[Fleet] Fix malformed synthetics package policies#236176
Merged
cesco-f merged 7 commits intoelastic:mainfrom Sep 25, 2025
Merged
[Fleet] Fix malformed synthetics package policies#236176cesco-f merged 7 commits intoelastic:mainfrom
cesco-f merged 7 commits intoelastic:mainfrom
Conversation
github-actions
bot
added
the
author:obs-ux-management
cesco-f
force-pushed
the
fix-synthetics-package-policies
branch
from
f7cf0b9 to
0e658d0
Compare
Contributor
Author
|
/ci |
Contributor
|
Applied fix work. Before After |
cesco-f
added
release_note:fix
backport:version
cesco-f
force-pushed
the
fix-synthetics-package-policies
branch
from
9f0f9ae to
1566867
Compare
botelastic
bot
added
the
Team:Fleet
Contributor
|
Pinging @elastic/fleet (Team:Fleet) |
… src/core/server/integration_tests/ci_checks'
Contributor
💔 Build Failed
Failed CI Steps
Test Failures
Metrics [docs]
History
|
Contributor
Author
|
@elasticmachine merge upstream |
…ckage policy as well
… src/core/server/integration_tests/ci_checks'
gsoldevila
reviewed
Sep 24, 2025
...plugins/shared/fleet/server/saved_objects/model_versions/synthetics_disable_browser_input.ts
Show resolved
Hide resolved
gsoldevila
approved these changes
Sep 24, 2025
Contributor
gsoldevila
left a comment
gsoldevila
left a comment
There was a problem hiding this comment.
LGTM! I added one non-critical observation.
dominiqueclarke
approved these changes
Sep 24, 2025
Contributor
dominiqueclarke
left a comment
dominiqueclarke
left a comment
There was a problem hiding this comment.
Before and after still looks good. Fix is applied. Code looks great. Thanks for the work!
shahzad31
reviewed
Sep 24, 2025
| } | ||
|
|
||
| return { | ||
| document: { ...doc, attributes: { ...doc.attributes, bump_agent_policy_revision: true } }, |
Contributor
There was a problem hiding this comment.
@nchaulet bump_agent_policy_revision if there are 1000 documents, will it bump revision 1000 times? or it will happen only once?
Contributor
Author
There was a problem hiding this comment.
It looks like the revision happens only once.
Member
There was a problem hiding this comment.
It will bump once related code is here https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/fleet/server/services/agent_policies/bump_agent_policies_task.ts#L115
Contributor
|
Starting backport for target branches: 8.19, 9.1 |
Contributor
💔 All backports failed
Manual backportTo create the backport manually run: Questions ?Please refer to the Backport tool documentation |
nickpeihl
pushed a commit
to nickpeihl/kibana
that referenced
this pull request
Sep 25, 2025
## Why this fix is needed In [PR elastic#229595](elastic#229595) the **disabled inputs were omitted from the Synthetics package policy**. When Kibana later discovers a new version of the Synthetics package, Fleet falls back to the **package defaults**, which always include an _enabled_ `synthetics/browser` input. As a result, an unexpected `synthetics/browser` input appears in Fleet. This PR introduces a new model version to disable the browser input for the malformed package policies. ## How to verify that this PR correctly hides the `synthetics/browser` input **Prerequisites** - Local checkouts of **Kibana** and the **Integrations** repository - `elastic-package` installed and on your `$PATH` --- ### 1. Start from an unchanged `main` branch ```bash git checkout main # Confirm the upstream fix for “extra Synthetics inputs” has NOT landed: # when you create a monitor the package policy should still have a single input. ``` --- ### 2. Spin up the stack ```bash # Elasticsearch (trial licence) yarn es snapshot --license trial # Kibana yarn debug --no-base-path --no-dev-config ``` --- ### 3. Create an HTTP monitor in a private location 1. Run the script described in <https://github.com/elastic/kibana/blob/main/x-pack/packages/kbn-synthetics-private-location/README.md> to create a private location. 2. In the **Synthetics** app, create an **HTTP** monitor that targets this location. **Validation:** the generated **package policy** must contain **exactly one input**. --- ### 4. Stop Kibana Press <kbd>Ctrl-C</kbd>; we’ll restart it against a local package registry next. --- ### 5. Create a dummy version of the Synthetics package and run it locally ```bash # Integrations repo cd packages/synthetics elastic-package stack up --services package-registry ``` A local Package Registry is now running at `https://localhost:8080`. --- ### 6. Restart Kibana against the local registry ```bash eval "$(elastic-package stack shellinit)" # exposes $ELASTIC_PACKAGE_CA_CERT export NODE_EXTRA_CA_CERTS=$ELASTIC_PACKAGE_CA_CERT # Point Kibana to the local registry echo "xpack.fleet.registryUrl: https://localhost:8080" >> config/kibana.yml yarn debug --no-base-path --no-dev-config ``` Pointing Kibana to a new version of the Synthetics package will trigger the bug. --- ### 7. Confirm the new browser input is visible You should now see a second **`browser`** input alongside **`http`**. --- ### 8. Checkout this PR and verify the fix Refresh the Synthetics integration page: - The **`browser`** input **must disappear**. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
CoenWarmer
pushed a commit
to CoenWarmer/kibana
that referenced
this pull request
Sep 25, 2025
## Why this fix is needed In [PR elastic#229595](elastic#229595) the **disabled inputs were omitted from the Synthetics package policy**. When Kibana later discovers a new version of the Synthetics package, Fleet falls back to the **package defaults**, which always include an _enabled_ `synthetics/browser` input. As a result, an unexpected `synthetics/browser` input appears in Fleet. This PR introduces a new model version to disable the browser input for the malformed package policies. ## How to verify that this PR correctly hides the `synthetics/browser` input **Prerequisites** - Local checkouts of **Kibana** and the **Integrations** repository - `elastic-package` installed and on your `$PATH` --- ### 1. Start from an unchanged `main` branch ```bash git checkout main # Confirm the upstream fix for “extra Synthetics inputs” has NOT landed: # when you create a monitor the package policy should still have a single input. ``` --- ### 2. Spin up the stack ```bash # Elasticsearch (trial licence) yarn es snapshot --license trial # Kibana yarn debug --no-base-path --no-dev-config ``` --- ### 3. Create an HTTP monitor in a private location 1. Run the script described in <https://github.com/elastic/kibana/blob/main/x-pack/packages/kbn-synthetics-private-location/README.md> to create a private location. 2. In the **Synthetics** app, create an **HTTP** monitor that targets this location. **Validation:** the generated **package policy** must contain **exactly one input**. --- ### 4. Stop Kibana Press <kbd>Ctrl-C</kbd>; we’ll restart it against a local package registry next. --- ### 5. Create a dummy version of the Synthetics package and run it locally ```bash # Integrations repo cd packages/synthetics elastic-package stack up --services package-registry ``` A local Package Registry is now running at `https://localhost:8080`. --- ### 6. Restart Kibana against the local registry ```bash eval "$(elastic-package stack shellinit)" # exposes $ELASTIC_PACKAGE_CA_CERT export NODE_EXTRA_CA_CERTS=$ELASTIC_PACKAGE_CA_CERT # Point Kibana to the local registry echo "xpack.fleet.registryUrl: https://localhost:8080" >> config/kibana.yml yarn debug --no-base-path --no-dev-config ``` Pointing Kibana to a new version of the Synthetics package will trigger the bug. --- ### 7. Confirm the new browser input is visible You should now see a second **`browser`** input alongside **`http`**. --- ### 8. Checkout this PR and verify the fix Refresh the Synthetics integration page: - The **`browser`** input **must disappear**. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
This was referenced Sep 25, 2025
Contributor
Author
💚 All backports created successfully
Note: Successful backport PRs will be merged automatically after passing CI. Questions ?Please refer to the Backport tool documentation |
cesco-f
added a commit
to cesco-f/kibana
that referenced
this pull request
Sep 25, 2025
## Why this fix is needed In [PR elastic#229595](elastic#229595) the **disabled inputs were omitted from the Synthetics package policy**. When Kibana later discovers a new version of the Synthetics package, Fleet falls back to the **package defaults**, which always include an _enabled_ `synthetics/browser` input. As a result, an unexpected `synthetics/browser` input appears in Fleet. This PR introduces a new model version to disable the browser input for the malformed package policies. ## How to verify that this PR correctly hides the `synthetics/browser` input **Prerequisites** - Local checkouts of **Kibana** and the **Integrations** repository - `elastic-package` installed and on your `$PATH` --- ### 1. Start from an unchanged `main` branch ```bash git checkout main # Confirm the upstream fix for “extra Synthetics inputs” has NOT landed: # when you create a monitor the package policy should still have a single input. ``` --- ### 2. Spin up the stack ```bash # Elasticsearch (trial licence) yarn es snapshot --license trial # Kibana yarn debug --no-base-path --no-dev-config ``` --- ### 3. Create an HTTP monitor in a private location 1. Run the script described in <https://github.com/elastic/kibana/blob/main/x-pack/packages/kbn-synthetics-private-location/README.md> to create a private location. 2. In the **Synthetics** app, create an **HTTP** monitor that targets this location. **Validation:** the generated **package policy** must contain **exactly one input**. --- ### 4. Stop Kibana Press <kbd>Ctrl-C</kbd>; we’ll restart it against a local package registry next. --- ### 5. Create a dummy version of the Synthetics package and run it locally ```bash # Integrations repo cd packages/synthetics elastic-package stack up --services package-registry ``` A local Package Registry is now running at `https://localhost:8080`. --- ### 6. Restart Kibana against the local registry ```bash eval "$(elastic-package stack shellinit)" # exposes $ELASTIC_PACKAGE_CA_CERT export NODE_EXTRA_CA_CERTS=$ELASTIC_PACKAGE_CA_CERT # Point Kibana to the local registry echo "xpack.fleet.registryUrl: https://localhost:8080" >> config/kibana.yml yarn debug --no-base-path --no-dev-config ``` Pointing Kibana to a new version of the Synthetics package will trigger the bug. --- ### 7. Confirm the new browser input is visible You should now see a second **`browser`** input alongside **`http`**. --- ### 8. Checkout this PR and verify the fix Refresh the Synthetics integration page: - The **`browser`** input **must disappear**. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> (cherry picked from commit eeb59b8) # Conflicts: # src/core/server/integration_tests/ci_checks/saved_objects/check_registered_types.test.ts # x-pack/platform/plugins/shared/fleet/server/saved_objects/index.ts
VladimirFilonov
pushed a commit
to VladimirFilonov/kibana
that referenced
this pull request
Sep 26, 2025
## Why this fix is needed In [PR elastic#229595](elastic#229595) the **disabled inputs were omitted from the Synthetics package policy**. When Kibana later discovers a new version of the Synthetics package, Fleet falls back to the **package defaults**, which always include an _enabled_ `synthetics/browser` input. As a result, an unexpected `synthetics/browser` input appears in Fleet. This PR introduces a new model version to disable the browser input for the malformed package policies. ## How to verify that this PR correctly hides the `synthetics/browser` input **Prerequisites** - Local checkouts of **Kibana** and the **Integrations** repository - `elastic-package` installed and on your `$PATH` --- ### 1. Start from an unchanged `main` branch ```bash git checkout main # Confirm the upstream fix for “extra Synthetics inputs” has NOT landed: # when you create a monitor the package policy should still have a single input. ``` --- ### 2. Spin up the stack ```bash # Elasticsearch (trial licence) yarn es snapshot --license trial # Kibana yarn debug --no-base-path --no-dev-config ``` --- ### 3. Create an HTTP monitor in a private location 1. Run the script described in <https://github.com/elastic/kibana/blob/main/x-pack/packages/kbn-synthetics-private-location/README.md> to create a private location. 2. In the **Synthetics** app, create an **HTTP** monitor that targets this location. **Validation:** the generated **package policy** must contain **exactly one input**. --- ### 4. Stop Kibana Press <kbd>Ctrl-C</kbd>; we’ll restart it against a local package registry next. --- ### 5. Create a dummy version of the Synthetics package and run it locally ```bash # Integrations repo cd packages/synthetics elastic-package stack up --services package-registry ``` A local Package Registry is now running at `https://localhost:8080`. --- ### 6. Restart Kibana against the local registry ```bash eval "$(elastic-package stack shellinit)" # exposes $ELASTIC_PACKAGE_CA_CERT export NODE_EXTRA_CA_CERTS=$ELASTIC_PACKAGE_CA_CERT # Point Kibana to the local registry echo "xpack.fleet.registryUrl: https://localhost:8080" >> config/kibana.yml yarn debug --no-base-path --no-dev-config ``` Pointing Kibana to a new version of the Synthetics package will trigger the bug. --- ### 7. Confirm the new browser input is visible You should now see a second **`browser`** input alongside **`http`**. --- ### 8. Checkout this PR and verify the fix Refresh the Synthetics integration page: - The **`browser`** input **must disappear**. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
cesco-f
added a commit
that referenced
this pull request
Sep 26, 2025
…236521) # Backport This will backport the following commits from `main` to `8.19`: - [[Fleet] Fix malformed synthetics package policies (#236176)](#236176) <!--- Backport version: 10.0.2 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Francesco Fagnani","email":"fagnani.francesco@gmail.com"},"sourceCommit":{"committedDate":"2025-09-25T15:32:10Z","message":"[Fleet] Fix malformed synthetics package policies (#236176)\n\n## Why this fix is needed\n\nIn [PR #229595](#229595) the\n**disabled inputs were omitted from the Synthetics package policy**.\nWhen Kibana later discovers a new version of the Synthetics package,\nFleet falls back to the **package defaults**, which always include an\n_enabled_ `synthetics/browser` input.\nAs a result, an unexpected `synthetics/browser` input appears in Fleet.\nThis PR introduces a new model version to disable the browser input for\nthe malformed package policies.\n\n## How to verify that this PR correctly hides the `synthetics/browser`\ninput\n\n**Prerequisites** \n- Local checkouts of **Kibana** and the **Integrations** repository \n- `elastic-package` installed and on your `$PATH`\n\n---\n\n### 1. Start from an unchanged `main` branch\n\n```bash\ngit checkout main\n# Confirm the upstream fix for “extra Synthetics inputs” has NOT landed:\n# when you create a monitor the package policy should still have a single input.\n```\n\n---\n\n### 2. Spin up the stack\n\n```bash\n# Elasticsearch (trial licence)\nyarn es snapshot --license trial\n\n# Kibana\nyarn debug --no-base-path --no-dev-config\n```\n\n---\n\n### 3. Create an HTTP monitor in a private location\n\n1. Run the script described in \n\n<https://github.com/elastic/kibana/blob/main/x-pack/packages/kbn-synthetics-private-location/README.md>\n to create a private location.\n2. In the **Synthetics** app, create an **HTTP** monitor that targets\nthis location.\n**Validation:** the generated **package policy** must contain **exactly\none input**.\n\n---\n\n### 4. Stop Kibana\n\nPress <kbd>Ctrl-C</kbd>; we’ll restart it against a local package\nregistry next.\n\n---\n\n### 5. Create a dummy version of the Synthetics package and run it\nlocally\n\n```bash\n# Integrations repo\ncd packages/synthetics\n\nelastic-package stack up --services package-registry\n```\n\nA local Package Registry is now running at `https://localhost:8080`.\n\n---\n\n### 6. Restart Kibana against the local registry\n\n```bash\neval \"$(elastic-package stack shellinit)\" # exposes $ELASTIC_PACKAGE_CA_CERT\nexport NODE_EXTRA_CA_CERTS=$ELASTIC_PACKAGE_CA_CERT\n\n# Point Kibana to the local registry\necho \"xpack.fleet.registryUrl: https://localhost:8080\" >> config/kibana.yml\n\nyarn debug --no-base-path --no-dev-config\n```\nPointing Kibana to a new version of the Synthetics package will trigger\nthe bug.\n\n---\n\n### 7. Confirm the new browser input is visible\n\nYou should now see a second **`browser`** input alongside **`http`**.\n\n---\n\n### 8. Checkout this PR and verify the fix\n\nRefresh the Synthetics integration page:\n\n- The **`browser`** input **must disappear**.\n\n---------\n\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>\nCo-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>","sha":"eeb59b80684be0b2e3fcac133a879f732d1ac9c5","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:Fleet","backport:version","author:obs-ux-management","v9.2.0","v8.19.5","v9.1.5"],"title":"[Fleet] Fix malformed synthetics package policies","number":236176,"url":"https://github.com/elastic/kibana/pull/236176","mergeCommit":{"message":"[Fleet] Fix malformed synthetics package policies (#236176)\n\n## Why this fix is needed\n\nIn [PR #229595](#229595) the\n**disabled inputs were omitted from the Synthetics package policy**.\nWhen Kibana later discovers a new version of the Synthetics package,\nFleet falls back to the **package defaults**, which always include an\n_enabled_ `synthetics/browser` input.\nAs a result, an unexpected `synthetics/browser` input appears in Fleet.\nThis PR introduces a new model version to disable the browser input for\nthe malformed package policies.\n\n## How to verify that this PR correctly hides the `synthetics/browser`\ninput\n\n**Prerequisites** \n- Local checkouts of **Kibana** and the **Integrations** repository \n- `elastic-package` installed and on your `$PATH`\n\n---\n\n### 1. Start from an unchanged `main` branch\n\n```bash\ngit checkout main\n# Confirm the upstream fix for “extra Synthetics inputs” has NOT landed:\n# when you create a monitor the package policy should still have a single input.\n```\n\n---\n\n### 2. Spin up the stack\n\n```bash\n# Elasticsearch (trial licence)\nyarn es snapshot --license trial\n\n# Kibana\nyarn debug --no-base-path --no-dev-config\n```\n\n---\n\n### 3. Create an HTTP monitor in a private location\n\n1. Run the script described in \n\n<https://github.com/elastic/kibana/blob/main/x-pack/packages/kbn-synthetics-private-location/README.md>\n to create a private location.\n2. In the **Synthetics** app, create an **HTTP** monitor that targets\nthis location.\n**Validation:** the generated **package policy** must contain **exactly\none input**.\n\n---\n\n### 4. Stop Kibana\n\nPress <kbd>Ctrl-C</kbd>; we’ll restart it against a local package\nregistry next.\n\n---\n\n### 5. Create a dummy version of the Synthetics package and run it\nlocally\n\n```bash\n# Integrations repo\ncd packages/synthetics\n\nelastic-package stack up --services package-registry\n```\n\nA local Package Registry is now running at `https://localhost:8080`.\n\n---\n\n### 6. Restart Kibana against the local registry\n\n```bash\neval \"$(elastic-package stack shellinit)\" # exposes $ELASTIC_PACKAGE_CA_CERT\nexport NODE_EXTRA_CA_CERTS=$ELASTIC_PACKAGE_CA_CERT\n\n# Point Kibana to the local registry\necho \"xpack.fleet.registryUrl: https://localhost:8080\" >> config/kibana.yml\n\nyarn debug --no-base-path --no-dev-config\n```\nPointing Kibana to a new version of the Synthetics package will trigger\nthe bug.\n\n---\n\n### 7. Confirm the new browser input is visible\n\nYou should now see a second **`browser`** input alongside **`http`**.\n\n---\n\n### 8. Checkout this PR and verify the fix\n\nRefresh the Synthetics integration page:\n\n- The **`browser`** input **must disappear**.\n\n---------\n\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>\nCo-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>","sha":"eeb59b80684be0b2e3fcac133a879f732d1ac9c5"}},"sourceBranch":"main","suggestedTargetBranches":["8.19","9.1"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/236176","number":236176,"mergeCommit":{"message":"[Fleet] Fix malformed synthetics package policies (#236176)\n\n## Why this fix is needed\n\nIn [PR #229595](#229595) the\n**disabled inputs were omitted from the Synthetics package policy**.\nWhen Kibana later discovers a new version of the Synthetics package,\nFleet falls back to the **package defaults**, which always include an\n_enabled_ `synthetics/browser` input.\nAs a result, an unexpected `synthetics/browser` input appears in Fleet.\nThis PR introduces a new model version to disable the browser input for\nthe malformed package policies.\n\n## How to verify that this PR correctly hides the `synthetics/browser`\ninput\n\n**Prerequisites** \n- Local checkouts of **Kibana** and the **Integrations** repository \n- `elastic-package` installed and on your `$PATH`\n\n---\n\n### 1. Start from an unchanged `main` branch\n\n```bash\ngit checkout main\n# Confirm the upstream fix for “extra Synthetics inputs” has NOT landed:\n# when you create a monitor the package policy should still have a single input.\n```\n\n---\n\n### 2. Spin up the stack\n\n```bash\n# Elasticsearch (trial licence)\nyarn es snapshot --license trial\n\n# Kibana\nyarn debug --no-base-path --no-dev-config\n```\n\n---\n\n### 3. Create an HTTP monitor in a private location\n\n1. Run the script described in \n\n<https://github.com/elastic/kibana/blob/main/x-pack/packages/kbn-synthetics-private-location/README.md>\n to create a private location.\n2. In the **Synthetics** app, create an **HTTP** monitor that targets\nthis location.\n**Validation:** the generated **package policy** must contain **exactly\none input**.\n\n---\n\n### 4. Stop Kibana\n\nPress <kbd>Ctrl-C</kbd>; we’ll restart it against a local package\nregistry next.\n\n---\n\n### 5. Create a dummy version of the Synthetics package and run it\nlocally\n\n```bash\n# Integrations repo\ncd packages/synthetics\n\nelastic-package stack up --services package-registry\n```\n\nA local Package Registry is now running at `https://localhost:8080`.\n\n---\n\n### 6. Restart Kibana against the local registry\n\n```bash\neval \"$(elastic-package stack shellinit)\" # exposes $ELASTIC_PACKAGE_CA_CERT\nexport NODE_EXTRA_CA_CERTS=$ELASTIC_PACKAGE_CA_CERT\n\n# Point Kibana to the local registry\necho \"xpack.fleet.registryUrl: https://localhost:8080\" >> config/kibana.yml\n\nyarn debug --no-base-path --no-dev-config\n```\nPointing Kibana to a new version of the Synthetics package will trigger\nthe bug.\n\n---\n\n### 7. Confirm the new browser input is visible\n\nYou should now see a second **`browser`** input alongside **`http`**.\n\n---\n\n### 8. Checkout this PR and verify the fix\n\nRefresh the Synthetics integration page:\n\n- The **`browser`** input **must disappear**.\n\n---------\n\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>\nCo-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>","sha":"eeb59b80684be0b2e3fcac133a879f732d1ac9c5"}},{"branch":"8.19","label":"v8.19.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.1","label":"v9.1.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
cesco-f
added a commit
that referenced
this pull request
Sep 26, 2025
…36520) # Backport This will backport the following commits from `main` to `9.1`: - [[Fleet] Fix malformed synthetics package policies (#236176)](#236176) <!--- Backport version: 10.0.2 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Francesco Fagnani","email":"fagnani.francesco@gmail.com"},"sourceCommit":{"committedDate":"2025-09-25T15:32:10Z","message":"[Fleet] Fix malformed synthetics package policies (#236176)\n\n## Why this fix is needed\n\nIn [PR #229595](#229595) the\n**disabled inputs were omitted from the Synthetics package policy**.\nWhen Kibana later discovers a new version of the Synthetics package,\nFleet falls back to the **package defaults**, which always include an\n_enabled_ `synthetics/browser` input.\nAs a result, an unexpected `synthetics/browser` input appears in Fleet.\nThis PR introduces a new model version to disable the browser input for\nthe malformed package policies.\n\n## How to verify that this PR correctly hides the `synthetics/browser`\ninput\n\n**Prerequisites** \n- Local checkouts of **Kibana** and the **Integrations** repository \n- `elastic-package` installed and on your `$PATH`\n\n---\n\n### 1. Start from an unchanged `main` branch\n\n```bash\ngit checkout main\n# Confirm the upstream fix for “extra Synthetics inputs” has NOT landed:\n# when you create a monitor the package policy should still have a single input.\n```\n\n---\n\n### 2. Spin up the stack\n\n```bash\n# Elasticsearch (trial licence)\nyarn es snapshot --license trial\n\n# Kibana\nyarn debug --no-base-path --no-dev-config\n```\n\n---\n\n### 3. Create an HTTP monitor in a private location\n\n1. Run the script described in \n\n<https://github.com/elastic/kibana/blob/main/x-pack/packages/kbn-synthetics-private-location/README.md>\n to create a private location.\n2. In the **Synthetics** app, create an **HTTP** monitor that targets\nthis location.\n**Validation:** the generated **package policy** must contain **exactly\none input**.\n\n---\n\n### 4. Stop Kibana\n\nPress <kbd>Ctrl-C</kbd>; we’ll restart it against a local package\nregistry next.\n\n---\n\n### 5. Create a dummy version of the Synthetics package and run it\nlocally\n\n```bash\n# Integrations repo\ncd packages/synthetics\n\nelastic-package stack up --services package-registry\n```\n\nA local Package Registry is now running at `https://localhost:8080`.\n\n---\n\n### 6. Restart Kibana against the local registry\n\n```bash\neval \"$(elastic-package stack shellinit)\" # exposes $ELASTIC_PACKAGE_CA_CERT\nexport NODE_EXTRA_CA_CERTS=$ELASTIC_PACKAGE_CA_CERT\n\n# Point Kibana to the local registry\necho \"xpack.fleet.registryUrl: https://localhost:8080\" >> config/kibana.yml\n\nyarn debug --no-base-path --no-dev-config\n```\nPointing Kibana to a new version of the Synthetics package will trigger\nthe bug.\n\n---\n\n### 7. Confirm the new browser input is visible\n\nYou should now see a second **`browser`** input alongside **`http`**.\n\n---\n\n### 8. Checkout this PR and verify the fix\n\nRefresh the Synthetics integration page:\n\n- The **`browser`** input **must disappear**.\n\n---------\n\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>\nCo-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>","sha":"eeb59b80684be0b2e3fcac133a879f732d1ac9c5","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:Fleet","backport:version","author:obs-ux-management","v9.2.0","v8.19.5","v9.1.5"],"title":"[Fleet] Fix malformed synthetics package policies","number":236176,"url":"https://github.com/elastic/kibana/pull/236176","mergeCommit":{"message":"[Fleet] Fix malformed synthetics package policies (#236176)\n\n## Why this fix is needed\n\nIn [PR #229595](#229595) the\n**disabled inputs were omitted from the Synthetics package policy**.\nWhen Kibana later discovers a new version of the Synthetics package,\nFleet falls back to the **package defaults**, which always include an\n_enabled_ `synthetics/browser` input.\nAs a result, an unexpected `synthetics/browser` input appears in Fleet.\nThis PR introduces a new model version to disable the browser input for\nthe malformed package policies.\n\n## How to verify that this PR correctly hides the `synthetics/browser`\ninput\n\n**Prerequisites** \n- Local checkouts of **Kibana** and the **Integrations** repository \n- `elastic-package` installed and on your `$PATH`\n\n---\n\n### 1. Start from an unchanged `main` branch\n\n```bash\ngit checkout main\n# Confirm the upstream fix for “extra Synthetics inputs” has NOT landed:\n# when you create a monitor the package policy should still have a single input.\n```\n\n---\n\n### 2. Spin up the stack\n\n```bash\n# Elasticsearch (trial licence)\nyarn es snapshot --license trial\n\n# Kibana\nyarn debug --no-base-path --no-dev-config\n```\n\n---\n\n### 3. Create an HTTP monitor in a private location\n\n1. Run the script described in \n\n<https://github.com/elastic/kibana/blob/main/x-pack/packages/kbn-synthetics-private-location/README.md>\n to create a private location.\n2. In the **Synthetics** app, create an **HTTP** monitor that targets\nthis location.\n**Validation:** the generated **package policy** must contain **exactly\none input**.\n\n---\n\n### 4. Stop Kibana\n\nPress <kbd>Ctrl-C</kbd>; we’ll restart it against a local package\nregistry next.\n\n---\n\n### 5. Create a dummy version of the Synthetics package and run it\nlocally\n\n```bash\n# Integrations repo\ncd packages/synthetics\n\nelastic-package stack up --services package-registry\n```\n\nA local Package Registry is now running at `https://localhost:8080`.\n\n---\n\n### 6. Restart Kibana against the local registry\n\n```bash\neval \"$(elastic-package stack shellinit)\" # exposes $ELASTIC_PACKAGE_CA_CERT\nexport NODE_EXTRA_CA_CERTS=$ELASTIC_PACKAGE_CA_CERT\n\n# Point Kibana to the local registry\necho \"xpack.fleet.registryUrl: https://localhost:8080\" >> config/kibana.yml\n\nyarn debug --no-base-path --no-dev-config\n```\nPointing Kibana to a new version of the Synthetics package will trigger\nthe bug.\n\n---\n\n### 7. Confirm the new browser input is visible\n\nYou should now see a second **`browser`** input alongside **`http`**.\n\n---\n\n### 8. Checkout this PR and verify the fix\n\nRefresh the Synthetics integration page:\n\n- The **`browser`** input **must disappear**.\n\n---------\n\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>\nCo-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>","sha":"eeb59b80684be0b2e3fcac133a879f732d1ac9c5"}},"sourceBranch":"main","suggestedTargetBranches":["8.19","9.1"],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/236176","number":236176,"mergeCommit":{"message":"[Fleet] Fix malformed synthetics package policies (#236176)\n\n## Why this fix is needed\n\nIn [PR #229595](#229595) the\n**disabled inputs were omitted from the Synthetics package policy**.\nWhen Kibana later discovers a new version of the Synthetics package,\nFleet falls back to the **package defaults**, which always include an\n_enabled_ `synthetics/browser` input.\nAs a result, an unexpected `synthetics/browser` input appears in Fleet.\nThis PR introduces a new model version to disable the browser input for\nthe malformed package policies.\n\n## How to verify that this PR correctly hides the `synthetics/browser`\ninput\n\n**Prerequisites** \n- Local checkouts of **Kibana** and the **Integrations** repository \n- `elastic-package` installed and on your `$PATH`\n\n---\n\n### 1. Start from an unchanged `main` branch\n\n```bash\ngit checkout main\n# Confirm the upstream fix for “extra Synthetics inputs” has NOT landed:\n# when you create a monitor the package policy should still have a single input.\n```\n\n---\n\n### 2. Spin up the stack\n\n```bash\n# Elasticsearch (trial licence)\nyarn es snapshot --license trial\n\n# Kibana\nyarn debug --no-base-path --no-dev-config\n```\n\n---\n\n### 3. Create an HTTP monitor in a private location\n\n1. Run the script described in \n\n<https://github.com/elastic/kibana/blob/main/x-pack/packages/kbn-synthetics-private-location/README.md>\n to create a private location.\n2. In the **Synthetics** app, create an **HTTP** monitor that targets\nthis location.\n**Validation:** the generated **package policy** must contain **exactly\none input**.\n\n---\n\n### 4. Stop Kibana\n\nPress <kbd>Ctrl-C</kbd>; we’ll restart it against a local package\nregistry next.\n\n---\n\n### 5. Create a dummy version of the Synthetics package and run it\nlocally\n\n```bash\n# Integrations repo\ncd packages/synthetics\n\nelastic-package stack up --services package-registry\n```\n\nA local Package Registry is now running at `https://localhost:8080`.\n\n---\n\n### 6. Restart Kibana against the local registry\n\n```bash\neval \"$(elastic-package stack shellinit)\" # exposes $ELASTIC_PACKAGE_CA_CERT\nexport NODE_EXTRA_CA_CERTS=$ELASTIC_PACKAGE_CA_CERT\n\n# Point Kibana to the local registry\necho \"xpack.fleet.registryUrl: https://localhost:8080\" >> config/kibana.yml\n\nyarn debug --no-base-path --no-dev-config\n```\nPointing Kibana to a new version of the Synthetics package will trigger\nthe bug.\n\n---\n\n### 7. Confirm the new browser input is visible\n\nYou should now see a second **`browser`** input alongside **`http`**.\n\n---\n\n### 8. Checkout this PR and verify the fix\n\nRefresh the Synthetics integration page:\n\n- The **`browser`** input **must disappear**.\n\n---------\n\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>\nCo-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>","sha":"eeb59b80684be0b2e3fcac133a879f732d1ac9c5"}},{"branch":"8.19","label":"v8.19.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.1","label":"v9.1.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
niros1
pushed a commit
that referenced
this pull request
Sep 30, 2025
## Why this fix is needed In [PR #229595](#229595) the **disabled inputs were omitted from the Synthetics package policy**. When Kibana later discovers a new version of the Synthetics package, Fleet falls back to the **package defaults**, which always include an _enabled_ `synthetics/browser` input. As a result, an unexpected `synthetics/browser` input appears in Fleet. This PR introduces a new model version to disable the browser input for the malformed package policies. ## How to verify that this PR correctly hides the `synthetics/browser` input **Prerequisites** - Local checkouts of **Kibana** and the **Integrations** repository - `elastic-package` installed and on your `$PATH` --- ### 1. Start from an unchanged `main` branch ```bash git checkout main # Confirm the upstream fix for “extra Synthetics inputs” has NOT landed: # when you create a monitor the package policy should still have a single input. ``` --- ### 2. Spin up the stack ```bash # Elasticsearch (trial licence) yarn es snapshot --license trial # Kibana yarn debug --no-base-path --no-dev-config ``` --- ### 3. Create an HTTP monitor in a private location 1. Run the script described in <https://github.com/elastic/kibana/blob/main/x-pack/packages/kbn-synthetics-private-location/README.md> to create a private location. 2. In the **Synthetics** app, create an **HTTP** monitor that targets this location. **Validation:** the generated **package policy** must contain **exactly one input**. --- ### 4. Stop Kibana Press <kbd>Ctrl-C</kbd>; we’ll restart it against a local package registry next. --- ### 5. Create a dummy version of the Synthetics package and run it locally ```bash # Integrations repo cd packages/synthetics elastic-package stack up --services package-registry ``` A local Package Registry is now running at `https://localhost:8080`. --- ### 6. Restart Kibana against the local registry ```bash eval "$(elastic-package stack shellinit)" # exposes $ELASTIC_PACKAGE_CA_CERT export NODE_EXTRA_CA_CERTS=$ELASTIC_PACKAGE_CA_CERT # Point Kibana to the local registry echo "xpack.fleet.registryUrl: https://localhost:8080" >> config/kibana.yml yarn debug --no-base-path --no-dev-config ``` Pointing Kibana to a new version of the Synthetics package will trigger the bug. --- ### 7. Confirm the new browser input is visible You should now see a second **`browser`** input alongside **`http`**. --- ### 8. Checkout this PR and verify the fix Refresh the Synthetics integration page: - The **`browser`** input **must disappear**. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
rylnd
pushed a commit
to rylnd/kibana
that referenced
this pull request
Oct 17, 2025
## Why this fix is needed In [PR elastic#229595](elastic#229595) the **disabled inputs were omitted from the Synthetics package policy**. When Kibana later discovers a new version of the Synthetics package, Fleet falls back to the **package defaults**, which always include an _enabled_ `synthetics/browser` input. As a result, an unexpected `synthetics/browser` input appears in Fleet. This PR introduces a new model version to disable the browser input for the malformed package policies. ## How to verify that this PR correctly hides the `synthetics/browser` input **Prerequisites** - Local checkouts of **Kibana** and the **Integrations** repository - `elastic-package` installed and on your `$PATH` --- ### 1. Start from an unchanged `main` branch ```bash git checkout main # Confirm the upstream fix for “extra Synthetics inputs” has NOT landed: # when you create a monitor the package policy should still have a single input. ``` --- ### 2. Spin up the stack ```bash # Elasticsearch (trial licence) yarn es snapshot --license trial # Kibana yarn debug --no-base-path --no-dev-config ``` --- ### 3. Create an HTTP monitor in a private location 1. Run the script described in <https://github.com/elastic/kibana/blob/main/x-pack/packages/kbn-synthetics-private-location/README.md> to create a private location. 2. In the **Synthetics** app, create an **HTTP** monitor that targets this location. **Validation:** the generated **package policy** must contain **exactly one input**. --- ### 4. Stop Kibana Press <kbd>Ctrl-C</kbd>; we’ll restart it against a local package registry next. --- ### 5. Create a dummy version of the Synthetics package and run it locally ```bash # Integrations repo cd packages/synthetics elastic-package stack up --services package-registry ``` A local Package Registry is now running at `https://localhost:8080`. --- ### 6. Restart Kibana against the local registry ```bash eval "$(elastic-package stack shellinit)" # exposes $ELASTIC_PACKAGE_CA_CERT export NODE_EXTRA_CA_CERTS=$ELASTIC_PACKAGE_CA_CERT # Point Kibana to the local registry echo "xpack.fleet.registryUrl: https://localhost:8080" >> config/kibana.yml yarn debug --no-base-path --no-dev-config ``` Pointing Kibana to a new version of the Synthetics package will trigger the bug. --- ### 7. Confirm the new browser input is visible You should now see a second **`browser`** input alongside **`http`**. --- ### 8. Checkout this PR and verify the fix Refresh the Synthetics integration page: - The **`browser`** input **must disappear**. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why this fix is needed
In PR #229595 the disabled inputs were omitted from the Synthetics package policy.
When Kibana later discovers a new version of the Synthetics package, Fleet falls back to the package defaults, which always include an enabled
synthetics/browserinput.As a result, an unexpected
synthetics/browserinput appears in Fleet.This PR introduces a new model version to disable the browser input for the malformed package policies.
How to verify that this PR correctly hides the
synthetics/browserinputPrerequisites
elastic-packageinstalled and on your$PATH1. Start from an unchanged
mainbranch2. Spin up the stack
3. Create an HTTP monitor in a private location
https://github.com/elastic/kibana/blob/main/x-pack/packages/kbn-synthetics-private-location/README.md
to create a private location.
Validation: the generated package policy must contain exactly one input.
4. Stop Kibana
Press Ctrl-C; we’ll restart it against a local package registry next.
5. Create a dummy version of the Synthetics package and run it locally
A local Package Registry is now running at
https://localhost:8080.6. Restart Kibana against the local registry
Pointing Kibana to a new version of the Synthetics package will trigger the bug.
7. Confirm the new browser input is visible
You should now see a second
browserinput alongsidehttp.8. Checkout this PR and verify the fix
Refresh the Synthetics integration page:
browserinput must disappear.