[Fleet] Hosted agent policies

[mostlyjason]

Problem
In most cases Fleet provides full central management for Elastic Agents. However, in some use cases, the infrastructure for Elastic Agents is managed outside of Fleet. Examples include ESS and K8s where these platforms are responsible for the creation of containers/pods for Elastic agent. They specify when agents are created, upgraded, or removed, and this would conflict with Fleet. For example, the container image would determine which version of the agent is running. To upgrade the agent, the user would update the image version.

Solution
We'll create a new type of agent policy called a "hosted agent policy". It will restrict the user from performing lifecycle actions that would be done by the hosting solution instead. Those actions include the ability to unenroll agents, upgrade them or reassign them because they are typically defined at the container or pod level.

However, the user can still configure the agent policies, including adding integrations or configuring the inputs. Fleet will sync the agent policy updates to the agents. If a container is recreated later, the agent policy is still stored within Fleet and can be applied to the agent when it starts.

Policies that are not hosted are just called "regular" policies, and they are default kind of policy.

User experience
WIth in the API, the user should be prevented from performing the above actions. API actions that are unpermitted for single agents should fail with an error. Bulk actions should apply the action to the subset of permitted agents, similar to how the ES bulk API works. For example, this allows the user to bulk select and upgrade every agent they are able to. The ones that remain on the old version, the user will have to upgrade them in the hosting solution.

Within the UI, the user ideally should not be able to execute unpermitted actions. We can disable the action buttons in those cases. For the bulk actions, we can show a screen that displays the number of permitted agents that the action applies to.

Phases

1. The user can create hosted agent policies but they cannot turn them into regular policies in the UI. That's because it would remove the protections we need for Cloud. Also, the user cannot add or remove integrations in managed agent policies, because the user should not be able to remove the fleet server integration on Cloud and we have not yet implemented other constraints.
2. We allow the user to add and remove other kinds of integrations to support pulling data from AWS. We add an allowlist/blocklist on which integrations cannot be added or removed from an agent policy. Even then the user should not be able to edit the allowlist for ESS (it seems these requirements are specific to ESS and its not really a generic type of policy)?

Related issues

• UI for managed agent policies [Fleet] UI changes related to hosted agent policies #91906
• Bulk actions [Fleet] [Managed Policies] Bulk actions changes #90437
• API changes [Ingest Manager] Hosted Agents cannot be upgraded, unenrolled or reassigned to a different config #76843

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[jfsiii]

I think we should change the saved object is_managed property to reflect the new feature name. e.g. is_externally_managed or something. maybe managed_by: enum if we think we want to track who/what is in control.

Do we want to make this change in 7.12 (already at BC3) or make a migration in 7.13?

It's after 7.12 FF but just asking if we want to get it in "right" from the beginning.

[mostlyjason]

@jfsiii hold off on any changes for this issue right now. Its still work in progress. I have an open question to @ruflin about whether this should really be a called an Elastic Cloud type policy, since some of the requirements seem specific to Elastic Cloud and do not apply to generic use cases like K8s.

[ruflin]

What means "user can create externally managed agent policies" in this context? Through the UI or API? I would consider this only an API feature. As it is managed externally through the API anyways, I don't think we need to expose this.

[mostlyjason]

Closing this one because its superseded by other docs and issues

[ruflin]

@mostlyjason can you link to the relevant issues so anyone subscribing here can follow up?

[mostlyjason]

Sure here you go

• UI for managed agent policies [Fleet] UI changes related to hosted agent policies #91906
• Bulk actions [Fleet] [Managed Policies] Bulk actions changes #90437
• API changes [Ingest Manager] Hosted Agents cannot be upgraded, unenrolled or reassigned to a different config #76843