Skip to content

Run only providers that have references in the policy #3609

@blakerouse

Description

@blakerouse

Describe the enhancement:

Currently the Elastic Agent runs all of its providers all the time. Context providers are rather low overhead, but dynamic providers are not and when they are not even being used its adding load for no benefit to the running policy.

We should adjust the Elastic Agent to only run providers that are referenced in the policy. Variable referencing is always prefixed with a provider name aka ${kubernetes.*} that means its rather easy to identify which providers should be enabled based on what is in the policy.

This also removes the need to add any configuration to Fleet to disable or enable a provide for the Elastic Agent. If the policy from Fleet doesn't use a provider then the Elastic Agent will not run it.

Describe a specific use case for the enhancement or feature:

Reduce load of an Elastic Agent, prevents it from trying to communicate with Docker or Kubernetes in the case that its not even running a Docker or Kubernetes inputs in the policy.

What is the definition of done?

I propose the following change:

  1. Parse the policy into the AST.
  2. Read the AST to determine the providers that are referenced.
  3. Start/stop the providers that are referenced or no longer referenced.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions