[Beats Management] Add flag to require verification

x-pack/index.js

@@ -16,6 +16,7 @@ import { watcher } from './plugins/watcher';
 import { grokdebugger } from './plugins/grokdebugger';
 import { dashboardMode } from './plugins/dashboard_mode';
 import { logstash } from './plugins/logstash';
+import { beats } from './plugins/beats';
 import { apm } from './plugins/apm';
 import { licenseManagement } from './plugins/license_management';
 import { cloud } from './plugins/cloud';
@@ -36,6 +37,7 @@ module.exports = function (kibana) {
     grokdebugger(kibana),
     dashboardMode(kibana),
     logstash(kibana),
+    beats(kibana),
     apm(kibana),
     licenseManagement(kibana),
     cloud(kibana),

x-pack/plugins/beats/common/constants/configuration_blocks.js

@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const CONFIGURATION_BLOCKS = {
+  TYPES: {
+    OUTPUT: 'output',
+    PROCESSORS: 'processors',
+    FILEBEAT_INPUTS: 'filebeat.inputs',
+    FILEBEAT_MODULES: 'filebeat.modules',
+    METRICBEAT_MODULES: 'metricbeat.modules'
+  }
+};
+
+CONFIGURATION_BLOCKS.UNIQUENESS_ENFORCING_TYPES = [
+  CONFIGURATION_BLOCKS.TYPES.OUTPUT
+];

x-pack/plugins/beats/common/constants/index.js

@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { PLUGIN } from './plugin';
+export { INDEX_NAMES } from './index_names';
+export { CONFIGURATION_BLOCKS } from './configuration_blocks';

x-pack/plugins/beats/common/constants/index_names.js

@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const INDEX_NAMES = {
+  BEATS: '.management-beats'
+};

x-pack/plugins/beats/common/constants/plugin.js

@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const PLUGIN = {
+  ID: 'beats'
+};

x-pack/plugins/beats/index.js

@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { installIndexTemplate } from './server/lib/index_template';
+import { registerApiRoutes } from './server/routes/api';
+import { PLUGIN } from './common/constants';
+
+const DEFAULT_ENROLLMENT_TOKENS_TTL_S = 10 * 60; // 10 minutes
+
+export function beats(kibana)  {
+  return new kibana.Plugin({
+    id: PLUGIN.ID,
+    require: ['kibana', 'elasticsearch', 'xpack_main'],
+    configPrefix: 'xpack.beats',
+    config: Joi => Joi.object({
+      enabled: Joi.boolean().default(true),
+      enrollmentTokensTtlInSeconds: Joi.number().integer().min(1).default(DEFAULT_ENROLLMENT_TOKENS_TTL_S),
+      requireVerification: Joi.boolean().default(false)
+    }).default(),
+    init: async function (server) {
+      await installIndexTemplate(server);
+      registerApiRoutes(server);
+    }
+  });
+}

x-pack/plugins/beats/server/lib/client/call_with_internal_user_factory.js

@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { once } from 'lodash';
+
+const callWithInternalUser = once((server) => {
+  const { callWithInternalUser } = server.plugins.elasticsearch.getCluster('admin');
+  return callWithInternalUser;
+});
+
+export const callWithInternalUserFactory = (server) => {
+  return callWithInternalUser(server);
+};

x-pack/plugins/beats/server/lib/client/call_with_request_factory.js

@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { once } from 'lodash';
+
+const callWithRequest = once((server) => {
+  const { callWithRequest } = server.plugins.elasticsearch.getCluster('admin');
+  return callWithRequest;
+});
+
+export const callWithRequestFactory = (server, request) => {
+  return (...args) => {
+    return callWithRequest(server)(request, ...args);
+  };
+};

x-pack/plugins/beats/server/lib/client/index.js

@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { callWithRequestFactory } from './call_with_request_factory';
+export { callWithInternalUserFactory } from './call_with_internal_user_factory';

x-pack/plugins/beats/server/lib/error_wrappers/index.js

@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { wrapEsError } from './wrap_es_error';

x-pack/plugins/beats/server/lib/error_wrappers/wrap_es_error.js

@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import Boom from 'boom';
+
+/**
+ * Wraps ES errors into a Boom error response and returns it
+ * This also handles the permissions issue gracefully
+ *
+ * @param err Object ES error
+ * @return Object Boom error response
+ */
+export function wrapEsError(err) {
+  const statusCode = err.statusCode;
+  if (statusCode === 403) {
+    return Boom.forbidden('Insufficient user permissions for managing Beats configuration');
+  }
+  return Boom.wrap(err, err.statusCode);
+}

x-pack/plugins/beats/server/lib/error_wrappers/wrap_es_error.test.js

@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { wrapEsError } from './wrap_es_error';
+
+describe('wrap_es_error', () => {
+  describe('#wrapEsError', () => {
+
+    let originalError;
+    beforeEach(() => {
+      originalError = new Error('I am an error');
+      originalError.statusCode = 404;
+    });
+
+    it('should return a Boom object', () => {
+      const wrappedError = wrapEsError(originalError);
+
+      expect(wrappedError.isBoom).to.be(true);
+    });
+
+    it('should return the correct Boom object', () => {
+      const wrappedError = wrapEsError(originalError);
+
+      expect(wrappedError.output.statusCode).to.be(originalError.statusCode);
+      expect(wrappedError.output.payload.message).to.be(originalError.message);
+    });
+
+    it('should return invalid permissions message for 403 errors', () => {
+      const securityError = new Error('I am an error');
+      securityError.statusCode = 403;
+      const wrappedError = wrapEsError(securityError);
+
+      expect(wrappedError.isBoom).to.be(true);
+      expect(wrappedError.message).to.be('Insufficient user permissions for managing Logstash pipelines');
+    });
+  });
+});

x-pack/plugins/beats/server/lib/index_template/beats_template.json

@@ -0,0 +1,92 @@
+{
+  "index_patterns": [
+    ".management-beats"
+  ],
+  "version": 65000,
+  "settings": {
+    "index": {
+      "number_of_shards": 1,
+      "auto_expand_replicas": "0-1",
+      "codec": "best_compression"
+    }
+  },
+  "mappings": {
+    "_doc": {
+      "dynamic": "strict",
+      "properties": {
+        "type": {
+          "type": "keyword"
+        },
+        "enrollment_token": {
+          "properties": {
+            "token": {
+              "type": "keyword"
+            },
+            "expires_on": {
+              "type": "date"
+            }
+          }
+        },
+        "tag": {
+          "properties": {
+            "id": {
+              "type": "keyword"
+            },
+            "configuration_blocks": {
+              "type": "nested",
+              "properties": {
+                "type": {
+                  "type": "keyword"
+                },
+                "block_yml": {
+                  "type": "text"
+                }
+              }
+            }
+          }
+        },
+        "beat": {
+          "properties": {
+            "id": {
+              "type": "keyword"
+            },
+            "access_token": {
+              "type": "keyword"
+            },
+            "verified_on": {
+              "type": "date"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "version": {
+              "type": "keyword"
+            },
+            "host_ip": {
+              "type": "ip"
+            },
+            "host_name": {
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "type": "keyword"
+            },
+            "local_configuration_yml": {
+              "type": "text"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "central_configuration_yml": {
+              "type": "text"
+            },
+            "metadata": {
+              "dynamic": "true",
+              "type": "object"
+            }
+          }
+        }
+      }
+    }
+  }
+}

x-pack/plugins/beats/server/lib/index_template/index.js

@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { installIndexTemplate } from './install_index_template';

x-pack/plugins/beats/server/lib/index_template/install_index_template.js

@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import beatsIndexTemplate from './beats_template';
+import { callWithInternalUserFactory } from '../client';
+
+const TEMPLATE_NAME = 'beats-template';
+
+export function installIndexTemplate(server) {
+  const callWithInternalUser = callWithInternalUserFactory(server);
+  return callWithInternalUser('indices.putTemplate', {
+    name: TEMPLATE_NAME,
+    body: beatsIndexTemplate
+  });
+}

x-pack/plugins/beats/server/routes/api/index.js

@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { registerCreateEnrollmentTokensRoute } from './register_create_enrollment_tokens_route';
+import { registerEnrollBeatRoute } from './register_enroll_beat_route';
+import { registerListBeatsRoute } from './register_list_beats_route';
+import { registerVerifyBeatsRoute } from './register_verify_beats_route';
+import { registerUpdateBeatRoute } from './register_update_beat_route';
+import { registerSetTagRoute } from './register_set_tag_route';
+
+export function registerApiRoutes(server) {
+  registerCreateEnrollmentTokensRoute(server);
+  registerEnrollBeatRoute(server);
+  registerListBeatsRoute(server);
+  registerVerifyBeatsRoute(server);
+  registerUpdateBeatRoute(server);
+  registerSetTagRoute(server);
+}