[ResponseOps] Update kibana system user with esql view permissions. by adcoelho · Pull Request #143568 · elastic/elasticsearch

adcoelho · 2026-03-04T11:16:54Z

Summary

We want to allow the Kibana system user to be able to manage ESQL views.

The permissions create_view, manage_view, and manage are the ones required in the error output when using the esClient to create a new view on startup.

I also updated the tests to include the ESQLViewActionNames, I hope that is correct.

elasticsearchmachine · 2026-03-04T11:17:19Z

Pinging @elastic/es-security (Team:Security)

rgodfrey-elastic · 2026-03-04T17:07:52Z

...va/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java

-                RoleDescriptor.IndicesPrivileges.builder().indices(ReservedRolesStore.ALERTING_V2_INDEX_ALIAS).privileges("all").build(),
+                RoleDescriptor.IndicesPrivileges.builder()
+                    .indices(ReservedRolesStore.ALERTING_V2_INDEX_ALIAS)
+                    .privileges("create_view", "manage_view", "manage", "all")


I think you only need to grant create_view here and that the error message indicates any of create_view, manage_view, or manage will grant the indices:admin/esql/view/put action.

https://github.com/elastic/elasticsearch/blob/main/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/privilege/IndexPrivilegeTests.java#L78

That test indicates that all should also grant the necessary action, which was already granted. So I'm wondering if this will actually fix your issue.

all already grants any view (and index) actions. If you're running into issues let me know and I can try to help out.

all is indices:*, manage is indices:admin/*, manage_view is indices:admin/esql/view* and the PUT, GET and DELETE operations are indices:admin/esql/view/put|get|delete.

rgodfrey-elastic · 2026-03-04T17:09:50Z

Is this PR attempting to solve the same problem as #143455 ? The titles are almost the same but are modifying different indices

jfreden

all should already cover this. Let me know if you're running into issues and I can try to help out over slack or zoom. Thanks!

jfreden · 2026-03-05T07:51:42Z

...va/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java

-                RoleDescriptor.IndicesPrivileges.builder().indices(ReservedRolesStore.ALERTING_V2_INDEX_ALIAS).privileges("all").build(),
+                RoleDescriptor.IndicesPrivileges.builder()
+                    .indices(ReservedRolesStore.ALERTING_V2_INDEX_ALIAS)
+                    .privileges("create_view", "manage_view", "manage", "all")


all already grants any view (and index) actions. If you're running into issues let me know and I can try to help out.

all is indices:*, manage is indices:admin/*, manage_view is indices:admin/esql/view* and the PUT, GET and DELETE operations are indices:admin/esql/view/put|get|delete.

adcoelho · 2026-03-05T09:39:06Z

After a chat with @jfreden, I understood the original call to the API was failing because the role did not have all privileges for the view name. I thought they were only necessary for the source index, so .alerting-foobar -> alerting-foobar was failing.

In addition to that, after our chat, I decided to go for the $. prefix convention for the view name.

I changed the PR to target $.alerting*.

jfreden · 2026-03-05T10:03:26Z

...va/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java

                // "Alerting V2" indexes
                RoleDescriptor.IndicesPrivileges.builder().indices(ReservedRolesStore.ALERTING_V2_INDEX_ALIAS).privileges("all").build(),
+                // "Alerting V2" views prefix
+                RoleDescriptor.IndicesPrivileges.builder().indices(ReservedRolesStore.ALERTING_V2_VIEWS).privileges("all").build(),


Do you need all here? Since this is only managing views you should at most need manage_view (all CRUD). What are the operations you're planning on doing? If it's only adding views, I'd stick to create_view otherwise manage_view.

When you mentioned above that:

all already grants any view (and index) actions.

I assumed that was the required privilege for the view name, too.

I realize now that it is still a superset of what we actually need. I will change to create_view.

jfreden

LGTM!

## Summary **The focus of this PR is the view creation logic. I will create a follow-up PR with an `$.alerting-episodes` view when we decide which fields we want on the alerts table.** This PR adds startup initialization of ES|QL views in the Alerting v2 plugin(in addition to the existing data stream resource setup). Views are created in Elasticsearch via the `/_query/view` API, so alerting can use them. [There is currently a separate PR in the Elasticsearch repo](elastic/elasticsearch#143568) that updates the Kibana system user permissions to allow for the ESQL view management. The views created by this PR are: ``` $.alerting-events -> FROM .alerting-events $.alerting-actions -> FROM .alerting-actions ```

…lastic#143568) * Adds alerting v2 views permissions. * Change alerting v2 view privileges to create_view only. * [CI] Auto commit changes from spotless --------- Co-authored-by: elasticsearchmachine <infra-root+elasticsearchmachine@elastic.co>

…sions. (elastic#143568)" This reverts commit 3251506.

…sions. (#143568)" (#143871) This reverts commit 3251506.

adcoelho self-assigned this Mar 4, 2026

adcoelho requested a review from a team as a code owner March 4, 2026 11:16

adcoelho requested a review from rgodfrey-elastic March 4, 2026 11:16

adcoelho added >non-issue :Security/Authorization Roles, Privileges, DLS/FLS, RBAC/ABAC Team:Security Meta label for security team v9.4.0 labels Mar 4, 2026

adcoelho mentioned this pull request Mar 4, 2026

[ResponseOps][Alerting V2] ESQL views elastic/kibana#255968

Merged

rgodfrey-elastic reviewed Mar 4, 2026

View reviewed changes

jfreden requested changes Mar 5, 2026

View reviewed changes

Adds alerting v2 views permissions.

f34062c

adcoelho force-pushed the alerting-v2-esql-views-permissions branch from 5aa417d to f34062c Compare March 5, 2026 09:35

adcoelho requested a review from a team as a code owner March 5, 2026 09:35

jfreden reviewed Mar 5, 2026

View reviewed changes

adcoelho and others added 2 commits March 5, 2026 16:07

Change alerting v2 view privileges to create_view only.

355a52f

[CI] Auto commit changes from spotless

7f8c704

rgodfrey-elastic approved these changes Mar 5, 2026

View reviewed changes

jfreden approved these changes Mar 6, 2026

View reviewed changes

adcoelho merged commit 3251506 into elastic:main Mar 6, 2026
41 checks passed

prwhelan mentioned this pull request Mar 6, 2026

[ML] Wait for cluster state in test #143767

Merged

jfreden added a commit to jfreden/elasticsearch that referenced this pull request Mar 9, 2026

Revert "[ResponseOps] Update kibana system user with esql view permis…

ef76275

…sions. (elastic#143568)" This reverts commit 3251506.

jfreden mentioned this pull request Mar 9, 2026

Revert "[ResponseOps] Update kibana system user with esql view permis… #143871

Merged

prwhelan mentioned this pull request Mar 9, 2026

[Transform] Disable PIT for CPS #143876

Closed

jfreden added a commit that referenced this pull request Mar 9, 2026

Revert "[ResponseOps] Update kibana system user with esql view permis…

c01bc2a

…sions. (#143568)" (#143871) This reverts commit 3251506.

jfreden mentioned this pull request Mar 10, 2026

Add back create_view as raw action privilege for kibana system #143931

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[ResponseOps] Update kibana system user with esql view permissions.#143568

[ResponseOps] Update kibana system user with esql view permissions.#143568
adcoelho merged 3 commits intoelastic:mainfrom
adcoelho:alerting-v2-esql-views-permissions

adcoelho commented Mar 4, 2026

Uh oh!

elasticsearchmachine commented Mar 4, 2026

Uh oh!

rgodfrey-elastic Mar 4, 2026

Uh oh!

jfreden Mar 5, 2026

Uh oh!

rgodfrey-elastic commented Mar 4, 2026

Uh oh!

jfreden left a comment

Uh oh!

jfreden Mar 5, 2026

Uh oh!

adcoelho commented Mar 5, 2026

Uh oh!

jfreden Mar 5, 2026

Uh oh!

adcoelho Mar 5, 2026

Uh oh!

jfreden left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

adcoelho commented Mar 4, 2026

Summary

Uh oh!

elasticsearchmachine commented Mar 4, 2026

Uh oh!

rgodfrey-elastic Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

jfreden Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

rgodfrey-elastic commented Mar 4, 2026

Uh oh!

jfreden left a comment

Choose a reason for hiding this comment

Uh oh!

jfreden Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

adcoelho commented Mar 5, 2026

Uh oh!

jfreden Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

adcoelho Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

jfreden left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants