Describe the enhancement:
Currently the Elastic Agent runs all of its providers all the time. Context providers are rather low overhead, but dynamic providers are not and when they are not even being used its adding load for no benefit to the running policy.
We should adjust the Elastic Agent to only run providers that are referenced in the policy. Variable referencing is always prefixed with a provider name aka ${kubernetes.*} that means its rather easy to identify which providers should be enabled based on what is in the policy.
This also removes the need to add any configuration to Fleet to disable or enable a provide for the Elastic Agent. If the policy from Fleet doesn't use a provider then the Elastic Agent will not run it.
Describe a specific use case for the enhancement or feature:
Reduce load of an Elastic Agent, prevents it from trying to communicate with Docker or Kubernetes in the case that its not even running a Docker or Kubernetes inputs in the policy.
What is the definition of done?
I propose the following change:
- Parse the policy into the AST.
- Read the AST to determine the providers that are referenced.
- Start/stop the providers that are referenced or no longer referenced.
Describe the enhancement:
Currently the Elastic Agent runs all of its providers all the time. Context providers are rather low overhead, but dynamic providers are not and when they are not even being used its adding load for no benefit to the running policy.
We should adjust the Elastic Agent to only run providers that are referenced in the policy. Variable referencing is always prefixed with a provider name aka
${kubernetes.*}that means its rather easy to identify which providers should be enabled based on what is in the policy.This also removes the need to add any configuration to Fleet to disable or enable a provide for the Elastic Agent. If the policy from Fleet doesn't use a provider then the Elastic Agent will not run it.
Describe a specific use case for the enhancement or feature:
Reduce load of an Elastic Agent, prevents it from trying to communicate with Docker or Kubernetes in the case that its not even running a Docker or Kubernetes inputs in the policy.
What is the definition of done?
I propose the following change: