[Observability serverless] turn on custom roles by default by dominiqueclarke · Pull Request #227878 · elastic/kibana

dominiqueclarke · 2025-07-14T16:40:59Z

Summary

Relates to #219861
Relates to https://github.com/elastic/observability-dev/issues/4539

Turns on Custom roles by default in serverless by turning on the feature flag

Original implementation found here.

Moves tests from the feature flag specific files to the standard files.

jeramysoucy

I noticed that we still have some tests that are specifically skipped for OBLT that can be unskipped now that we're enabling custom roles. Can we audit the code for instances like this and evaluate?

// custom roles are not enabled for observability projects
this.tags(['skipSvlOblt']);

jeramysoucy · 2025-07-15T14:35:57Z

config/serverless.oblt.yml


 # Disable role management (custom roles)
-xpack.security.roleManagementEnabled: false
+xpack.security.roleManagementEnabled: true


Nit: as this defaults to true, I think we can just remove it, along with the comment.

.../platform/test/api_integration_deployment_agnostic/default_configs/serverless.config.base.ts

mgiota

Code review, LGTM!

…no-cache --fix'

…in OBLT

jeramysoucy · 2025-07-16T15:13:23Z

x-pack/test_serverless/api_integration/config.base.ts

-          ...(options.serverlessProject !== 'oblt'
-            ? ['xpack.security.authc.native_roles.enabled=true']
-            : []),
+          'xpack.security.authc.native_roles.enabled=true',


Need to set the ES flag for all project types

jeramysoucy · 2025-07-16T15:14:26Z

x-pack/test_serverless/api_integration/test_suites/common/platform_security/authorization.ts

I updated this file to remove the skipSvlOblt tags that were preciously in place because custom roles was not yet supported on OBLT.

jeramysoucy · 2025-07-16T15:15:20Z

...test_serverless/api_integration/test_suites/observability/platform_security/authorization.ts

I removed the roles tests here, which are now run for OBLT from the common config/index.

jeramysoucy · 2025-07-16T15:15:49Z

x-pack/test_serverless/functional/config.base.ts

-          ...(options.serverlessProject !== 'oblt'
-            ? ['xpack.security.authc.native_roles.enabled=true']
-            : []),
+          'xpack.security.authc.native_roles.enabled=true',


Need to set the ES flag to enable native roles for all project types now.

jeramysoucy · 2025-07-16T15:16:46Z

...erverless/functional/test_suites/common/platform_security/navigation/management_nav_cards.ts

I removed the skipSvlOblt tags that were here to handle when custom roles was not yet supported.

...erverless/functional/test_suites/common/platform_security/navigation/management_nav_cards.ts

jeramysoucy · 2025-07-16T15:18:37Z

x-pack/test_serverless/functional/test_suites/common/platform_security/roles.ts

I removed the skipSvlOblt tags that were here to handle when custom roles was not yet supported.

github-actions · 2025-07-16T15:38:18Z

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

/oblt-deploy : Deploy a Kibana instance using the Observability test environments.
run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

…ault

… integration tests

…nfig defaults

csr

LGTM, left a few comments.

...tions/observability/test/api_integration_deployment_agnostic/apis/alerting/es_query/index.ts

...servability/test/api_integration_deployment_agnostic/apis/alerting/custom_threshold/index.ts

csr · 2025-07-17T09:30:37Z

x-pack/test_serverless/functional/test_suites/common/platform_security/roles.ts

  const platformSecurityUtils = getService('platformSecurityUtils');

  describe('Roles', function () {
-    // custom roles are not enabled for observability projects


@jeramysoucy is the comment at the top still relevant?

// Note: this suite is currently only called from the feature flags test config:
// x-pack/test_serverless/functional/test_suites/search/config.feature_flags.ts
// This can be moved into the common config groups once custom roles are enabled
// permanently in serverless.

awahab07 · 2025-07-17T11:04:32Z

x-pack/test_serverless/functional/test_suites/observability/index.ts

-    // loadTestFile(require.resolve('./rules/es_query_consumer'));
+    loadTestFile(require.resolve('./rules/custom_threshold_consumer'));
+    loadTestFile(require.resolve('./rules/es_query_consumer'));
+    loadTestFile(require.resolve('./role_management'));


kibana/x-pack/test_serverless/functional/test_suites/observability/role_management/custom_role_access.ts

Line 23 in 17c1381

this.tags(['skipMKI']);

The suite is skipped for MKI. Do we need to unskip it to be sure custom roles are working on MKI?

@dmlemeshko custom_role_access was added as an example, should it stay and be unkipped now that custom role management is enabled?

Addressed here.

…thub.com:dominiqueclarke/kibana into feature/observability-custom-roles-on-by-default

awahab07

obs-ux-logs changes LGTM

elasticmachine · 2025-07-17T13:54:56Z

💚 Build Succeeded

Buildkite Build
Commit: 7f8f6da
Kibana Serverless Image: docker.elastic.co/kibana-ci/kibana-serverless:pr-227878-7f8f6dad4c73

Metrics [docs]

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`serverlessObservability`	14.5KB	14.5KB	+2.0B

History

💚 Build #320325 succeeded 17c1381
💚 Build #320189 succeeded 8dac9b9
💔 Build #320117 failed 49b7cf5
💔 Build #319641 failed 90f63ac
💔 Build #319537 failed 0c26a6b

…27878) ## Summary Relates to elastic#219861 Relates to elastic/observability-dev#4539 Turns on Custom roles by default in serverless by turning on the feature flag Original implementation found [here](elastic#219861). Moves tests from the feature flag specific files to the standard files. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: “jeramysoucy” <jeramy.soucy@elastic.co>

github-actions bot added the author:obs-ux-management PRs authored by the obs ux management team label Jul 14, 2025

observability serverless - turn on custom roles by default

5970f48

dominiqueclarke force-pushed the feature/observability-custom-roles-on-by-default branch from cebc101 to 5970f48 Compare July 14, 2025 16:43

dominiqueclarke added release_note:enhancement v9.2.0 backport:skip This PR does not require backporting labels Jul 14, 2025

dominiqueclarke changed the title ~~observability serverless - turn on custom roles by default~~ [Observability serverless] turn on custom roles by default Jul 14, 2025

dominiqueclarke marked this pull request as ready for review July 14, 2025 16:45

dominiqueclarke requested review from a team as code owners July 14, 2025 16:45

remove unneccessary configuration

2d0f7bf

dominiqueclarke requested review from a team as code owners July 14, 2025 16:53

dominiqueclarke added 2 commits July 15, 2025 09:57

enable feature flag by default

eb349b0

adjust base configuration

478738d

dominiqueclarke requested a review from a team as a code owner July 15, 2025 14:00

jeramysoucy requested changes Jul 15, 2025

View reviewed changes

dominiqueclarke added 3 commits July 15, 2025 15:52

Update serverless.oblt.yml

0c26a6b

Update serverless.config.base.ts

dc8ae2b

Update serverless.config.base.ts

90f63ac

mgiota approved these changes Jul 16, 2025

View reviewed changes

dominiqueclarke and others added 4 commits July 16, 2025 09:19

Update config.feature_flags.ts

dae0563

Update config.feature_flags.ts

2ec5e53

[CI] Auto-commit changed files from 'node scripts/eslint_all_files --…

92ad783

…no-cache --fix'

Updates integration and functional tests to account for custom roles …

fcecb31

…in OBLT

jeramysoucy reviewed Jul 16, 2025

View reviewed changes

...erverless/functional/test_suites/common/platform_security/navigation/management_nav_cards.ts Outdated Show resolved Hide resolved

jeramysoucy reviewed Jul 16, 2025

View reviewed changes

Fixes org members nav card visibiility

049c79d

botelastic bot added the ci:project-deploy-observability Create an Observability project label Jul 16, 2025

dominiqueclarke and others added 3 commits July 16, 2025 13:09

Merge branch 'main' into feature/observability-custom-roles-on-by-def…

49b7cf5

…ault

add --xpack.security.roleManagementEnabled=true to functional and api…

8dac9b9

… integration tests

Updates the FTR serverless SAML auth provider to match the current co…

17c1381

…nfig defaults

jeramysoucy requested a review from a team as a code owner July 17, 2025 07:40

csr approved these changes Jul 17, 2025

View reviewed changes

awahab07 reviewed Jul 17, 2025

View reviewed changes

dominiqueclarke added 2 commits July 17, 2025 08:48

unskip tests in MKI

2e09361

Merge branch 'feature/observability-custom-roles-on-by-default' of gi…

7f8f6da

…thub.com:dominiqueclarke/kibana into feature/observability-custom-roles-on-by-default

awahab07 approved these changes Jul 17, 2025

View reviewed changes

jeramysoucy approved these changes Jul 17, 2025

View reviewed changes

Ikuni17 approved these changes Jul 17, 2025

View reviewed changes

pheyos merged commit 9149e15 into elastic:main Jul 18, 2025
12 checks passed

Conversation

dominiqueclarke commented Jul 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

jeramysoucy left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mgiota left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jeramysoucy Jul 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Jul 16, 2025

🤖 GitHub comments

Uh oh!

csr left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

awahab07 left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Jul 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💚 Build Succeeded

Metrics [docs]

Page load bundle

History

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

dominiqueclarke commented Jul 14, 2025 •

edited

Loading

jeramysoucy Jul 16, 2025 •

edited

Loading

elasticmachine commented Jul 17, 2025 •

edited

Loading