Add "read ingest pipeline" cluster privilege #48028
Labels
>feature
:Security/Authorization
Roles, Privileges, DLS/FLS, RBAC/ABAC
Team:Security
Meta label for security team
Comments
tvernum
changed the title
|
Pinging @elastic/es-security (:Security/Authorization) |
BigPandaToo
added a commit
to BigPandaToo/elasticsearch
that referenced
this issue
Dec 9, 2020
The new privilege will allow to run ingest tools with minimal privilege to check whether a pipeline exists, without being able to modify it. This privilege also support simulate pipeline too since it is a readonly operation. Resolve elastic#48028
BigPandaToo
added a commit
to BigPandaToo/elasticsearch
that referenced
this issue
Dec 10, 2020
Fixing tests. Resolve elastic#48028
BigPandaToo
added a commit
to BigPandaToo/elasticsearch
that referenced
this issue
Dec 13, 2020
Fixing tests. Resolve elastic#48028
BigPandaToo
added a commit
to BigPandaToo/elasticsearch
that referenced
this issue
Dec 14, 2020
Fixing tests. Resolve elastic#48028
BigPandaToo
added a commit
to BigPandaToo/elasticsearch
that referenced
this issue
Dec 14, 2020
Resolving bwc, renaming the action Resolve elastic#48028
BigPandaToo
added a commit
to BigPandaToo/elasticsearch
that referenced
this issue
Dec 14, 2020
Fixing doc Resolve elastic#48028
BigPandaToo
added a commit
that referenced
this issue
Dec 15, 2020
* Adding "read ingest pipeline" cluster privilege The new privilege will allow to run ingest tools with minimal privilege to check whether a pipeline exists, without being able to modify it. This privilege also support simulate pipeline too since it is a readonly operation. Resolve #48028 * Adding "read ingest pipeline" cluster privilege Fixing tests. Resolve #48028 * Adding "read ingest pipeline" cluster privilege Fixing tests. Resolve #48028 * Adding "read ingest pipeline" cluster privilege Fixing tests. Resolve #48028 * Adding "read ingest pipeline" cluster privilege Resolving bwc, renaming the action Resolve #48028 * Adding "read ingest pipeline" cluster privilege Fixing doc Resolve #48028 * Adding "read ingest pipeline" cluster privilege Fixing test * Adding ingest pipeline privileges test Co-authored-by: Elastic Machine <[email protected]>
BigPandaToo
added a commit
to BigPandaToo/elasticsearch
that referenced
this issue
Dec 15, 2020
* Adding "read ingest pipeline" cluster privilege The new privilege will allow to run ingest tools with minimal privilege to check whether a pipeline exists, without being able to modify it. This privilege also support simulate pipeline too since it is a readonly operation. Resolve elastic#48028 * Adding "read ingest pipeline" cluster privilege Fixing tests. Resolve elastic#48028 * Adding "read ingest pipeline" cluster privilege Fixing tests. Resolve elastic#48028 * Adding "read ingest pipeline" cluster privilege Fixing tests. Resolve elastic#48028 * Adding "read ingest pipeline" cluster privilege Resolving bwc, renaming the action Resolve elastic#48028 * Adding "read ingest pipeline" cluster privilege Fixing doc Resolve elastic#48028 * Adding "read ingest pipeline" cluster privilege Fixing test * Adding ingest pipeline privileges test Co-authored-by: Elastic Machine <[email protected]>
BigPandaToo
added a commit
that referenced
this issue
Dec 15, 2020
* Adding "read ingest pipeline" cluster privilege (#66137) * Adding "read ingest pipeline" cluster privilege The new privilege will allow to run ingest tools with minimal privilege to check whether a pipeline exists, without being able to modify it. This privilege also support simulate pipeline too since it is a readonly operation. Resolve #48028 * Adding "read ingest pipeline" cluster privilege Fixing tests. Resolve #48028 * Adding "read ingest pipeline" cluster privilege Fixing tests. Resolve #48028 * Adding "read ingest pipeline" cluster privilege Fixing tests. Resolve #48028 * Adding "read ingest pipeline" cluster privilege Resolving bwc, renaming the action Resolve #48028 * Adding "read ingest pipeline" cluster privilege Fixing doc Resolve #48028 * Adding "read ingest pipeline" cluster privilege Fixing test * Adding ingest pipeline privileges test Co-authored-by: Elastic Machine <[email protected]> * Adding "read ingest pipeline" cluster privilege (#66137) Fixing resolution Co-authored-by: Elastic Machine <[email protected]>
BigPandaToo
added a commit
to BigPandaToo/elasticsearch
that referenced
this issue
Dec 16, 2020
Renaming read_ingest_pipelines to read_pipelines Related: elastic#48028
BigPandaToo
added a commit
to BigPandaToo/elasticsearch
that referenced
this issue
Dec 16, 2020
Renaming read_ingest_pipelines to read_pipelines Related: elastic#48028
BigPandaToo
added a commit
that referenced
this issue
Dec 16, 2020
BigPandaToo
added a commit
to BigPandaToo/elasticsearch
that referenced
this issue
Dec 16, 2020
* Renaming read_ingest_pipelines to read_pipelines Renaming read_ingest_pipelines to read_pipelines Related: elastic#48028 * Renaming read_ingest_pipelines to read_pipelines Renaming read_ingest_pipelines to read_pipelines Related: elastic#48028
BigPandaToo
added a commit
to BigPandaToo/elasticsearch
that referenced
this issue
Dec 16, 2020
Renaming read_ingest_pipelines to read_pipelines Related: elastic#48028
BigPandaToo
added a commit
that referenced
this issue
Dec 16, 2020
* Rename read_ingest_pipelines to read_pipeline (#66434) * Renaming read_ingest_pipelines to read_pipelines Renaming read_ingest_pipelines to read_pipelines Related: #48028 * Renaming read_ingest_pipelines to read_pipelines Renaming read_ingest_pipelines to read_pipelines Related: #48028 * Rename read_ingest_pipelines to read_pipeline Renaming read_ingest_pipelines to read_pipelines Related: #48028
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The only ingest pipeline we have is full read/write (actually, for historical reasons we have 2 identical privileges for the same thing).
In order to run ingest tools with minimal privilege it would be helpful to be able to check whether a pipeline exists, without being able to modify it.
This would also allow autocomplete of pipeline names Kibana.
This privilege should probably support simulate pipeline too (since it is a readonly operation) but this is open for discussion.
The text was updated successfully, but these errors were encountered: