[Fleet] Add integration knowledge opt out UI setting and enable feature flag

[juliaElastic]

Summary

Closes https://github.com/elastic/ingest-dev/issues/6276

• Enable feature flag installIntegrationsKnowledge by default
• Added setting integration_knowledge_enabled to ingest_manager_settings SO to save the UI setting
• When the integration knowledge user setting is turned off, new package installations will skip the knowledge base indexing step
• When the integration knowledge user setting is turned on again, there is a one-time async task scheduled that reindexes knowledge base for installed packages

The Manage integration knowledge action is added to Installed integrations table.

Clicking the action opens the flyout about the Knowledge base information and the switch to be able to opt out.

UX design follows Figma

To verify:

• Open the flyout and verify that the switch is on by default
• Turn the switch off and click Save on the flyout
• Install a new package and verify that the knowledge_base ES asset is not created
• Go back to the flyout and switch the setting on again
• Verify that the previously installed package has now an ES asset type knowledge_base

GET .kibana_ingest/_doc/epm-packages:apache

"installed_es": [
...
        {
          "id": "apache-README.md",
          "type": "knowledge_base"
        }
      ],

Kibana logs

[2025-12-03T13:30:34.253+01:00][INFO ][plugins.fleet] Scheduling task to reindex integration knowledge for installed packages

[2025-12-03T13:30:36.584+01:00][DEBUG][plugins.fleet] Successfully indexed 1 knowledge base documents for package apache. Document IDs: apache-README.md
[2025-12-03T13:30:36.585+01:00][DEBUG][plugins.fleet] Knowledge base step: Saved 1 documents to index for package apache@2.1.1
[2025-12-03T13:30:36.587+01:00][DEBUG][plugins.fleet] Successfully indexed 1 knowledge base documents for package system. Document IDs: system-README.md
[2025-12-03T13:30:36.587+01:00][DEBUG][plugins.fleet] Knowledge base step: Saved 1 documents to index for package system@2.8.0

Added tour component and learn more link:

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
• This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
• Flaky Test Runner was used on any tests changed
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
• Review the backport guidelines and apply applicable backport:* labels.

Identify risks

Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging.

• See some risk examples
• ...

[juliaElastic]

Previously the Actions button was disabled if there were no integrations selected.
Now the new Manage integration knowledge is available even if there are no selected items.

[juliaElastic]

There is a different way to create archiveIterator for packages depending on install source, which makes this logic a little complex.
Alternatively we could call reinstallPackageForInstallation which would call all package install steps.

Or skip the reindex if the package is not installed from registry.

[juliaElastic]

Solved this for bundled packages and skipping other types (uploaded, custom).

This is similar to who the reinstall logic works: https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/fleet/server/services/epm/packages/reinstall.ts#L29

[juliaElastic]

Is there a way to determine if an installed package already has the latest knowledge base assets created?
If so, we could skip the reindexing for those packages.
@Supplementing You might now this?

We could check the existence of any knowledge_base type assets, but it's not guaranteed it belongs to the latest package version.

{
    "id": "apache-README.md",
    "type": "knowledge_base"
  }

[Supplementing]

Yes, theres an internal endpoint that will return the indexed KB docs for the package, along with the current version for each asset.

GET /internal/fleet/epm/packages/{pkgName}/knowledge_base

[juliaElastic]

Thanks, I could use this to check if knowledge base items exist for the currently installed package version, and if so, skip the reindexing.

[2025-12-03T16:28:40.479+01:00][DEBUG][plugins.fleet] Skipping reindexing knowledge base for package apm@8.16.1 - already indexed

[juliaElastic]

Currently the setting is changed only when the Save button is clicked.
I'm wondering if it would be simpler to change the setting when the switch is clicked, and get rid of the Save button.
cc @sileschristian

[sileschristian]

Currently the setting is changed only when the Save button is clicked. I'm wondering if it would be simpler to change the setting when the switch is clicked, and get rid of the Save button. cc @sileschristian

Makes sense Julia. Question related the details/explanations: is someone working on what we should explain and how? FYI, don't take my design copies as something we should place there as it was meant to only indicate that we need to add explanations.

[juliaElastic]

@nimarezainia @kpollich Could you review the copy in the flyout and let me know if we should change anything?

[kpollich]

cc @vishaangelova @karenzone as well for copy review

One thing we should clarify: EIS is only going to be used for cloud/serverless deployments. Self-hosted deployments will generate embeddings on a local ML node (ES will nominate one if it doesn't exist). So there needs to be some conditional language here.

Maybe an easy way to approach this would be to change the language slightly and only show the "cost" section for ECH/serverless deployments, e.g.

## How it works?

Integration documentation and metadata are processed by Elasticsearch to provide context about your installed integrations to [agent builder](https://www.elastic.co/docs/solutions/search/elastic-agent-builder) and [AI assistant](https://www.elastic.co/docs/explore-analyze/ai-features/ai-assistant).

## What gets indexed

- Integration documentation
- Configuration metadata
- Field definitions

{ if isECH || isServerless }
## Cost

Indexing uses Elastic Inference Service and incurs minimal per token charges.
{ /if }

☑️ Use integration knowledge in all installed integrations

[juliaElastic]

Updated the copy and made it conditional.

In cloud/serverless:

In self-managed:

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[jgowdyelastic]

LGTM

[pmuellr]

LGTM - I tried to remove my review, but it wasn't good enough, it seems.

I understand my issues will be addressed in a future PR ...

[kibanamachine]

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#10064

[❌] x-pack/solutions/observability/test/api_integration_deployment_agnostic/configs/serverless/oblt.ai_assistant.serverless.config.ts: 0/1 tests passed.
[❌] x-pack/solutions/observability/test/api_integration_deployment_agnostic/configs/stateful/oblt.ai_assistant.stateful.config.ts: 0/1 tests passed.

see run history

[sorenlouv]

Probably fine.
@arturoliduena Since you wrote this, WDYT?

[kibanamachine]

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#10066

[✅] x-pack/solutions/observability/test/api_integration_deployment_agnostic/feature_flag_configs/serverless/oblt.ai_assistant.serverless.config.ts: 1/1 tests passed.

see run history

[elasticmachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 72f051b

Failed CI Steps

• Jest Tests #6
• FTR Configs #42
• FTR Configs #42

Test Failures

• [job] [logs] Jest Tests #6 / GroupedAlertsTable resets all levels pagination when global query updates
• [job] [logs] Jest Tests #6 / GroupedAlertsTable resets all levels pagination when selected group changes
• [job] [logs] Jest Tests #6 / GroupedAlertsTable resets innermost level's current page when that level's page size updates
• [job] [logs] Jest Tests #6 / GroupedAlertsTable resets only most inner group pagination when its parent groups open/close
• [job] [logs] Jest Tests #6 / GroupedAlertsTable resets outermost level's current page when that level's page size updates

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
fleet	1375	1377	+2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
fleet	2.1MB	2.1MB	+6.3KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
fleet	179.3KB	179.4KB	+31.0B

History

• 💔 Build #372262 failed 6ce1e64
• 💔 Build #372237 failed 61cc206
• 💔 Build #371966 failed 73af7d4
• 💔 Build #371716 failed 222b3de