Skip to content

[ML] Add authorization info to ML config listings#87884

Merged
droberts195 merged 3 commits intoelastic:masterfrom
droberts195:auth_for_ml_listings
Jun 21, 2022
Merged

[ML] Add authorization info to ML config listings#87884
droberts195 merged 3 commits intoelastic:masterfrom
droberts195:auth_for_ml_listings

Conversation

@droberts195
Copy link
Copy Markdown

ML datafeeds and data frame analytics jobs remember permissions
from their time of creation or most recent update. It can be
quite hard to determine what these are when listing their
configs, which can lead to uncertainty about whether some minor
update changed the permissions.

This change adds information about the permissions to the
config listings.

If the last update was from a user then the permissions used
are the roles they had at the time, and a list of these roles
is added to the new authorization field of the datafeed or
data frame analytics job config listing.

If the last update was using an API key then the permissions
of that API key are used for subsequent searches and the new
authorization field of the datafeed or data frame analytics
job config listing shows the API key name and ID.

If a service account did the last update then the service
account name is added to the new authorization field of the
datafeed or data frame analytics job config listing.

ML datafeeds and data frame analytics jobs remember permissions
from their time of creation or most recent update. It can be
quite hard to determine what these are when listing their
configs, which can lead to uncertainty about whether some minor
update changed the permissions.

This change adds information about the permissions to the
config listings.

If the last update was from a user then the permissions used
are the roles they had at the time, and a list of these roles
is added to the new `authorization` field of the datafeed or
data frame analytics job config listing.

If the last update was using an API key then the permissions
of that API key are used for subsequent searches and the new
`authorization` field of the datafeed or data frame analytics
job config listing shows the API key name and ID.

If a service account did the last update then the service
account name is added to the new `authorization` field of the
datafeed or data frame analytics job config listing.
@elasticmachine elasticmachine added the Team:ML Meta label for the ML team label Jun 21, 2022
@elasticmachine
Copy link
Copy Markdown
Collaborator

Pinging @elastic/ml-core (Team:ML)

@elasticsearchmachine
Copy link
Copy Markdown
Collaborator

Hi @droberts195, I've created a changelog YAML for you.

@droberts195
Copy link
Copy Markdown
Author

Note: there is more unit testing for this functionality in #87570

@sethmlarson sethmlarson added the Team:Clients Meta label for clients team label Jun 21, 2022
@elasticmachine
Copy link
Copy Markdown
Collaborator

Pinging @elastic/clients-team (Team:Clients)

Copy link
Copy Markdown

@przemekwitek przemekwitek left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Same user but different roles
@droberts195
Copy link
Copy Markdown
Author

Jenkins run elasticsearch-ci/part-2

@droberts195 droberts195 merged commit 0d98910 into elastic:master Jun 21, 2022
@droberts195 droberts195 deleted the auth_for_ml_listings branch June 21, 2022 15:56
droberts195 added a commit that referenced this pull request Jun 23, 2022
#87884 added
authorization information to the datafeed and data frame
analytics job configs returned by listing them, but not to
the ones returned from creating or updating them. For
consistency it's best that the same fields are present in
both places.
droberts195 added a commit to droberts195/elasticsearch that referenced this pull request Dec 12, 2022
Due to elastic#41185 datafeeds created prior to 7.0 and not updated since
then have unparseable authorization headers in 8.x. In 8.0-8.3 this
could easily be a non-issue, as such datafeeds were likely forgotten
leftovers and never run. Even if it was a problem, only the datafeed
of interest would need updating with any urgency.

Due to elastic#87884 datafeeds with authorization headers older than 7.0
prevent _all_ datafeeds being listed in 8.4 and 8.5. This in turn
breaks the anomaly detection job management section of the ML UI.

The problem is alleviated by elastic#92168 and fixed by elastic#92221, but we
should warn users that the problem exists in 8.4.0-8.5.3 inclusive.
droberts195 added a commit that referenced this pull request Dec 13, 2022
…2274)

Due to #41185 datafeeds created prior to 7.0 and not updated since
then have unparseable authorization headers in 8.x. In 8.0-8.3 this
could easily be a non-issue, as such datafeeds were likely forgotten
leftovers and never run. Even if it was a problem, only the datafeed
of interest would need updating with any urgency.

Due to #87884 datafeeds with authorization headers older than 7.0
prevent _all_ datafeeds being listed in 8.4 and 8.5. This in turn
breaks the anomaly detection job management section of the ML UI.

The problem is alleviated by #92168 and fixed by #92221, but we
should warn users that the problem exists in 8.4.0-8.5.3 inclusive.
droberts195 added a commit to droberts195/elasticsearch that referenced this pull request Dec 13, 2022
…astic#92274)

Due to elastic#41185 datafeeds created prior to 7.0 and not updated since
then have unparseable authorization headers in 8.x. In 8.0-8.3 this
could easily be a non-issue, as such datafeeds were likely forgotten
leftovers and never run. Even if it was a problem, only the datafeed
of interest would need updating with any urgency.

Due to elastic#87884 datafeeds with authorization headers older than 7.0
prevent _all_ datafeeds being listed in 8.4 and 8.5. This in turn
breaks the anomaly detection job management section of the ML UI.

The problem is alleviated by elastic#92168 and fixed by elastic#92221, but we
should warn users that the problem exists in 8.4.0-8.5.3 inclusive.
elasticsearchmachine pushed a commit that referenced this pull request Dec 13, 2022
…2274) (#92318)

Due to #41185 datafeeds created prior to 7.0 and not updated since
then have unparseable authorization headers in 8.x. In 8.0-8.3 this
could easily be a non-issue, as such datafeeds were likely forgotten
leftovers and never run. Even if it was a problem, only the datafeed
of interest would need updating with any urgency.

Due to #87884 datafeeds with authorization headers older than 7.0
prevent _all_ datafeeds being listed in 8.4 and 8.5. This in turn
breaks the anomaly detection job management section of the ML UI.

The problem is alleviated by #92168 and fixed by #92221, but we
should warn users that the problem exists in 8.4.0-8.5.3 inclusive.
droberts195 added a commit to droberts195/elasticsearch that referenced this pull request Dec 13, 2022
Due to elastic#41185 datafeeds created prior to 7.0 and not updated since
then have unparseable authorization headers in 8.x. In 8.0-8.3 this
could easily be a non-issue, as such datafeeds were likely forgotten
leftovers and never run. Even if it was a problem, only the datafeed
of interest would need updating with any urgency.

Due to elastic#87884 datafeeds with authorization headers older than 7.0
prevent _all_ datafeeds being listed in 8.4 and 8.5. This in turn
breaks the anomaly detection job management section of the ML UI.

The problem is alleviated by elastic#92168 and fixed by elastic#92221, but we
should warn users that the problem exists in 8.4.0-8.5.3 inclusive.

Backport of elastic#92274
droberts195 added a commit to droberts195/elasticsearch that referenced this pull request Dec 13, 2022
Due to elastic#41185 datafeeds created prior to 7.0 and not updated since
then have unparseable authorization headers in 8.x. In 8.0-8.3 this
could easily be a non-issue, as such datafeeds were likely forgotten
leftovers and never run. Even if it was a problem, only the datafeed
of interest would need updating with any urgency.

Due to elastic#87884 datafeeds with authorization headers older than 7.0
prevent _all_ datafeeds being listed in 8.4 and 8.5. This in turn
breaks the anomaly detection job management section of the ML UI.

The problem is alleviated by elastic#92168 and fixed by elastic#92221, but we
should warn users that the problem exists in 8.4.0-8.5.3 inclusive.

Backport of elastic#92274
elasticsearchmachine pushed a commit that referenced this pull request Dec 13, 2022
…em (#92323)

Due to #41185 datafeeds created prior to 7.0 and not updated since
then have unparseable authorization headers in 8.x. In 8.0-8.3 this
could easily be a non-issue, as such datafeeds were likely forgotten
leftovers and never run. Even if it was a problem, only the datafeed
of interest would need updating with any urgency.

Due to #87884 datafeeds with authorization headers older than 7.0
prevent _all_ datafeeds being listed in 8.4 and 8.5. This in turn
breaks the anomaly detection job management section of the ML UI.

The problem is alleviated by #92168 and fixed by #92221, but we
should warn users that the problem exists in 8.4.0-8.5.3 inclusive.

Backport of #92274
droberts195 added a commit that referenced this pull request Dec 13, 2022
…em (#92324)

Due to #41185 datafeeds created prior to 7.0 and not updated since
then have unparseable authorization headers in 8.x. In 8.0-8.3 this
could easily be a non-issue, as such datafeeds were likely forgotten
leftovers and never run. Even if it was a problem, only the datafeed
of interest would need updating with any urgency.

Due to #87884 datafeeds with authorization headers older than 7.0
prevent _all_ datafeeds being listed in 8.4 and 8.5. This in turn
breaks the anomaly detection job management section of the ML UI.

The problem is alleviated by #92168 and fixed by #92221, but we
should warn users that the problem exists in 8.4.0-8.5.3 inclusive.

Backport of #92274
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

>enhancement :ml Machine learning Team:Clients Meta label for clients team Team:ML Meta label for the ML team v8.4.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants