[Ingest Manager] Support for linux/arm64 (#23479) (#23522)

[Ingest Manager] Support for linux/arm64 (#23479)

x-pack/elastic-agent/CHANGELOG.next.asciidoc

@@ -30,6 +30,7 @@
 - Fix shell wrapper for deb/rpm packaging {pull}23038[23038]
 - Fixed parsing of npipe URI {pull}22978[22978]
 - Remove artifacts on transient download errors {pull}23235[23235]
+- Support for linux/arm64 {pull}23479[23479]
 - Skip top level files when unziping archive during upgrade {pull}23456[23456]
 - Do not take ownership of Endpoint log path {pull}23444[23444]
 - Fix issue of missing log messages from filebeat monitor {pull}23514[23514]

x-pack/elastic-agent/pkg/agent/application/global_config.go

@@ -5,6 +5,8 @@
 package application
 
 import (
+	"runtime"
+
 	"github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/paths"
 	"github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors"
 	"github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/config"
@@ -30,5 +32,7 @@ func agentGlobalConfig() map[string]interface{} {
 			"home":   paths.Home(),
 			"logs":   paths.Logs(),
 		},
+		"runtime.os":   runtime.GOOS,
+		"runtime.arch": runtime.GOARCH,
 	}
 }

x-pack/elastic-agent/pkg/agent/program/program.go

@@ -69,6 +69,21 @@ func detectPrograms(agentInfo transpiler.AgentInfo, singleConfig *transpiler.AST
 	programs := make([]Program, 0)
 	for _, spec := range Supported {
 		specificAST := singleConfig.Clone()
+		if len(spec.Constraints) > 0 {
+			constraints, err := eql.New(spec.Constraints)
+			if err != nil {
+				return nil, err
+			}
+			ok, err := constraints.Eval(specificAST)
+			if err != nil {
+				return nil, err
+			}
+
+			if !ok {
+				continue
+			}
+		}
+
 		err := spec.Rules.Apply(agentInfo, specificAST)
 		if err != nil {
 			return nil, err

x-pack/elastic-agent/pkg/agent/program/program_test.go

@@ -423,6 +423,9 @@ func TestConfiguration(t *testing.T) {
 		"endpoint_unknown_output": {
 			expected: 0,
 		},
+		"endpoint_arm": {
+			expected: 0,
+		},
 	}
 
 	for name, test := range testcases {

x-pack/elastic-agent/pkg/agent/program/spec.go

@@ -39,6 +39,7 @@ type Spec struct {
 	PostInstallSteps  *transpiler.StepList `yaml:"post_install"`
 	PreUninstallSteps *transpiler.StepList `yaml:"pre_uninstall"`
 	When              string               `yaml:"when"`
+	Constraints       string               `yaml:"constraints"`
 }
 
 // ReadSpecs reads all the specs that match the provided globbing path.

x-pack/elastic-agent/pkg/agent/program/spec_test.go

@@ -54,7 +54,8 @@ func TestSerialization(t *testing.T) {
 		PreUninstallSteps: transpiler.NewStepList(
 			transpiler.ExecFile(30, "app", "uninstall", "--force"),
 		),
-		When: "1 == 1",
+		When:        "1 == 1",
+		Constraints: "2 == 2",
 	}
 	yml := `name: hello
 cmd: hellocmd
@@ -118,6 +119,7 @@ pre_uninstall:
     - --force
     timeout: 30
 when: 1 == 1
+constraints: 2 == 2
 `
 	t.Run("serialization", func(t *testing.T) {
 		b, err := yaml.Marshal(spec)

x-pack/elastic-agent/pkg/agent/program/testdata/endpoint_arm.yml

@@ -0,0 +1,115 @@
+revision: 5
+name: Endpoint Host
+fleet:
+  agent:
+    id: fleet-agent-id
+  host:
+    id: host-agent-id
+  access_api_key: VuaCfGcBCdbkQm-e5aOx:ui2lp2axTNmsyakw9tvNnw
+  kibana:
+    protocol: https
+    host: localhost:5601
+    timeout: 30s
+
+outputs:
+  default:
+    type: elasticsearch
+    hosts: [127.0.0.1:9200, 127.0.0.1:9300]
+    username: elastic
+    password: changeme
+    api_key: TiNAGG4BaaMdaH1tRfuU:KnR6yE41RrSowb0kQ0HWoA
+    ca_sha256: 7HIpactkIAq2Y49orFOOQKurWxmmSFZhBCoQYcRhJ3Y=
+
+inputs:
+- id: endpoint-id
+  type: endpoint
+  name: endpoint-1
+  enabled: true
+  package:
+    name: endpoint
+    version: 0.3.0
+  data_stream:
+    namespace: default
+  artifact_manifest:
+    schema_version: v22
+    manifest_version: v21
+    artifacts:
+      - endpoint-allowlist-windows:
+          sha256: 1234
+          size: 2
+          url: /relative/path/to/endpoint-allowlist-windows
+      - endpoint-allowlist-macos:
+          sha256: 1234
+          size: 2
+          url: /relative/path/to/endpoint-allowlist-macos
+      - endpoint-allowlist-linux:
+          sha256: 1234
+          size: 2
+          url: /relative/path/to/endpoint-allowlist-linux
+  policy:
+    linux:
+      advanced:
+        free-form: free-form-value
+      indices:
+        network: logs-endpoint.events.network-default
+        file: logs-endpoint.events.file-default
+        process: logs-endpoint.events.process-default
+        metadata: metrics-endpoint.metadata-default
+        policy: metrics-endpoint.policy-default
+        telemetry: metrics-endpoint.telemetry-default
+      logging:
+        file: info
+        stdout: debug
+      events:
+        process: true
+        file: true
+        network: true
+    windows:
+      malware:
+        mode: prevent
+      advanced:
+        free-form: free-form-value
+      indices:
+        network: logs-endpoint.events.network-default
+        file: logs-endpoint.events.file-default
+        registry: logs-endpoint.events.registry-default
+        process: logs-endpoint.events.process-default
+        driver: logs-endpoint.events.driver-default
+        library: logs-endpoint.events.library-default
+        alerts: logs-endpoint.alerts-default
+        metadata: metrics-endpoint.metadata-default
+        policy: metrics-endpoint.policy-default
+        telemetry: metrics-endpoint.telemetry-default
+      logging:
+        file: info
+        stdout: debug
+      events:
+        registry: true
+        process: true
+        security: true
+        file: true
+        dns: false
+        dll_and_driver_load: false
+        network: true
+    mac:
+      malware:
+        mode: prevent
+      advanced:
+        free-form: free-form-value
+      indices:
+        network: logs-endpoint.events.network-default
+        file: logs-endpoint.events.file-default
+        process: logs-endpoint.events.process-default
+        alerts: logs-endpoint.alerts-default
+        metadata: metrics-endpoint.metadata-default
+        policy: metrics-endpoint.policy-default
+        telemetry: metrics-endpoint.telemetry-default
+      logging:
+        file: info
+        stdout: debug
+      events:
+        process: true
+        file: true
+        network: true
+runtime:
+  arch: arm64

x-pack/elastic-agent/pkg/agent/program/testdata/endpoint_basic.yml

@@ -111,3 +111,5 @@ inputs:
         process: true
         file: true
         network: true
+runtime:
+  arch: x86_64

x-pack/elastic-agent/pkg/artifact/artifact.go

@@ -13,12 +13,13 @@ import (
 )
 
 var packageArchMap = map[string]string{
-	"linux-binary-32":   "linux-x86.tar.gz",
-	"linux-binary-64":   "linux-x86_64.tar.gz",
-	"windows-binary-32": "windows-x86.zip",
-	"windows-binary-64": "windows-x86_64.zip",
-	"darwin-binary-32":  "darwin-x86_64.tar.gz",
-	"darwin-binary-64":  "darwin-x86_64.tar.gz",
+	"linux-binary-32":    "linux-x86.tar.gz",
+	"linux-binary-64":    "linux-x86_64.tar.gz",
+	"linux-binary-arm64": "linux-arm64.tar.gz",
+	"windows-binary-32":  "windows-x86.zip",
+	"windows-binary-64":  "windows-x86_64.zip",
+	"darwin-binary-32":   "darwin-x86_64.tar.gz",
+	"darwin-binary-64":   "darwin-x86_64.tar.gz",
 }
 
 // GetArtifactName constructs a path to a downloaded artifact

x-pack/elastic-agent/pkg/artifact/config.go

@@ -77,7 +77,9 @@ func (c *Config) Arch() string {
 	}
 
 	arch := "32"
-	if strings.Contains(runtime.GOARCH, "64") {
+	if strings.Contains(runtime.GOARCH, "arm64") {
+		arch = "arm64"
+	} else if strings.Contains(runtime.GOARCH, "64") {
 		arch = "64"
 	}
 

x-pack/elastic-agent/pkg/artifact/download/http/elastic_test.go

@@ -137,6 +137,7 @@ func getTestCases() []testCase {
 	return []testCase{
 		{"linux", "32"},
 		{"linux", "64"},
+		{"linux", "arm64"},
 		{"darwin", "32"},
 		{"darwin", "64"},
 		{"windows", "32"},
@@ -164,6 +165,7 @@ func getElasticCoClient() http.Client {
 		fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "i686.rpm"):             struct{}{},
 		fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "x86_64.rpm"):           struct{}{},
 		fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "linux-x86.tar.gz"):     struct{}{},
+		fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "linux-arm64.tar.gz"):   struct{}{},
 		fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "linux-x86_64.tar.gz"):  struct{}{},
 		fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "windows-x86.zip"):      struct{}{},
 		fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "windows-x86_64.zip"):   struct{}{},

x-pack/elastic-agent/spec/endpoint.yml

@@ -62,3 +62,4 @@ rules:
     - revision
 
 when: length(${fleet}) > 0 and length(${inputs}) > 0 and hasKey(${output}, 'elasticsearch')
+constraints: ${runtime.arch} != 'arm64'