-
Notifications
You must be signed in to change notification settings - Fork 8.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Unauthorized route migration for routes owned by kibana-cloud-security-posture #198353
Unauthorized route migration for routes owned by kibana-cloud-security-posture #198353
Conversation
Pinging @elastic/kibana-cloud-security-posture (Team:Cloud Security) |
…a-cloud-security-posture
…rd routes" This reverts commit ded55a7.
Closing this PR in favour of adding |
Reopening this PR as per the circumstances discussed on this comment. Updated Kubernetes Dashboard to require |
Starting backport for target branches: 8.x |
💚 Build Succeeded
Metrics [docs]
History
|
…y-posture (elastic#198353) ### Authz API migration for unauthorized routes This PR migrates unauthorized routes owned by your team to a new security configuration. Please refer to the documentation for more information: [Authorization API](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization) ### **Before migration:** ```ts router.get({ path: '/api/path', ... }, handler); ``` ### **After migration:** ```ts router.get({ path: '/api/path', security: { authz: { enabled: false, reason: 'This route is opted out from authorization because ...', }, }, ... }, handler); ``` ### What to do next? 1. Review the changes in this PR. 2. Elaborate on the reasoning to opt-out of authorization. 3. Routes without a compelling reason to opt-out of authorization should plan to introduce them as soon as possible. 2. You might need to update your tests to reflect the new security configuration: - If you have snapshot tests that include the route definition. ## Any questions? If you have any questions or need help with API authorization, please reach out to the `@elastic/kibana-security` team. --------- Co-authored-by: Paulo Silva <[email protected]> (cherry picked from commit 767a4bb)
💚 All backports created successfully
Note: Successful backport PRs will be merged automatically after passing CI. Questions ?Please refer to the Backport tool documentation |
…ecurity-posture (#198353) (#200282) # Backport This will backport the following commits from `main` to `8.x`: - [Unauthorized route migration for routes owned by kibana-cloud-security-posture (#198353)](#198353) <!--- Backport version: 9.4.3 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Kibana Machine","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-11-14T23:50:01Z","message":"Unauthorized route migration for routes owned by kibana-cloud-security-posture (#198353)\n\n### Authz API migration for unauthorized routes\r\n\r\nThis PR migrates unauthorized routes owned by your team to a new\r\nsecurity configuration.\r\nPlease refer to the documentation for more information: [Authorization\r\nAPI](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)\r\n\r\n### **Before migration:**\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n ...\r\n}, handler);\r\n```\r\n\r\n### **After migration:**\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n security: {\r\n authz: {\r\n enabled: false,\r\n reason: 'This route is opted out from authorization because ...',\r\n },\r\n },\r\n ...\r\n}, handler);\r\n```\r\n\r\n### What to do next?\r\n1. Review the changes in this PR.\r\n2. Elaborate on the reasoning to opt-out of authorization.\r\n3. Routes without a compelling reason to opt-out of authorization should\r\nplan to introduce them as soon as possible.\r\n2. You might need to update your tests to reflect the new security\r\nconfiguration:\r\n - If you have snapshot tests that include the route definition.\r\n\r\n## Any questions?\r\nIf you have any questions or need help with API authorization, please\r\nreach out to the `@elastic/kibana-security` team.\r\n\r\n---------\r\n\r\nCo-authored-by: Paulo Silva <[email protected]>","sha":"767a4bbd406bb5d87ca39d1b9a474820343147bb","branchLabelMapping":{"^v9.0.0$":"main","^v8.17.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["enhancement","release_note:skip","Feature:Security/Authorization","v9.0.0","Team:Cloud Security","backport:prev-minor","Authz: API migration"],"title":"Unauthorized route migration for routes owned by kibana-cloud-security-posture","number":198353,"url":"https://github.com/elastic/kibana/pull/198353","mergeCommit":{"message":"Unauthorized route migration for routes owned by kibana-cloud-security-posture (#198353)\n\n### Authz API migration for unauthorized routes\r\n\r\nThis PR migrates unauthorized routes owned by your team to a new\r\nsecurity configuration.\r\nPlease refer to the documentation for more information: [Authorization\r\nAPI](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)\r\n\r\n### **Before migration:**\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n ...\r\n}, handler);\r\n```\r\n\r\n### **After migration:**\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n security: {\r\n authz: {\r\n enabled: false,\r\n reason: 'This route is opted out from authorization because ...',\r\n },\r\n },\r\n ...\r\n}, handler);\r\n```\r\n\r\n### What to do next?\r\n1. Review the changes in this PR.\r\n2. Elaborate on the reasoning to opt-out of authorization.\r\n3. Routes without a compelling reason to opt-out of authorization should\r\nplan to introduce them as soon as possible.\r\n2. You might need to update your tests to reflect the new security\r\nconfiguration:\r\n - If you have snapshot tests that include the route definition.\r\n\r\n## Any questions?\r\nIf you have any questions or need help with API authorization, please\r\nreach out to the `@elastic/kibana-security` team.\r\n\r\n---------\r\n\r\nCo-authored-by: Paulo Silva <[email protected]>","sha":"767a4bbd406bb5d87ca39d1b9a474820343147bb"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/198353","number":198353,"mergeCommit":{"message":"Unauthorized route migration for routes owned by kibana-cloud-security-posture (#198353)\n\n### Authz API migration for unauthorized routes\r\n\r\nThis PR migrates unauthorized routes owned by your team to a new\r\nsecurity configuration.\r\nPlease refer to the documentation for more information: [Authorization\r\nAPI](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)\r\n\r\n### **Before migration:**\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n ...\r\n}, handler);\r\n```\r\n\r\n### **After migration:**\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n security: {\r\n authz: {\r\n enabled: false,\r\n reason: 'This route is opted out from authorization because ...',\r\n },\r\n },\r\n ...\r\n}, handler);\r\n```\r\n\r\n### What to do next?\r\n1. Review the changes in this PR.\r\n2. Elaborate on the reasoning to opt-out of authorization.\r\n3. Routes without a compelling reason to opt-out of authorization should\r\nplan to introduce them as soon as possible.\r\n2. You might need to update your tests to reflect the new security\r\nconfiguration:\r\n - If you have snapshot tests that include the route definition.\r\n\r\n## Any questions?\r\nIf you have any questions or need help with API authorization, please\r\nreach out to the `@elastic/kibana-security` team.\r\n\r\n---------\r\n\r\nCo-authored-by: Paulo Silva <[email protected]>","sha":"767a4bbd406bb5d87ca39d1b9a474820343147bb"}}]}] BACKPORT-->
…y-posture (elastic#198353) ### Authz API migration for unauthorized routes This PR migrates unauthorized routes owned by your team to a new security configuration. Please refer to the documentation for more information: [Authorization API](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization) ### **Before migration:** ```ts router.get({ path: '/api/path', ... }, handler); ``` ### **After migration:** ```ts router.get({ path: '/api/path', security: { authz: { enabled: false, reason: 'This route is opted out from authorization because ...', }, }, ... }, handler); ``` ### What to do next? 1. Review the changes in this PR. 2. Elaborate on the reasoning to opt-out of authorization. 3. Routes without a compelling reason to opt-out of authorization should plan to introduce them as soon as possible. 2. You might need to update your tests to reflect the new security configuration: - If you have snapshot tests that include the route definition. ## Any questions? If you have any questions or need help with API authorization, please reach out to the `@elastic/kibana-security` team. --------- Co-authored-by: Paulo Silva <[email protected]>
…y-posture (elastic#198353) ### Authz API migration for unauthorized routes This PR migrates unauthorized routes owned by your team to a new security configuration. Please refer to the documentation for more information: [Authorization API](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization) ### **Before migration:** ```ts router.get({ path: '/api/path', ... }, handler); ``` ### **After migration:** ```ts router.get({ path: '/api/path', security: { authz: { enabled: false, reason: 'This route is opted out from authorization because ...', }, }, ... }, handler); ``` ### What to do next? 1. Review the changes in this PR. 2. Elaborate on the reasoning to opt-out of authorization. 3. Routes without a compelling reason to opt-out of authorization should plan to introduce them as soon as possible. 2. You might need to update your tests to reflect the new security configuration: - If you have snapshot tests that include the route definition. ## Any questions? If you have any questions or need help with API authorization, please reach out to the `@elastic/kibana-security` team. --------- Co-authored-by: Paulo Silva <[email protected]>
Authz API migration for unauthorized routes
This PR migrates unauthorized routes owned by your team to a new security configuration.
Please refer to the documentation for more information: Authorization API
Before migration:
After migration:
What to do next?
Any questions?
If you have any questions or need help with API authorization, please reach out to the
@elastic/kibana-security
team.