[Fleet] Add fleet subfeatures (#178006)

elastic · Mar 11, 2024 · f034f86 · f034f86
1 parent 20a9bf7
commit f034f86
Show file tree

Hide file tree

Showing 2 changed files with 111 additions and 1 deletion.
diff --git a/x-pack/plugins/fleet/common/experimental_features.ts b/x-pack/plugins/fleet/common/experimental_features.ts
@@ -27,6 +27,7 @@ export const allowedExperimentalValues = Object.freeze<Record<string, boolean>>(
   remoteESOutput: true,
   agentless: false,
   enableStrictKQLValidation: false,
+  subfeaturePrivileges: false,
 });
 
 type ExperimentalConfigKeys = Array<keyof ExperimentalFeatures>;

diff --git a/x-pack/plugins/fleet/server/plugin.ts b/x-pack/plugins/fleet/server/plugin.ts
@@ -289,6 +289,7 @@ export class FleetPlugin
     registerSavedObjects(core.savedObjects);
     registerEncryptedSavedObjects(deps.encryptedSavedObjects);
 
+    const experimentalFeatures = parseExperimentalConfigValue(config.enableExperimental ?? []);
     // Register feature
     if (deps.features) {
       deps.features.registerKibanaFeature({
@@ -318,6 +319,115 @@ export class FleetPlugin
             },
           ],
         },
+        subFeatures: experimentalFeatures.subfeaturePrivileges
+          ? [
+              {
+                name: 'Agents',
+                requireAllSpaces: true,
+                privilegeGroups: [
+                  {
+                    groupType: 'mutually_exclusive',
+                    privileges: [
+                      {
+                        id: `${PLUGIN_ID}-agents-all`,
+                        api: [`${PLUGIN_ID}-agents-read`, `${PLUGIN_ID}-agents-all`],
+                        name: 'All',
+                        ui: ['read', 'all'],
+                        savedObject: {
+                          all: [],
+                          read: allSavedObjectTypes,
+                        },
+                        includeIn: 'all',
+                      },
+                      {
+                        id: `${PLUGIN_ID}-agents-read`,
+                        api: [`${PLUGIN_ID}-agents-read`],
+                        name: 'Read',
+                        ui: ['read'],
+                        savedObject: {
+                          all: [],
+                          read: allSavedObjectTypes,
+                        },
+                        includeIn: 'read',
+                        alerting: {},
+                      },
+                    ],
+                  },
+                ],
+              },
+              {
+                name: 'Agent policies',
+                requireAllSpaces: true,
+                privilegeGroups: [
+                  {
+                    groupType: 'mutually_exclusive',
+                    privileges: [
+                      {
+                        id: `${PLUGIN_ID}-agent-policies-all`,
+                        api: [
+                          `${PLUGIN_ID}-agent-policies-read`,
+                          `${PLUGIN_ID}-agent-policies-all`,
+                        ],
+                        name: 'All',
+                        ui: ['read', 'all'],
+                        savedObject: {
+                          all: [],
+                          read: allSavedObjectTypes,
+                        },
+                        includeIn: 'all',
+                      },
+                      {
+                        id: `${PLUGIN_ID}-agent-policies-read`,
+                        api: [`${PLUGIN_ID}-agent-policies-read`],
+                        name: 'Read',
+                        ui: ['read'],
+                        savedObject: {
+                          all: [],
+                          read: allSavedObjectTypes,
+                        },
+                        includeIn: 'read',
+                        alerting: {},
+                      },
+                    ],
+                  },
+                ],
+              },
+              {
+                name: 'Settings',
+                requireAllSpaces: true,
+                privilegeGroups: [
+                  {
+                    groupType: 'mutually_exclusive',
+                    privileges: [
+                      {
+                        id: `${PLUGIN_ID}-settings-all`,
+                        api: [`${PLUGIN_ID}-settings-read`, `${PLUGIN_ID}-settings-all`],
+                        name: 'All',
+                        ui: ['read', 'all'],
+                        savedObject: {
+                          all: [],
+                          read: allSavedObjectTypes,
+                        },
+                        includeIn: 'all',
+                      },
+                      {
+                        id: `${PLUGIN_ID}-settings-read`,
+                        api: [`${PLUGIN_ID}-settings-read`],
+                        name: 'Read',
+                        ui: ['read'],
+                        savedObject: {
+                          all: [],
+                          read: allSavedObjectTypes,
+                        },
+                        includeIn: 'read',
+                        alerting: {},
+                      },
+                    ],
+                  },
+                ],
+              },
+            ]
+          : [],
         privileges: {
           all: {
             api: [`${PLUGIN_ID}-read`, `${PLUGIN_ID}-all`],
@@ -340,7 +450,6 @@ export class FleetPlugin
               read: allSavedObjectTypes,
             },
             ui: ['read'],
-            disabled: true,
           },
         },
       });