Skip to content

Commit 55514d3

Browse files
kibanamachinekibanamachine
authored
Merge branch '8.8' into backport/8.8/pr-155829
2 parents b95fa2b + a387c0f commit 55514d3

30 files changed

Lines changed: 666 additions & 87 deletions

File tree

‎config/serverless.oblt.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
1+
uiSettings.overrides.defaultRoute: /app/observability/overview
12
xpack.infra.logs.app_target: discover

‎docs/settings/alert-action-settings.asciidoc‎

Lines changed: 17 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,14 @@
1-
[role="xpack"]
21
[[alert-action-settings-kb]]
3-
=== Alerting and action settings in {kib}
2+
== Alerting and action settings in {kib}
43
++++
54
<titleabbrev>Alerting and action settings</titleabbrev>
65
++++
76

7+
:description: Learn about the settings that affect {kib} {alert-features}.
8+
:tags-products: [kibana, alerting]
9+
:tags-content-type: [reference]
10+
:tags-user-goals: [configure]
11+
812
Alerting and actions are enabled by default in {kib}, but require you to configure the following:
913

1014
. <<using-kibana-with-security,Set up {kib} to work with {stack} {security-features}>>.
@@ -15,7 +19,7 @@ You can configure the following settings in the `kibana.yml` file.
1519

1620
[float]
1721
[[general-alert-action-settings]]
18-
==== General settings
22+
=== General settings
1923

2024
`xpack.encryptedSavedObjects.encryptionKey`::
2125
A string of 32 or more characters used to encrypt sensitive properties on alerting rules and actions before they're stored in {es}. Third party credentials &mdash; such as the username and password used to connect to an SMTP service &mdash; are an example of encrypted properties.
@@ -29,7 +33,7 @@ Be sure to back up the encryption key value somewhere safe, as your alerting rul
2933

3034
[float]
3135
[[action-settings]]
32-
==== Action settings
36+
=== Action settings
3337

3438
`xpack.actions.allowedHosts` {ess-icon}::
3539
A list of hostnames that {kib} is allowed to connect to when built-in actions are triggered. It defaults to `[*]`, allowing any host, but keep in mind the potential for SSRF attacks when hosts are not explicitly added to the allowed hosts. An empty list `[]` can be used to block built-in actions from making any external connections.
@@ -71,7 +75,7 @@ xpack.actions.customHostSettings:
7175
ssl:
7276
verificationMode: 'none'
7377
--
74-
78+
+
7579
The settings in `xpack.actions.customHostSettings` can be used to override the
7680
global option `xpack.actions.ssl.verificationMode` and provide customized TLS
7781
settings on a per-server basis. Set `xpack.actions.ssl.verificationMode` to the
@@ -107,7 +111,7 @@ The options `smtp.ignoreTLS` and `smtp.requireTLS` can not both be set to true.
107111
Default: `false`.
108112

109113
`xpack.actions.customHostSettings[n].ssl.rejectUnauthorized`::
110-
Deprecated. Use <<action-config-custom-host-verification-mode,`xpack.actions.customHostSettings.ssl.verificationMode`>> instead. A boolean value indicating whether to bypass server certificate validation.
114+
deprecated:[8.0.0] Use <<action-config-custom-host-verification-mode,`xpack.actions.customHostSettings.ssl.verificationMode`>> instead. A boolean value indicating whether to bypass server certificate validation.
111115
Overrides the general `xpack.actions.rejectUnauthorized` configuration
112116
for requests made for this hostname/port.
113117

@@ -127,7 +131,7 @@ the files cannot be made available.
127131

128132
[[action-config-email-domain-allowlist]] `xpack.actions.email.domain_allowlist` {ess-icon}::
129133
A list of allowed email domains which can be used with the email connector. When this setting is not used, all email domains are allowed. When this setting is used, if any email is attempted to be sent that (a) includes an addressee with an email domain that is not in the allowlist, or (b) includes a from address domain that is not in the allowlist, it will fail with a message indicating the email is not allowed.
130-
134+
+
131135
WARNING: This feature is available in {kib} 7.17.4 and 8.3.0 onwards but is not supported in {kib} 8.0, 8.1 or 8.2. As such, this setting should be removed before upgrading from 7.17 to 8.0, 8.1 or 8.2. It is possible to configure the settings in 7.17.4 and then upgrade to 8.3.0 directly.
132136

133137
`xpack.actions.enableFooterInEmail` {ess-icon}::
@@ -160,8 +164,6 @@ proxy in tunneling mode, and display some of the interaction between the client
160164
--
161165
curl --verbose --proxytunnel --proxy http://localhost:8080 http://example.com
162166
--
163-
+
164-
165167

166168
`xpack.actions.proxyBypassHosts` {ess-icon}::
167169
Specifies hostnames which should not use the proxy, if using a proxy for actions. The value is an array of hostnames as strings. By default, all hosts will use the proxy, but if an action's hostname is in this list, the proxy will not be used. The settings `xpack.actions.proxyBypassHosts` and `xpack.actions.proxyOnlyHosts` cannot be used at the same time.
@@ -173,14 +175,14 @@ Specifies hostnames which should only use the proxy, if using a proxy for action
173175
Specifies HTTP headers for the proxy, if using a proxy for actions. Default: {}.
174176

175177
`xpack.actions.proxyRejectUnauthorizedCertificates` {ess-icon}::
176-
Deprecated. Use <<action-config-proxy-verification-mode,`xpack.actions.ssl.proxyVerificationMode`>> instead. Set to `false` to bypass certificate validation for the proxy, if using a proxy for actions. Default: `true`.
178+
deprecated:[8.0.0] Use <<action-config-proxy-verification-mode,`xpack.actions.ssl.proxyVerificationMode`>> instead. Set to `false` to bypass certificate validation for the proxy, if using a proxy for actions. Default: `true`.
177179

178180
[[action-config-proxy-verification-mode]]`xpack.actions.ssl.proxyVerificationMode` {ess-icon}::
179181
Controls the verification for the proxy server certificate that Kibana receives when making an outbound SSL/TLS connection to the proxy server. Valid values are `full`, `certificate`, and `none`.
180182
Use `full` to perform hostname verification, `certificate` to skip hostname verification, and `none` to skip verification. Default: `full`. <<elasticsearch-ssl-verificationMode,Equivalent {kib} setting>>.
181183

182184
`xpack.actions.rejectUnauthorized` {ess-icon}::
183-
Deprecated. Use <<action-config-verification-mode,`xpack.actions.ssl.verificationMode`>> instead. Set to `false` to bypass certificate validation for actions. Default: `true`.
185+
deprecated:[8.0.0] Use <<action-config-verification-mode,`xpack.actions.ssl.verificationMode`>> instead. Set to `false` to bypass certificate validation for actions. Default: `true`.
184186
+
185187
As an alternative to setting `xpack.actions.rejectUnauthorized`, you can use the setting
186188
`xpack.actions.customHostSettings` to set SSL options for specific servers.
@@ -206,9 +208,8 @@ For example, `20m`, `24h`, `7d`, `1w`. Default: `60s`.
206208
Specifies the maximum number of times an action can be attempted to run. Can be minimum 1 and maximum 10.
207209

208210
`xpack.actions.run.connectorTypeOverrides` {ess-icon}::
209-
Overrides the configs under `xpack.actions.run` for the connector type with the given ID. List the connector type identifier and its settings in an array of objects.
211+
Overrides the configs under `xpack.actions.run` for the connector type with the given ID. List the connector type identifier and its settings in an array of objects. For example:
210212
+
211-
For example:
212213
[source,yaml]
213214
--
214215
xpack.actions.run:
@@ -220,7 +221,7 @@ xpack.actions.run:
220221

221222
[float]
222223
[[alert-settings]]
223-
==== Alerting settings
224+
=== Alerting settings
224225

225226
`xpack.alerting.maxEphemeralActionsPerAlert` {ess-icon}::
226227
deprecated:[8.8.0]
@@ -257,9 +258,8 @@ Specifies the default timeout for tasks associated with all types of rules. The
257258
For example, `20m`, `24h`, `7d`, `1w`. Default: `5m`.
258259

259260
`xpack.alerting.rules.run.ruleTypeOverrides` {ess-icon}::
260-
Overrides the configs under `xpack.alerting.rules.run` for the rule type with the given ID. List the rule identifier and its settings in an array of objects.
261+
Overrides the configs under `xpack.alerting.rules.run` for the rule type with the given ID. List the rule identifier and its settings in an array of objects. For example:
261262
+
262-
For example:
263263
[source,yaml]
264264
--
265265
xpack.alerting.rules.run:
@@ -270,9 +270,8 @@ xpack.alerting.rules.run:
270270
--
271271

272272
`xpack.alerting.rules.run.actions.connectorTypeOverrides` {ess-icon}::
273-
Overrides the configs under `xpack.alerting.rules.run.actions` for the connector type with the given ID. List the connector type identifier and its settings in an array of objects.
273+
Overrides the configs under `xpack.alerting.rules.run.actions` for the connector type with the given ID. List the connector type identifier and its settings in an array of objects. For example:
274274
+
275-
For example:
276275
[source,yaml]
277276
--
278277
xpack.alerting.rules.run:

‎docs/setup/settings.asciidoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -619,7 +619,7 @@ Set this value to false to disable the Upgrade Assistant UI. *Default: true*
619619
Set this value to change the {kib} interface language.
620620
Valid locales are: `en`, `zh-CN`, `ja-JP`. *Default: `en`*
621621

622-
include::{kib-repo-dir}/settings/alert-action-settings.asciidoc[]
622+
include::{kib-repo-dir}/settings/alert-action-settings.asciidoc[leveloffset=+1]
623623
include::{kib-repo-dir}/settings/apm-settings.asciidoc[]
624624
include::{kib-repo-dir}/settings/banners-settings.asciidoc[]
625625
include::{kib-repo-dir}/settings/cases-settings.asciidoc[leveloffset=+1]

‎packages/core/root/core-root-server-internal/src/bootstrap.test.mocks.ts‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License
4+
* 2.0 and the Server Side Public License, v 1; you may not use this file except
5+
* in compliance with, at your election, the Elastic License 2.0 or the Server
6+
* Side Public License, v 1.
7+
*/
8+
9+
import { Env } from '@kbn/config';
10+
import { rawConfigServiceMock, configServiceMock } from '@kbn/config-mocks';
11+
12+
export const mockConfigService = configServiceMock.create();
13+
export const mockRawConfigService = rawConfigServiceMock.create();
14+
export const mockRawConfigServiceConstructor = jest.fn(() => mockRawConfigService);
15+
jest.doMock('@kbn/config', () => ({
16+
ConfigService: jest.fn(() => mockConfigService),
17+
Env,
18+
RawConfigService: jest.fn(mockRawConfigServiceConstructor),
19+
}));
20+
21+
jest.doMock('./root', () => ({
22+
Root: jest.fn(() => ({
23+
shutdown: jest.fn(),
24+
})),
25+
}));

‎packages/core/root/core-root-server-internal/src/bootstrap.test.ts‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License
4+
* 2.0 and the Server Side Public License, v 1; you may not use this file except
5+
* in compliance with, at your election, the Elastic License 2.0 or the Server
6+
* Side Public License, v 1.
7+
*/
8+
9+
import { of } from 'rxjs';
10+
import type { CliArgs } from '@kbn/config';
11+
12+
import { mockRawConfigService, mockRawConfigServiceConstructor } from './bootstrap.test.mocks';
13+
14+
jest.mock('@kbn/core-logging-server-internal');
15+
16+
import { bootstrap } from './bootstrap';
17+
18+
const bootstrapCfg = {
19+
configs: ['config/kibana.yml'],
20+
cliArgs: {} as unknown as CliArgs,
21+
applyConfigOverrides: () => ({}),
22+
};
23+
24+
describe('bootstrap', () => {
25+
describe('serverless', () => {
26+
beforeEach(() => {
27+
jest.clearAllMocks();
28+
});
29+
30+
test('should load additional serverless files for a valid project', async () => {
31+
mockRawConfigService.getConfig$.mockReturnValue(of({ serverless: 'es' }));
32+
await bootstrap(bootstrapCfg);
33+
expect(mockRawConfigServiceConstructor).toHaveBeenCalledTimes(2);
34+
expect(mockRawConfigServiceConstructor).toHaveBeenNthCalledWith(
35+
1,
36+
bootstrapCfg.configs,
37+
bootstrapCfg.applyConfigOverrides
38+
);
39+
expect(mockRawConfigServiceConstructor).toHaveBeenNthCalledWith(
40+
2,
41+
[
42+
expect.stringContaining('config/serverless.yml'),
43+
expect.stringContaining('config/serverless.es.yml'),
44+
...bootstrapCfg.configs,
45+
],
46+
bootstrapCfg.applyConfigOverrides
47+
);
48+
});
49+
50+
test('should skip loading the serverless files for an invalid project', async () => {
51+
mockRawConfigService.getConfig$.mockReturnValue(of({ serverless: 'not-valid' }));
52+
await bootstrap(bootstrapCfg);
53+
expect(mockRawConfigServiceConstructor).toHaveBeenCalledTimes(1);
54+
expect(mockRawConfigServiceConstructor).toHaveBeenNthCalledWith(
55+
1,
56+
bootstrapCfg.configs,
57+
bootstrapCfg.applyConfigOverrides
58+
);
59+
});
60+
});
61+
});

‎packages/core/root/core-root-server-internal/src/bootstrap.ts‎

Lines changed: 44 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,14 @@
77
*/
88

99
import chalk from 'chalk';
10+
import { firstValueFrom } from 'rxjs';
1011
import { getPackages } from '@kbn/repo-packages';
1112
import { CliArgs, Env, RawConfigService } from '@kbn/config';
1213
import { CriticalError } from '@kbn/core-base-server-internal';
14+
import { resolve } from 'path';
15+
import { getConfigDirectory } from '@kbn/utils';
16+
import { statSync } from 'fs';
17+
import { VALID_SERVERLESS_PROJECT_TYPES } from './root/serverless_config';
1318
import { Root } from './root';
1419
import { MIGRATION_EXCEPTION_CODE } from './constants';
1520

@@ -38,15 +43,40 @@ export async function bootstrap({ configs, cliArgs, applyConfigOverrides }: Boot
3843
// eslint-disable-next-line @typescript-eslint/no-var-requires
3944
const { REPO_ROOT } = require('@kbn/repo-info');
4045

41-
const env = Env.createDefault(REPO_ROOT, {
46+
let env = Env.createDefault(REPO_ROOT, {
4247
configs,
4348
cliArgs,
4449
repoPackages: getPackages(REPO_ROOT),
4550
});
4651

47-
const rawConfigService = new RawConfigService(env.configs, applyConfigOverrides);
52+
let rawConfigService = new RawConfigService(env.configs, applyConfigOverrides);
4853
rawConfigService.loadConfig();
4954

55+
// Hack to load the extra serverless config files if `serverless: {projectType}` is found in it.
56+
const rawConfig = await firstValueFrom(rawConfigService.getConfig$());
57+
const serverlessProjectType = rawConfig?.serverless;
58+
if (
59+
typeof serverlessProjectType === 'string' &&
60+
VALID_SERVERLESS_PROJECT_TYPES.includes(serverlessProjectType)
61+
) {
62+
const extendedConfigs = [
63+
...['serverless.yml', `serverless.${serverlessProjectType}.yml`]
64+
.map((name) => resolve(getConfigDirectory(), name))
65+
.filter(configFileExists),
66+
...configs,
67+
];
68+
69+
env = Env.createDefault(REPO_ROOT, {
70+
configs: extendedConfigs,
71+
cliArgs: { ...cliArgs, serverless: true },
72+
repoPackages: getPackages(REPO_ROOT),
73+
});
74+
75+
rawConfigService.stop();
76+
rawConfigService = new RawConfigService(env.configs, applyConfigOverrides);
77+
rawConfigService.loadConfig();
78+
}
79+
5080
const root = new Root(rawConfigService, env, onRootShutdown);
5181

5282
process.on('SIGHUP', () => reloadConfiguration());
@@ -128,3 +158,15 @@ function onRootShutdown(reason?: any) {
128158

129159
process.exit(0);
130160
}
161+
162+
function configFileExists(path: string) {
163+
try {
164+
return statSync(path).isFile();
165+
} catch (err) {
166+
if (err.code === 'ENOENT') {
167+
return false;
168+
}
169+
170+
throw err;
171+
}
172+
}

‎packages/core/root/core-root-server-internal/src/register_service_config.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ import { uiSettingsConfig } from '@kbn/core-ui-settings-server-internal';
2828

2929
import { config as pluginsConfig } from '@kbn/core-plugins-server-internal';
3030
import { elasticApmConfig } from './root/elastic_config';
31+
import { serverlessConfig } from './root/serverless_config';
3132

3233
const rootConfigPath = '';
3334

@@ -49,6 +50,7 @@ export function registerServiceConfig(configService: ConfigService) {
4950
pluginsConfig,
5051
savedObjectsConfig,
5152
savedObjectsMigrationConfig,
53+
serverlessConfig,
5254
statusConfig,
5355
uiSettingsConfig,
5456
];

‎packages/core/root/core-root-server-internal/src/root/serverless_config.ts‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License
4+
* 2.0 and the Server Side Public License, v 1; you may not use this file except
5+
* in compliance with, at your election, the Elastic License 2.0 or the Server
6+
* Side Public License, v 1.
7+
*/
8+
9+
import { schema, TypeOf, Type } from '@kbn/config-schema';
10+
import { ServiceConfigDescriptor } from '@kbn/core-base-server-internal';
11+
12+
// Config validation for how to run Kibana in Serverless mode.
13+
// Clients need to specify the project type to run in.
14+
// Going for a simple `serverless` string because it serves as
15+
// a direct replacement to the legacy --serverless CLI flag.
16+
// If we even decide to extend this further, and converting it into an object,
17+
// BWC can be ensured by adding the object definition as another alternative to `schema.oneOf`.
18+
19+
export const VALID_SERVERLESS_PROJECT_TYPES = ['es', 'oblt', 'security'];
20+
21+
const serverlessConfigSchema = schema.maybe(
22+
schema.oneOf(
23+
VALID_SERVERLESS_PROJECT_TYPES.map((projectName) => schema.literal(projectName)) as [
24+
Type<typeof VALID_SERVERLESS_PROJECT_TYPES[number]> // This cast is needed because it's different to Type<T>[] :sight:
25+
]
26+
)
27+
);
28+
29+
export type ServerlessConfigType = TypeOf<typeof serverlessConfigSchema>;
30+
31+
export const serverlessConfig: ServiceConfigDescriptor<ServerlessConfigType> = {
32+
path: 'serverless',
33+
schema: serverlessConfigSchema,
34+
};

0 commit comments

Comments
 (0)