Fleet-server does not correctly update API keys on policy output permissions change

[AndersonQ]

• Version: 8.3.2, the commit causing this problem was merged on 04/04/2022 and backported to v8.2.0 and v8.3.0
• Operating System: all
• Steps to Reproduce: see below

Fleet-server will change the API key for an input when ever the output permissions change. However given a policy with 2 or more outputs, if only a sub set of the policies has a permission change, there is the chance that the new API key will be set to its correct input as well as to other inputs that did not have a permission change and therefore did not get a new API key.
It can cause a "invalid API key" error as a input might try to interact with indexes it does not have permission to do so.

See more details here.

[joshdover]

@AndersonQ where did we land on the approach for fixing this problem? Will we be adding a new fields to .fleet-agents to track the API keys for each output?

[AndersonQ]

hi @joshdover. Yes, we'll add new fields, keep the old ones for backward compatibility and fleet-server will do a "migration" of the data from the old, now deprecated fields, to the new ones. I started the work on it. You can already check the new model here, have a look at internal/pkg/model/schema.go and model/schema.json.