#10464 Enabling Agentless for the OKTA integration

[qcorporation]

Parent Ticket (Enhancement)

Okta ingest using the new Agentless onboarding

Proposed commit message

• Highlighted the new Agentless Enabled integration mimcking the "Response enabled integration" notification (thanks @jamiehynds). Also a copy paste of the CSPM text with the addition of reference link to the Agentless description/definition

• Upgraded the format_version to latest, 3.2.3
• Updated Kibana version constraints to ^8.18 || ^9.0.0

Checklist

• [ x ] I have reviewed tips for building integrations and this pull request is aligned with them.
• [ x ] I have verified that all data streams collect metrics or logs.
• [ x ] I have added an entry to my package's changelog.yml file.
• [ x ] I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

1. An Elastic stack was setup using devenv - link
2. Create a new project within serverless based upon the link
3. Make changes to the integration and installed the integration through elastic-package install --zip <okta.zip>
4. Setup Okta through the dev account, create a new api key and input the settings within the integration.
5. Make sure Okta integration had an initial refresh rate of 60s and incremental refresh of 60s
6. Swap the agent image for one that has the persistent storage changes in filebeat. Change the image by editing the agentlessconfig within the k8s cluster. I used elastic-agent-service:9.1.0-SNAPSHOT

Failure injection and Validation

• validated that when an Agent/Filebeat that had the persistence storage enhancement (9.1.0 image) connected to ES that a new cursor was added to agentless-state-httpjson-okta.system-*
• validated that when Agent/Filebeat fetched more data (by creating more logs within Okta) that the cursor was incremented in this index
• Force a pod restart kubectl delete pods <pod> -n <namespace> and validate a new pod was brought back up and it uses the same cursor as before. To validate the cursor continuation I had to download the agent diagnostic logs after the restart and validated that the agent/filebeat did not publish all the logs again and only logs from the cursor
• Run two agent okta policies with separate api keys, and validated that they both work independently especially there was a forced pod restart
• Validate that when the agent policy was deleted the agent in agentless pod also got torn down
• Validated that health status was updated in both fleet/agent page and integration page (ticket was logged)

Note:

• Did not test document duplication as Okta integration implements a json.uuid which maps to _id. Elasticsearch will overwrite the existing doc with the new one.

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: d6a23b7

History

• 💚 Build #22517 succeeded c5bfbef
• 💚 Build #22452 succeeded 29ef2cc9d6233a03afde21cad5072e8b54440498
• 💚 Build #22335 succeeded d7014144ea782d8abf940753ff6c2ff913051dc2

cc @qcorporation

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elastic-vault-github-plugin-prod]

Package okta - 3.5.0 containing this change is available at https://epr.elastic.co/package/okta/3.5.0/