[doc] fix the necessary privileges of central pipeline management #16902

kaisecheng · 2025-01-15T20:10:16Z

This commit updated the instructions of using central pipeline management with the necessary privileges

fixes: #16905
relates: https://github.com/elastic/ingest-dev/issues/4812

github-actions · 2025-01-15T20:33:05Z

📃 DOCS PREVIEW ✨ https://logstash_bk_16902.docs-preview.app.elstc.co/diff

kaisecheng · 2025-01-15T21:33:21Z

docs/static/security/api-keys.asciidoc

@@ -249,8 +249,7 @@ POST /_security/api_key
  "name": "logstash_host001", <1>
  "role_descriptors": {
    "logstash_monitoring": { <2>
-      "cluster": ["monitor"],
-      "index": ["read"]


it gives syntax error

kaisecheng · 2025-01-15T21:35:51Z

docs/static/security/grant-access.asciidoc

+  "indices": [
+    {
+      "names": [ "logstash-*" ],
+      "privileges": ["read","view_index_metadata"]
+    }
+  ]


These few lines were unfortunately removed by me five years ago

Nice, thanks for fixing this. Indeed names and privileges are required fields.

kaisecheng · 2025-01-15T21:46:18Z

docs/static/security/grant-access.asciidoc

 }
 ---------------------------------------------------------------

 . Assign your Logstash users the `logstash_reader` role. If the Logstash user
 will be using
 {logstash-ref}/logstash-centralized-pipeline-management.html[centralized pipeline management],
-also assign the `logstash_admin` role. You can create and manage users from the
+also assign the `logstash_system` role. You can create and manage users from the


we need cluster privilege "monitor" to query /_xpack when using central pipeline management.

Elasticsearch has two built-in roles: logstash_admin, logstash_system
logstash_admin

{ "cluster": ["manage_logstash_pipelines"], "indices": [ { "names": [ ".logstash*" ], "privileges": ["create","read","delete","index","manage"] } ] }

logstash_system

{ "cluster": ["monitor", "cluster:admin/xpack/monitoring/bulk"] }

So, we need logstash_system here

kaisecheng · 2025-01-15T21:53:47Z

docs/static/settings/configuration-management-settings.asciidoc

-should have the built-in `logstash_admin` role and the customized `logstash_writer` role, which provides access to system
-indices for managing configurations. Starting with Elasticsearch version 7.10.0, the
-`logstash_admin` role inherits the `manage_logstash_pipelines` cluster privilege for centralized pipeline management.
+should have the built-in `logstash_admin` role and `logstash_system` role, which provides access to system


The original doc recommend to create a new role logstash_writer for writing indices and for central pipeline management.

logstash_writer

{ "cluster": ["manage_index_templates", "monitor", "manage_ilm"], "indices": [ { "names": [ "logstash-*" ], "privileges": ["write","create","create_index","manage","manage_ilm"] } ] }

I think using logstash_system is more align to other examples and user has less step to follow.

kaisecheng · 2025-01-15T21:55:37Z

docs/static/settings/configuration-management-settings.asciidoc

+should have the built-in `logstash_admin` role and `logstash_system` role, which provides access to system
+indices for managing configurations.
+
+NOTE: Starting with Elasticsearch version 7.10.0, the `logstash_admin` role inherits the `manage_logstash_pipelines` cluster privilege for centralized pipeline management.


In Logstash 9, we can consider to remove this note about upgrading from 7.x

Can we create an issue and follow up once we land this change? Thank you!

kaisecheng · 2025-01-15T21:56:41Z

docs/static/settings/configuration-management-settings.asciidoc

@@ -143,8 +144,8 @@ If you're using {es} in {ecloud}, you can set your auth credentials here.
 This setting is an alternative to both `xpack.management.elasticsearch.username`
 and `xpack.management.elasticsearch.password`. If `cloud_auth` is configured,
 those settings should not be used.
-The credentials you specify here should be for a user with the `logstash_admin` role, which
-provides access to system indices for managing configurations.
+The credentials you specify here should be for a user with the `logstash_admin` and `logstash_system` roles, which


xpack feature need to call /_xpack, so logstash_system is a must

karenzone

Builds and renders cleanly. Left minor comments inline for consideration. Otherwise, LGTM.

NOTE: I did a docs-only review, and I did not test these changes to validate them.

karenzone · 2025-01-22T22:55:03Z

docs/static/security/grant-access.asciidoc

@@ -1,6 +1,6 @@
 [discrete]
 [[ls-user-access]]
-=== Granting access to the Logstash indices
+=== Granting access to the indices Logstash creates


Ohhhhh, I LIKE this. Nice clarification.

docs/static/settings/configuration-management-settings.asciidoc

mashhurs

I have suggested nits, tested and LGTM!

mashhurs · 2025-01-23T01:43:44Z

docs/static/security/grant-access.asciidoc

+  "indices": [
+    {
+      "names": [ "logstash-*" ],
+      "privileges": ["read","view_index_metadata"]
+    }
+  ]


Nice, thanks for fixing this. Indeed names and privileges are required fields.

docs/static/settings/configuration-management-settings.asciidoc

mashhurs · 2025-01-23T01:57:18Z

docs/static/settings/configuration-management-settings.asciidoc

+should have the built-in `logstash_admin` role and `logstash_system` role, which provides access to system
+indices for managing configurations.
+
+NOTE: Starting with Elasticsearch version 7.10.0, the `logstash_admin` role inherits the `manage_logstash_pipelines` cluster privilege for centralized pipeline management.


Can we create an issue and follow up once we land this change? Thank you!

Co-authored-by: Karen Metts <[email protected]>

docs/static/settings/configuration-management-settings.asciidoc

github-actions · 2025-01-23T10:37:05Z

📃 DOCS PREVIEW ✨ https://logstash_bk_16902.docs-preview.app.elstc.co/diff

kaisecheng · 2025-01-23T11:06:48Z

@logstashmachine backport 8.x

…6902) CPM requires two roles logstash_admin and logstash_system Co-authored-by: Karen Metts <[email protected]> (cherry picked from commit dc740b4)

kaisecheng · 2025-01-23T11:21:33Z

@logstashmachine backport 8.17

kaisecheng · 2025-01-23T11:21:48Z

@logstashmachine backport 7.17

…6902) CPM requires two roles logstash_admin and logstash_system Co-authored-by: Karen Metts <[email protected]> (cherry picked from commit dc740b4)

…6902) (#16930) CPM requires two roles logstash_admin and logstash_system Co-authored-by: Karen Metts <[email protected]> (cherry picked from commit dc740b4) Co-authored-by: kaisecheng <[email protected]>

…6902) (#16928) CPM requires two roles logstash_admin and logstash_system Co-authored-by: Karen Metts <[email protected]> (cherry picked from commit dc740b4) Co-authored-by: kaisecheng <[email protected]>

[doc] fix the necessary privileges of central pipeline management

Backport PR #16902 (#16931)

fix the necessary privileges of central pipeline management

ec91513

kaisecheng commented Jan 15, 2025

View reviewed changes

kaisecheng marked this pull request as ready for review January 15, 2025 22:00

robbavey requested a review from karenzone January 22, 2025 14:25

karenzone approved these changes Jan 22, 2025

View reviewed changes

mashhurs approved these changes Jan 23, 2025

View reviewed changes

Update docs/static/settings/configuration-management-settings.asciidoc

437fb49

Co-authored-by: Karen Metts <[email protected]>

kaisecheng commented Jan 23, 2025

View reviewed changes

docs/static/settings/configuration-management-settings.asciidoc Outdated Show resolved Hide resolved

Update docs/static/settings/configuration-management-settings.asciidoc

63c1ee9

kaisecheng merged commit dc740b4 into elastic:main Jan 23, 2025
5 checks passed

github-actions bot mentioned this pull request Jan 23, 2025

Backport PR #16902 to 8.x: [doc] fix the necessary privileges of central pipeline management #16928

Merged

github-actions bot added the v8.18.0 label Jan 23, 2025

github-actions bot mentioned this pull request Jan 23, 2025

Backport PR #16902 to 8.17: [doc] fix the necessary privileges of central pipeline management #16930

Merged

github-actions bot added the v8.17.2 label Jan 23, 2025

kaisecheng added a commit to kaisecheng/logstash that referenced this pull request Jan 23, 2025

Backport PR elastic#16902

7fec6cb

[doc] fix the necessary privileges of central pipeline management

kaisecheng mentioned this pull request Jan 23, 2025

Backport [doc] fix the necessary privileges of central pipeline management #16931

Merged

kaisecheng added a commit that referenced this pull request Jan 24, 2025

[doc] fix the necessary privileges of central pipeline management

8bcc13e

Backport PR #16902 (#16931)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[doc] fix the necessary privileges of central pipeline management #16902

[doc] fix the necessary privileges of central pipeline management #16902

kaisecheng commented Jan 15, 2025 •

edited

Loading

github-actions bot commented Jan 15, 2025

kaisecheng Jan 15, 2025

kaisecheng Jan 15, 2025

mashhurs Jan 23, 2025

kaisecheng Jan 15, 2025

kaisecheng Jan 15, 2025

kaisecheng Jan 15, 2025

mashhurs Jan 23, 2025

kaisecheng Jan 23, 2025

kaisecheng Jan 15, 2025

karenzone left a comment

karenzone Jan 22, 2025

mashhurs left a comment

mashhurs Jan 23, 2025

mashhurs Jan 23, 2025

github-actions bot commented Jan 23, 2025

kaisecheng commented Jan 23, 2025

kaisecheng commented Jan 23, 2025

kaisecheng commented Jan 23, 2025

[doc] fix the necessary privileges of central pipeline management #16902

[doc] fix the necessary privileges of central pipeline management #16902

Conversation

kaisecheng commented Jan 15, 2025 • edited Loading

github-actions bot commented Jan 15, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

karenzone left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mashhurs left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot commented Jan 23, 2025

kaisecheng commented Jan 23, 2025

kaisecheng commented Jan 23, 2025

kaisecheng commented Jan 23, 2025

kaisecheng commented Jan 15, 2025 •

edited

Loading