Skip to content

[Fleet] Periodically clean up .fleet-policies index to remove old revisions #119963

@kpollich

Description

@kpollich

For long-lived policies like our policy-elastic-agent-on-cloud policy, we accrue many revisions over time, which results in confusing results and noise when debugging and working with support.

For example, when attempting to grab the current policy data during a support case, we recently ran this query and received 51 results.

GET .fleet-policies/_search?q=policy-elastic-agent-on-cloud

This makes it difficult to sort through the noise and determine the currently deployed revision of the policy for debugging purposes.

The way Fleet Server handles this in code is to sort the policy results in descending order of revision_idx and only grab the most recent revision:

https://github.com/elastic/fleet-server/blob/01349f51cedc19a3aac953d8564b27f81bb9dd35/internal/pkg/dl/policies.go#L23-L34

We could potentially imitate this behavior in the various queries we use for support purposes (potentially adds difficulty and verbosity), but there is likely also a justification for periodically truncating the list of revisions once it gets above some maximum size.

Fleet UI is responsible for writing to this index, while Fleet Server only reads from it. Therefore, Fleet UI should be responsible for its cleanup as the "writer" process here.

Fleet UI generates a document in .fleet-policies for each Agent Policy during setup here:

/**
* Ensure a .fleet-policy document exist for each agent policy so Fleet server can retrieve it
*/
export async function ensureFleetServerAgentPoliciesExists(
soClient: SavedObjectsClientContract,
esClient: ElasticsearchClient
) {
const { items: agentPolicies } = await agentPolicyService.list(soClient, {
perPage: SO_SEARCH_LIMIT,
});
await Promise.all(
agentPolicies.map(async (agentPolicy) => {
const policyChangeActionExist = !!(await agentPolicyService.getLatestFleetPolicy(
esClient,
agentPolicy.id
));
if (!policyChangeActionExist) {
return agentPolicyService.createFleetServerPolicy(soClient, agentPolicy.id);
}
})
);
}

Metadata

Metadata

Assignees

Labels

Team:FleetTeam label for Observability Data Collection Fleet teamtechnical debtImprovement of the software architecture and operational architecture

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions