[Fleet] Elastic Cloud agent policy configuration change is not persistent

[nimarezainia]

Please post all questions and issues on https://discuss.elastic.co/c/beats
before opening a Github Issue. Your questions will reach a wider audience there,
and if we confirm that there is a bug, then you can open a new issue.

For security vulnerabilities please only send reports to [email protected].
See https://www.elastic.co/community/security for more information.

Please include configurations and logs if available.

For confirmed bugs, please report:

• Version: 7.14.0
• Operating System: MacOs 11.4 (using firefox)
• Discuss Forum URL:
• Steps to Reproduce:

navigate to fleet-->agent policy --> Elastic Cloud agent policy and select "Agent Monitoring". Save the config. It will show saved.

...... then reload the page. Config is not accepted. and not receiving monitoring data either.

In fact seems like no other config on this page is being saved. Also tried on different browsers with the same effect.

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[mostlyjason]

I was able to reproduce this. If I navigated using links the boxes still showed as clicked. If I did a hard refresh they showed as unchecked. Also, I noticed that the agent policy is out of date and it is not updating. It shows as last activity 5 hours ago. I reported that bug here https://github.com/elastic/obs-dc-team/issues/575.

@nimarezainia is your agent with fleet server getting the policy update?

[mostlyjason]

I created another deployment and I am getting logs and metrics data from fleet server. However, when I hard refresh the policy page it shows as unchecked.

[mostlyjason]

Now the logging is turned off and I haven't received any data for 15 minutes. It appears it collected data only for a minute or two before it turned off again. It seems like there is some kind of race condition issue.

[jen-huang]

I believe this is somewhat expected behavior due to changes we made here: #103722

The intent behind this set of changes is to to enable us to modify is_managed agent policy settings on Cloud via kibana.yml between versions (i.e. introduce the new TTL field and values), but the downside is that it prevents the user from editing other settings as we will overwrite them with the values in kibana.yml whenever Fleet setup is triggered.

@mostlyjason I think we should establish some additional business rules for managed policies. The simple take is that managed agent policies cannot be edited at all (and we should update the UI to disable more fields), but I can see a valid case for the user wanting to change the namespace value, at least. I would not extend this to the agent monitoring settings as it seems like we intentionally turned that off for the default Cloud policy. What do you think?

[mostlyjason]

@jen-huang It looks like #103187 allows for marking fields as frozen, and only accepting changes from kibana.yml when its not frozen. Am I understanding the existing logic correctly? Do you know if the agent monitoring and namespace inputs are marked as frozen? If not, they should not be overridden by kibana.yml?