Skip to content

Fix enforcement of unique policy name of policies across spaces#239631

Merged
MichelLosier merged 27 commits intoelastic:mainfrom
MichelLosier:enforce-spaceaware-unique-policy-name
Nov 4, 2025
Merged

Fix enforcement of unique policy name of policies across spaces#239631
MichelLosier merged 27 commits intoelastic:mainfrom
MichelLosier:enforce-spaceaware-unique-policy-name

Conversation

@MichelLosier
Copy link
Contributor

@MichelLosier MichelLosier commented Oct 17, 2025 •
edited by kibanamachine
Loading

Summary

Resolves: #228746

This fixes a couple scenarios:

  • (From original ticket): When creating an agent policy with packages (like system), the name incrementation accounts for package names that already exist in the spaces to be set for the new policy.
  • Creating or updating an agent policy for multiple spaces that has the same name of another policy that is not in the current namespace now results in an error.
  • When an agent policy with multiple spaces has an integration policy name updated to one that already exists in another space that is not the current namespace now results in an error.

Implementation overview

This fix makes sure that create and update agent policy handlers pass the provided space_ids to the agentPolicyService class so that they can be used in cross-space saved object queries when validating name uniqueness, while making sure the space_ids field is not persisted in the actual SO since this field is derived from the actual SO namespaces value.

The uniqueness check happens in a couple places:

  • When creating / updating an agent policy new names, or name changes are checked in the service class.
    • Since the service class doesn't own space assignment changes, and space assignment changes only happen when calling the REST API this makes sure we have multi-space checks when the service class is called directly and there is a name change.
  • When space ids are updated for a policy in the route handler.
  • Existing policies that are duplicate named in shared spaces should maintain status quo for all edits unless space or name changes happen.

Release notes

Fixes fleet policy name uniqueness not being consistently enforced across spaces when name or space changes occur

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

  • Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
  • Documentation was added for features that require explanation or tutorials
  • Unit or functional tests were updated or added to match the most common scenarios
  • If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
  • This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
  • Flaky Test Runner was used on any tests changed
  • The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
  • Review the backport guidelines and apply applicable backport:* labels.

Identify risks

Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging.
@MichelLosier
Copy link
Contributor Author

MichelLosier commented Oct 17, 2025

/ci
1 similar comment
@MichelLosier
Copy link
Contributor Author

MichelLosier commented Oct 21, 2025

/ci
@MichelLosier
Check name uniqueness across an agent policy's spaces
e87bbb4
@MichelLosier
Check name uniqueness of agent policy spaces on create
62120da
@MichelLosier
Remove optionality of name uniqueness check when updating agent polic…
e01bee9 
…y spaces
@MichelLosier
Add and update tests for agentPolicyService.requireUniqueName
a16c5a9
@MichelLosier
Increment package names with space awareness when creating agent poli…
1e4a070 
…cies
@MichelLosier
Have agentPolicyService.requireUniqueName use own client when multipl…
9e2371f 
…e spaceids provided
@MichelLosier
WIP add FTR tests for agent policy name uniqueness
eee0ff0
@MichelLosier
Add FTR tests for agent policy space aware name uniqueness
f4c452e
@MichelLosier
Fix type issues
5ebb7d2
@MichelLosier
WIP: package policy multispace name conflict tests
42fab4c
@MichelLosier
Add FTR tests for handling package policy spaceaware name conflict ch…
a189fdb 
…ecks
@MichelLosier
Have packagePolicyClient create and update enforce name uniqueness
b77ded2
@MichelLosier MichelLosier force-pushed the enforce-spaceaware-unique-policy-name branch from 895b415 to b77ded2 Compare October 27, 2025 22:49
@MichelLosier
Copy link
Contributor Author

MichelLosier commented Oct 27, 2025

/ci
@MichelLosier
Copy link
Contributor Author

MichelLosier commented Oct 28, 2025

/ci
@MichelLosier
Copy link
Contributor Author

MichelLosier commented Oct 28, 2025

/ci
@MichelLosier
Copy link
Contributor Author

MichelLosier commented Oct 29, 2025

/ci
@MichelLosier MichelLosier marked this pull request as ready for review October 29, 2025 19:13
@MichelLosier MichelLosier requested a review from a team as a code owner October 29, 2025 19:13
@MichelLosier MichelLosier added backport:version Backport to applied version labels v9.3.0 v9.2.1 v9.1.7 labels Oct 30, 2025
@MichelLosier MichelLosier self-assigned this Nov 3, 2025
@nchaulet nchaulet self-requested a review November 3, 2025 20:15
@elasticmachine
Copy link
Contributor

elasticmachine commented Nov 4, 2025

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] Scout Test Run Builder / serverless-security - EUI testing wrapper: EuiDataGrid - data grid, run

Metrics [docs]

✅ unchanged

History

cc @MichelLosier
nchaulet
nchaulet approved these changes Nov 4, 2025
View reviewed changes
Copy link
Member

@nchaulet nchaulet left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚀
@MichelLosier MichelLosier merged commit e15311c into elastic:main Nov 4, 2025
12 checks passed
@kibanamachine
Copy link
Contributor

kibanamachine commented Nov 4, 2025

Starting backport for target branches: 9.1, 9.2

https://github.com/elastic/kibana/actions/runs/19081859500
@kibanamachine
Copy link
Contributor

kibanamachine commented Nov 4, 2025

💔 All backports failed

Status Branch Result
❌ 9.1 Backport failed because of merge conflicts
❌ 9.2 Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 239631

Questions ?

Please refer to the Backport tool documentation
@MichelLosier MichelLosier mentioned this pull request Nov 4, 2025
Merged
MichelLosier added a commit to MichelLosier/kibana that referenced this pull request Nov 4, 2025
@MichelLosier
Fix enforcement of unique policy name of policies across spaces (elas…
b843742 
…tic#239631)

Resolves: elastic#228746

Fixes fleet policy name uniqueness not being consistently enforced
across spaces when name or space changes occur:

* When creating an agent policy with packages
(like system), the name incrementation accounts for package names that
already exist in the spaces to be set for the new policy.
* Creating or updating an agent policy for multiple spaces that has the
same name of another policy that is not in the current namespace now
results in an error.
* When an agent policy with multiple spaces has an integration policy
name updated to one that already exists in another space that is not the
current namespace now results in an error.

(cherry picked from commit e15311c)

# Conflicts:
#	x-pack/platform/plugins/shared/fleet/server/services/agent_policy.test.ts
#	x-pack/platform/test/fleet_api_integration/apis/space_awareness/agent_policies.ts
#	x-pack/platform/test/fleet_api_integration/apis/space_awareness/api_helper.ts
#	x-pack/platform/test/fleet_api_integration/apis/space_awareness/package_policies.ts
@MichelLosier MichelLosier mentioned this pull request Nov 4, 2025
Merged
@MichelLosier
Copy link
Contributor Author

MichelLosier commented Nov 4, 2025

💚 All backports created successfully

Status Branch Result
✅ 9.2
✅ 9.1

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation
MichelLosier added a commit to MichelLosier/kibana that referenced this pull request Nov 4, 2025
@MichelLosier
Fix enforcement of unique policy name of policies across spaces (elas…
9083b02 
…tic#239631)

Resolves: elastic#228746

Fixes fleet policy name uniqueness not being consistently enforced
across spaces when name or space changes occur:

* When creating an agent policy with packages
(like system), the name incrementation accounts for package names that
already exist in the spaces to be set for the new policy.
* Creating or updating an agent policy for multiple spaces that has the
same name of another policy that is not in the current namespace now
results in an error.
* When an agent policy with multiple spaces has an integration policy
name updated to one that already exists in another space that is not the
current namespace now results in an error.

(cherry picked from commit e15311c)

# Conflicts:
#	x-pack/platform/plugins/shared/fleet/server/services/agent_policy.test.ts
#	x-pack/platform/plugins/shared/fleet/server/services/agent_policy_create.ts
#	x-pack/platform/plugins/shared/fleet/server/services/package_policies/upgrade.test.ts
#	x-pack/platform/plugins/shared/fleet/server/services/package_policy.ts
#	x-pack/platform/test/fleet_api_integration/apis/space_awareness/agent_policies.ts
#	x-pack/platform/test/fleet_api_integration/apis/space_awareness/api_helper.ts
#	x-pack/platform/test/fleet_api_integration/apis/space_awareness/package_policies.ts
@kibanamachine kibanamachine mentioned this pull request Nov 5, 2025
Merged
MichelLosier added a commit that referenced this pull request Nov 5, 2025
@MichelLosier
[9.2] Fix enforcement of unique policy name of policies across spaces (…
df316a3 
…#239631) (#241884)

# Backport

This will backport the following commits from `main` to `9.2`:
- [Fix enforcement of unique policy name of policies across spaces
(#239631)](#239631)

<!--- Backport version: 10.1.0 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Michel
Losier","email":"michel.losier@elastic.co"},"sourceCommit":{"committedDate":"2025-11-04T20:25:43Z","message":"Fix
enforcement of unique policy name of policies across spaces
(#239631)\n\nResolves:
https://github.com/elastic/kibana/issues/228746\n\nFixes fleet policy
name uniqueness not being consistently enforced\nacross spaces when name
or space changes occur:\n\n* When creating an agent policy with
packages\n(like system), the name incrementation accounts for package
names that\nalready exist in the spaces to be set for the new policy.\n*
Creating or updating an agent policy for multiple spaces that has
the\nsame name of another policy that is not in the current namespace
now\nresults in an error.\n* When an agent policy with multiple spaces
has an integration policy\nname updated to one that already exists in
another space that is not the\ncurrent namespace now results in an
error.","sha":"e15311c5a7ad2052046f5da0cea0c5815dfd4d73","branchLabelMapping":{"^v9.3.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:Fleet","backport:version","v9.3.0","v9.1.7","v9.2.1"],"title":"Fix
enforcement of unique policy name of policies across
spaces","number":239631,"url":"https://github.com/elastic/kibana/pull/239631","mergeCommit":{"message":"Fix
enforcement of unique policy name of policies across spaces
(#239631)\n\nResolves:
https://github.com/elastic/kibana/issues/228746\n\nFixes fleet policy
name uniqueness not being consistently enforced\nacross spaces when name
or space changes occur:\n\n* When creating an agent policy with
packages\n(like system), the name incrementation accounts for package
names that\nalready exist in the spaces to be set for the new policy.\n*
Creating or updating an agent policy for multiple spaces that has
the\nsame name of another policy that is not in the current namespace
now\nresults in an error.\n* When an agent policy with multiple spaces
has an integration policy\nname updated to one that already exists in
another space that is not the\ncurrent namespace now results in an
error.","sha":"e15311c5a7ad2052046f5da0cea0c5815dfd4d73"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","9.2"],"targetPullRequestStates":[{"branch":"main","label":"v9.3.0","branchLabelMappingKey":"^v9.3.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/239631","number":239631,"mergeCommit":{"message":"Fix
enforcement of unique policy name of policies across spaces
(#239631)\n\nResolves:
https://github.com/elastic/kibana/issues/228746\n\nFixes fleet policy
name uniqueness not being consistently enforced\nacross spaces when name
or space changes occur:\n\n* When creating an agent policy with
packages\n(like system), the name incrementation accounts for package
names that\nalready exist in the spaces to be set for the new policy.\n*
Creating or updating an agent policy for multiple spaces that has
the\nsame name of another policy that is not in the current namespace
now\nresults in an error.\n* When an agent policy with multiple spaces
has an integration policy\nname updated to one that already exists in
another space that is not the\ncurrent namespace now results in an
error.","sha":"e15311c5a7ad2052046f5da0cea0c5815dfd4d73"}},{"branch":"9.1","label":"v9.1.7","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.2","label":"v9.2.1","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->
wildemat pushed a commit to wildemat/kibana that referenced this pull request Nov 5, 2025
@MichelLosier @wildemat
Fix enforcement of unique policy name of policies across spaces (elas…
bbb5539 
…tic#239631)

Resolves: elastic#228746

Fixes fleet policy name uniqueness not being consistently enforced
across spaces when name or space changes occur:

* When creating an agent policy with packages
(like system), the name incrementation accounts for package names that
already exist in the spaces to be set for the new policy.
* Creating or updating an agent policy for multiple spaces that has the
same name of another policy that is not in the current namespace now
results in an error.
* When an agent policy with multiple spaces has an integration policy
name updated to one that already exists in another space that is not the
current namespace now results in an error.
viduni94 pushed a commit to viduni94/kibana that referenced this pull request Nov 5, 2025
@MichelLosier @viduni94
Fix enforcement of unique policy name of policies across spaces (elas…
79749b6 
…tic#239631)

Resolves: elastic#228746

Fixes fleet policy name uniqueness not being consistently enforced
across spaces when name or space changes occur:

* When creating an agent policy with packages
(like system), the name incrementation accounts for package names that
already exist in the spaces to be set for the new policy.
* Creating or updating an agent policy for multiple spaces that has the
same name of another policy that is not in the current namespace now
results in an error.
* When an agent policy with multiple spaces has an integration policy
name updated to one that already exists in another space that is not the
current namespace now results in an error.
MichelLosier added a commit that referenced this pull request Nov 6, 2025
@MichelLosier
[9.1] Fix enforcement of unique policy name of policies across spaces (…
6fc25bd 
…#239631) (#241885)

# Backport

This will backport the following commits from `main` to `9.1`:
- [Fix enforcement of unique policy name of policies across spaces
(#239631)](#239631)

<!--- Backport version: 10.1.0 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Michel
Losier","email":"michel.losier@elastic.co"},"sourceCommit":{"committedDate":"2025-11-04T20:25:43Z","message":"Fix
enforcement of unique policy name of policies across spaces
(#239631)\n\nResolves:
https://github.com/elastic/kibana/issues/228746\n\nFixes fleet policy
name uniqueness not being consistently enforced\nacross spaces when name
or space changes occur:\n\n* When creating an agent policy with
packages\n(like system), the name incrementation accounts for package
names that\nalready exist in the spaces to be set for the new policy.\n*
Creating or updating an agent policy for multiple spaces that has
the\nsame name of another policy that is not in the current namespace
now\nresults in an error.\n* When an agent policy with multiple spaces
has an integration policy\nname updated to one that already exists in
another space that is not the\ncurrent namespace now results in an
error.","sha":"e15311c5a7ad2052046f5da0cea0c5815dfd4d73","branchLabelMapping":{"^v9.3.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:Fleet","backport:version","v9.3.0","v9.1.7","v9.2.1"],"title":"Fix
enforcement of unique policy name of policies across
spaces","number":239631,"url":"https://github.com/elastic/kibana/pull/239631","mergeCommit":{"message":"Fix
enforcement of unique policy name of policies across spaces
(#239631)\n\nResolves:
https://github.com/elastic/kibana/issues/228746\n\nFixes fleet policy
name uniqueness not being consistently enforced\nacross spaces when name
or space changes occur:\n\n* When creating an agent policy with
packages\n(like system), the name incrementation accounts for package
names that\nalready exist in the spaces to be set for the new policy.\n*
Creating or updating an agent policy for multiple spaces that has
the\nsame name of another policy that is not in the current namespace
now\nresults in an error.\n* When an agent policy with multiple spaces
has an integration policy\nname updated to one that already exists in
another space that is not the\ncurrent namespace now results in an
error.","sha":"e15311c5a7ad2052046f5da0cea0c5815dfd4d73"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","9.2"],"targetPullRequestStates":[{"branch":"main","label":"v9.3.0","branchLabelMappingKey":"^v9.3.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/239631","number":239631,"mergeCommit":{"message":"Fix
enforcement of unique policy name of policies across spaces
(#239631)\n\nResolves:
https://github.com/elastic/kibana/issues/228746\n\nFixes fleet policy
name uniqueness not being consistently enforced\nacross spaces when name
or space changes occur:\n\n* When creating an agent policy with
packages\n(like system), the name incrementation accounts for package
names that\nalready exist in the spaces to be set for the new policy.\n*
Creating or updating an agent policy for multiple spaces that has
the\nsame name of another policy that is not in the current namespace
now\nresults in an error.\n* When an agent policy with multiple spaces
has an integration policy\nname updated to one that already exists in
another space that is not the\ncurrent namespace now results in an
error.","sha":"e15311c5a7ad2052046f5da0cea0c5815dfd4d73"}},{"branch":"9.1","label":"v9.1.7","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.2","label":"v9.2.1","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->
@mistic mistic added v9.1.8 and removed v9.1.7 labels Nov 12, 2025
eokoneyo pushed a commit to eokoneyo/kibana that referenced this pull request Dec 2, 2025
@MichelLosier @eokoneyo
Fix enforcement of unique policy name of policies across spaces (elas…
92a3ea3 
…tic#239631)

Resolves: elastic#228746

Fixes fleet policy name uniqueness not being consistently enforced
across spaces when name or space changes occur:

* When creating an agent policy with packages
(like system), the name incrementation accounts for package names that
already exist in the spaces to be set for the new policy.
* Creating or updating an agent policy for multiple spaces that has the
same name of another policy that is not in the current namespace now
results in an error.
* When an agent policy with multiple spaces has an integration policy
name updated to one that already exists in another space that is not the
current namespace now results in an error.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:version Backport to applied version labels release_note:fix Team:Fleet Team label for Observability Data Collection Fleet team v9.1.8 v9.2.1 v9.3.0

5 participants

@MichelLosier @elasticmachine @kibanamachine @nchaulet @mistic