Skip to content

[Fleet] Fix kuery handling in bulk agent actions#258582

Merged
jillguyonnet merged 2 commits intoelastic:mainfrom
jillguyonnet:fleet/258069-fix-bulk-agent-query
Mar 24, 2026
Merged

[Fleet] Fix kuery handling in bulk agent actions#258582
jillguyonnet merged 2 commits intoelastic:mainfrom
jillguyonnet:fleet/258069-fix-bulk-agent-query

Conversation

@jillguyonnet
Copy link
Copy Markdown
Member

@jillguyonnet jillguyonnet commented Mar 19, 2026 •
edited by kibanamachine
Loading

Summary

Fixes #258069

Testing:

  • Create two spaces and enroll some agents in both
  • In space 2, upgrade some agents so that their runtime status is updating
  • In space 1, force unenroll agents with a kuery that contains an OR on status, e.g.: 
    POST kbn:/api/fleet/agents/bulk_unenroll
{
  "agents": "status:online or status:updating",
  "force": true
}
  • On main, the updating agents in space 2 would be unenrolled; with this fix they shouldn't be affected

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

  • Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
  • Documentation was added for features that require explanation or tutorials
  • Unit or functional tests were updated or added to match the most common scenarios
  • If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
  • This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
  • Flaky Test Runner was used on any tests changed
  • The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
  • Review the backport guidelines and apply applicable backport:* labels.

Identify risks

Low probability risk of incorrectly selecting agents by kuery in Fleet bulk agent actions.

Release note

Fixes space-awareness for Fleet bulk agent actions (unenroll, upgrade, reassign to policy).
@jillguyonnet jillguyonnet self-assigned this Mar 19, 2026
@jillguyonnet jillguyonnet added the Team:Fleet Team label for Observability Data Collection Fleet team label Mar 19, 2026
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Mar 19, 2026

⏳ Build in-progress, with failures

Failed CI Steps

Test Failures

  • [job] [logs] Fleet Cypress Tests #1 / Add Integration - Automatic Import should create an integration
  • [job] [logs] Fleet Cypress Tests #1 / Add Integration - Automatic Import should create an integration
  • [job] [logs] Jest Tests #12 / buildEsqlFetchSubscribe changing a ES|QL query with no transformational commands should not change state when loading and finished if index pattern and columns are the same
  • [job] [logs] FTR Configs #90 / Cloud Security Posture GET /internal/cloud_security_posture/stats CSPM Compliance Dashboard Stats API should return CSPM benchmarks V2

cc @jillguyonnet
@jillguyonnet
Copy link
Copy Markdown
Member Author

jillguyonnet commented Mar 23, 2026

@elasticmachine merge upstream
@jillguyonnet jillguyonnet marked this pull request as ready for review March 24, 2026 08:41
@jillguyonnet jillguyonnet requested a review from a team as a code owner March 24, 2026 08:41
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Mar 24, 2026

Pinging @elastic/fleet (Team:Fleet)
juliaElastic
juliaElastic approved these changes Mar 24, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@juliaElastic juliaElastic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@jillguyonnet jillguyonnet merged commit abad64f into elastic:main Mar 24, 2026
32 checks passed
@jillguyonnet jillguyonnet deleted the fleet/258069-fix-bulk-agent-query branch March 24, 2026 10:47
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Mar 24, 2026

Starting backport for target branches: 8.19, 9.2, 9.3

https://github.com/elastic/kibana/actions/runs/23485546309
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Mar 24, 2026

💔 All backports failed

Status Branch Result
❌ 8.19 Backport failed because of merge conflicts
❌ 9.2 Backport failed because of merge conflicts
❌ 9.3 Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 258582

Questions ?

Please refer to the Backport tool documentation
jesuswr pushed a commit to jesuswr/kibana that referenced this pull request Mar 24, 2026
@jillguyonnet @elasticmachine @jesuswr
[Fleet] Fix kuery handling in bulk agent actions (elastic#258582)
83ece73 
## Summary

Fixes elastic#258069

Testing:
* Create two spaces and enroll some agents in both
* In space 2, upgrade some agents so that their runtime status is
`updating`
* In space 1, force unenroll agents with a kuery that contains an OR on
status, e.g.:
   ```
   POST kbn:/api/fleet/agents/bulk_unenroll
   {
     "agents": "status:online or status:updating",
     "force": true
   }
   ```
* On `main`, the updating agents in space 2 would be unenrolled; with
this fix they shouldn't be affected

### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

### Identify risks

Low probability risk of incorrectly selecting agents by kuery in Fleet
bulk agent actions.

## Release note

Fixes space-awareness for Fleet bulk agent actions (unenroll, upgrade,
reassign to policy).

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
@jillguyonnet jillguyonnet mentioned this pull request Mar 24, 2026
Closed
jillguyonnet added a commit to jillguyonnet/kibana that referenced this pull request Mar 24, 2026
@jillguyonnet
[Fleet] Fix kuery handling in bulk agent actions (elastic#258582)
91d67cf 
## Summary

Fixes elastic#258069

Testing:
* Create two spaces and enroll some agents in both
* In space 2, upgrade some agents so that their runtime status is
`updating`
* In space 1, force unenroll agents with a kuery that contains an OR on
status, e.g.:
   ```
   POST kbn:/api/fleet/agents/bulk_unenroll
   {
     "agents": "status:online or status:updating",
     "force": true
   }
   ```
* On `main`, the updating agents in space 2 would be unenrolled; with
this fix they shouldn't be affected

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

### Identify risks

Low probability risk of incorrectly selecting agents by kuery in Fleet
bulk agent actions.

## Release note

Fixes space-awareness for Fleet bulk agent actions (unenroll, upgrade,
reassign to policy).

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit abad64f)

# Conflicts:
#	x-pack/platform/plugins/shared/fleet/server/services/agents/reassign.ts
@jillguyonnet jillguyonnet mentioned this pull request Mar 24, 2026
Closed
jillguyonnet added a commit to jillguyonnet/kibana that referenced this pull request Mar 24, 2026
@jillguyonnet
[Fleet] Fix kuery handling in bulk agent actions (elastic#258582)
6b4e653 
## Summary

Fixes elastic#258069

Testing:
* Create two spaces and enroll some agents in both
* In space 2, upgrade some agents so that their runtime status is
`updating`
* In space 1, force unenroll agents with a kuery that contains an OR on
status, e.g.:
   ```
   POST kbn:/api/fleet/agents/bulk_unenroll
   {
     "agents": "status:online or status:updating",
     "force": true
   }
   ```
* On `main`, the updating agents in space 2 would be unenrolled; with
this fix they shouldn't be affected

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

### Identify risks

Low probability risk of incorrectly selecting agents by kuery in Fleet
bulk agent actions.

## Release note

Fixes space-awareness for Fleet bulk agent actions (unenroll, upgrade,
reassign to policy).

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit abad64f)

# Conflicts:
#	x-pack/platform/plugins/shared/fleet/server/services/agents/reassign.ts
#	x-pack/platform/plugins/shared/fleet/server/services/agents/rollback.test.ts
#	x-pack/platform/plugins/shared/fleet/server/services/agents/rollback.ts
@jillguyonnet jillguyonnet mentioned this pull request Mar 24, 2026
Closed
@jillguyonnet

This comment was marked as duplicate.

Sign in to view
@jillguyonnet jillguyonnet mentioned this pull request Mar 24, 2026
Merged
jillguyonnet added a commit to jillguyonnet/kibana that referenced this pull request Mar 24, 2026
@jillguyonnet
[Fleet] Fix kuery handling in bulk agent actions (elastic#258582)
90f5636 
## Summary

Fixes elastic#258069

Testing:
* Create two spaces and enroll some agents in both
* In space 2, upgrade some agents so that their runtime status is
`updating`
* In space 1, force unenroll agents with a kuery that contains an OR on
status, e.g.:
   ```
   POST kbn:/api/fleet/agents/bulk_unenroll
   {
     "agents": "status:online or status:updating",
     "force": true
   }
   ```
* On `main`, the updating agents in space 2 would be unenrolled; with
this fix they shouldn't be affected

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

### Identify risks

Low probability risk of incorrectly selecting agents by kuery in Fleet
bulk agent actions.

## Release note

Fixes space-awareness for Fleet bulk agent actions (unenroll, upgrade,
reassign to policy).

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit abad64f)

# Conflicts:
#	x-pack/platform/plugins/shared/fleet/server/services/agents/reassign.ts
jillguyonnet added a commit to jillguyonnet/kibana that referenced this pull request Mar 24, 2026
@jillguyonnet
[Fleet] Fix kuery handling in bulk agent actions (elastic#258582)
9885d81 
## Summary

Fixes elastic#258069

Testing:
* Create two spaces and enroll some agents in both
* In space 2, upgrade some agents so that their runtime status is
`updating`
* In space 1, force unenroll agents with a kuery that contains an OR on
status, e.g.:
   ```
   POST kbn:/api/fleet/agents/bulk_unenroll
   {
     "agents": "status:online or status:updating",
     "force": true
   }
   ```
* On `main`, the updating agents in space 2 would be unenrolled; with
this fix they shouldn't be affected

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

### Identify risks

Low probability risk of incorrectly selecting agents by kuery in Fleet
bulk agent actions.

## Release note

Fixes space-awareness for Fleet bulk agent actions (unenroll, upgrade,
reassign to policy).

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit abad64f)

# Conflicts:
#	x-pack/platform/plugins/shared/fleet/server/services/agents/reassign.ts
#	x-pack/platform/plugins/shared/fleet/server/services/agents/rollback.test.ts
#	x-pack/platform/plugins/shared/fleet/server/services/agents/rollback.ts
@jillguyonnet

This comment was marked as outdated.

Sign in to view
jillguyonnet added a commit to jillguyonnet/kibana that referenced this pull request Mar 24, 2026
@jillguyonnet
[Fleet] Fix kuery handling in bulk agent actions (elastic#258582)
5ea46f9 
## Summary

Fixes elastic#258069

Testing:
* Create two spaces and enroll some agents in both
* In space 2, upgrade some agents so that their runtime status is
`updating`
* In space 1, force unenroll agents with a kuery that contains an OR on
status, e.g.:
   ```
   POST kbn:/api/fleet/agents/bulk_unenroll
   {
     "agents": "status:online or status:updating",
     "force": true
   }
   ```
* On `main`, the updating agents in space 2 would be unenrolled; with
this fix they shouldn't be affected

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

### Identify risks

Low probability risk of incorrectly selecting agents by kuery in Fleet
bulk agent actions.

## Release note

Fixes space-awareness for Fleet bulk agent actions (unenroll, upgrade,
reassign to policy).

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit abad64f)

# Conflicts:
#	x-pack/platform/plugins/shared/fleet/server/services/agents/reassign.ts
#	x-pack/platform/plugins/shared/fleet/server/services/agents/rollback.test.ts
#	x-pack/platform/plugins/shared/fleet/server/services/agents/rollback.ts
@jillguyonnet jillguyonnet mentioned this pull request Mar 24, 2026
Closed
@jillguyonnet
Copy link
Copy Markdown
Member Author

jillguyonnet commented Mar 24, 2026

💚 All backports created successfully

Status Branch Result
✅ 9.2

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation
jillguyonnet added a commit to jillguyonnet/kibana that referenced this pull request Mar 24, 2026
@jillguyonnet
[Fleet] Fix kuery handling in bulk agent actions (elastic#258582)
6faf43d 
## Summary

Fixes elastic#258069

Testing:
* Create two spaces and enroll some agents in both
* In space 2, upgrade some agents so that their runtime status is
`updating`
* In space 1, force unenroll agents with a kuery that contains an OR on
status, e.g.:
   ```
   POST kbn:/api/fleet/agents/bulk_unenroll
   {
     "agents": "status:online or status:updating",
     "force": true
   }
   ```
* On `main`, the updating agents in space 2 would be unenrolled; with
this fix they shouldn't be affected

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

### Identify risks

Low probability risk of incorrectly selecting agents by kuery in Fleet
bulk agent actions.

## Release note

Fixes space-awareness for Fleet bulk agent actions (unenroll, upgrade,
reassign to policy).

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit abad64f)

# Conflicts:
#	x-pack/platform/plugins/shared/fleet/server/services/agents/action_runner.ts
#	x-pack/platform/plugins/shared/fleet/server/services/agents/reassign.ts
#	x-pack/platform/plugins/shared/fleet/server/services/agents/rollback.test.ts
#	x-pack/platform/plugins/shared/fleet/server/services/agents/rollback.ts
@jillguyonnet jillguyonnet mentioned this pull request Mar 24, 2026
Merged
@jillguyonnet
Copy link
Copy Markdown
Member Author

jillguyonnet commented Mar 24, 2026

💚 All backports created successfully

Status Branch Result
✅ 8.19

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation
@jillguyonnet jillguyonnet mentioned this pull request Mar 24, 2026
Merged
@jillguyonnet
Copy link
Copy Markdown
Member Author

jillguyonnet commented Mar 24, 2026

💚 All backports created successfully

Status Branch Result
✅ 9.2

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation
jillguyonnet added a commit to jillguyonnet/kibana that referenced this pull request Mar 24, 2026
@jillguyonnet
[Fleet] Fix kuery handling in bulk agent actions (elastic#258582)
43bb015 
## Summary

Fixes elastic#258069

Testing:
* Create two spaces and enroll some agents in both
* In space 2, upgrade some agents so that their runtime status is
`updating`
* In space 1, force unenroll agents with a kuery that contains an OR on
status, e.g.:
   ```
   POST kbn:/api/fleet/agents/bulk_unenroll
   {
     "agents": "status:online or status:updating",
     "force": true
   }
   ```
* On `main`, the updating agents in space 2 would be unenrolled; with
this fix they shouldn't be affected

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

### Identify risks

Low probability risk of incorrectly selecting agents by kuery in Fleet
bulk agent actions.

## Release note

Fixes space-awareness for Fleet bulk agent actions (unenroll, upgrade,
reassign to policy).

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit abad64f)

# Conflicts:
#	x-pack/platform/plugins/shared/fleet/server/services/agents/reassign.ts
#	x-pack/platform/plugins/shared/fleet/server/services/agents/rollback.test.ts
#	x-pack/platform/plugins/shared/fleet/server/services/agents/rollback.ts
jillguyonnet added a commit that referenced this pull request Mar 25, 2026
@jillguyonnet
[9.2] [Fleet] Fix kuery handling in bulk agent actions (#258582) (#25…
c062a45 
…9396)

# Backport

This will backport the following commits from `main` to `9.2`:
- [[Fleet] Fix kuery handling in bulk agent actions
(#258582)](#258582)

<!--- Backport version: 11.0.1 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Jill
Guyonnet","email":"jill.guyonnet@elastic.co"},"sourceCommit":{"committedDate":"2026-03-24T10:47:38Z","message":"[Fleet]
Fix kuery handling in bulk agent actions (#258582)\n\n##
Summary\n\nFixes
https://github.com/elastic/kibana/issues/258069\n\nTesting:\n* Create
two spaces and enroll some agents in both\n* In space 2, upgrade some
agents so that their runtime status is\n`updating`\n* In space 1, force
unenroll agents with a kuery that contains an OR on\nstatus, e.g.:\n
```\n POST kbn:/api/fleet/agents/bulk_unenroll\n {\n \"agents\":
\"status:online or status:updating\",\n \"force\": true\n }\n ```\n* On
`main`, the updating agents in space 2 would be unenrolled; with\nthis
fix they shouldn't be affected\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n\n- [ ] Any text added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n### Identify risks\n\nLow
probability risk of incorrectly selecting agents by kuery in Fleet\nbulk
agent actions.\n\n## Release note\n\nFixes space-awareness for Fleet
bulk agent actions (unenroll, upgrade,\nreassign to
policy).\n\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"abad64f043642b0f71c7668ba0e60e228f021a1f","branchLabelMapping":{"^v9.4.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:Fleet","backport:version","v9.4.0","v9.3.3","v9.2.8","v8.19.14"],"title":"[Fleet]
Fix kuery handling in bulk agent
actions","number":258582,"url":"https://github.com/elastic/kibana/pull/258582","mergeCommit":{"message":"[Fleet]
Fix kuery handling in bulk agent actions (#258582)\n\n##
Summary\n\nFixes
https://github.com/elastic/kibana/issues/258069\n\nTesting:\n* Create
two spaces and enroll some agents in both\n* In space 2, upgrade some
agents so that their runtime status is\n`updating`\n* In space 1, force
unenroll agents with a kuery that contains an OR on\nstatus, e.g.:\n
```\n POST kbn:/api/fleet/agents/bulk_unenroll\n {\n \"agents\":
\"status:online or status:updating\",\n \"force\": true\n }\n ```\n* On
`main`, the updating agents in space 2 would be unenrolled; with\nthis
fix they shouldn't be affected\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n\n- [ ] Any text added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n### Identify risks\n\nLow
probability risk of incorrectly selecting agents by kuery in Fleet\nbulk
agent actions.\n\n## Release note\n\nFixes space-awareness for Fleet
bulk agent actions (unenroll, upgrade,\nreassign to
policy).\n\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"abad64f043642b0f71c7668ba0e60e228f021a1f"}},"sourceBranch":"main","suggestedTargetBranches":["9.2"],"targetPullRequestStates":[{"branch":"main","label":"v9.4.0","branchLabelMappingKey":"^v9.4.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/258582","number":258582,"mergeCommit":{"message":"[Fleet]
Fix kuery handling in bulk agent actions (#258582)\n\n##
Summary\n\nFixes
https://github.com/elastic/kibana/issues/258069\n\nTesting:\n* Create
two spaces and enroll some agents in both\n* In space 2, upgrade some
agents so that their runtime status is\n`updating`\n* In space 1, force
unenroll agents with a kuery that contains an OR on\nstatus, e.g.:\n
```\n POST kbn:/api/fleet/agents/bulk_unenroll\n {\n \"agents\":
\"status:online or status:updating\",\n \"force\": true\n }\n ```\n* On
`main`, the updating agents in space 2 would be unenrolled; with\nthis
fix they shouldn't be affected\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n\n- [ ] Any text added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n### Identify risks\n\nLow
probability risk of incorrectly selecting agents by kuery in Fleet\nbulk
agent actions.\n\n## Release note\n\nFixes space-awareness for Fleet
bulk agent actions (unenroll, upgrade,\nreassign to
policy).\n\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"abad64f043642b0f71c7668ba0e60e228f021a1f"}},{"branch":"9.3","label":"v9.3.3","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/259380","number":259380,"state":"OPEN"},{"branch":"9.2","label":"v9.2.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.14","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/259392","number":259392,"state":"OPEN"}]}]
BACKPORT-->
jillguyonnet added a commit that referenced this pull request Mar 25, 2026
@jillguyonnet
[8.19] [Fleet] Fix kuery handling in bulk agent actions (#258582) (#2…
ec9192e 
…59392)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[Fleet] Fix kuery handling in bulk agent actions
(#258582)](#258582)

<!--- Backport version: 11.0.1 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Jill
Guyonnet","email":"jill.guyonnet@elastic.co"},"sourceCommit":{"committedDate":"2026-03-24T10:47:38Z","message":"[Fleet]
Fix kuery handling in bulk agent actions (#258582)\n\n##
Summary\n\nFixes
https://github.com/elastic/kibana/issues/258069\n\nTesting:\n* Create
two spaces and enroll some agents in both\n* In space 2, upgrade some
agents so that their runtime status is\n`updating`\n* In space 1, force
unenroll agents with a kuery that contains an OR on\nstatus, e.g.:\n
```\n POST kbn:/api/fleet/agents/bulk_unenroll\n {\n \"agents\":
\"status:online or status:updating\",\n \"force\": true\n }\n ```\n* On
`main`, the updating agents in space 2 would be unenrolled; with\nthis
fix they shouldn't be affected\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n\n- [ ] Any text added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n### Identify risks\n\nLow
probability risk of incorrectly selecting agents by kuery in Fleet\nbulk
agent actions.\n\n## Release note\n\nFixes space-awareness for Fleet
bulk agent actions (unenroll, upgrade,\nreassign to
policy).\n\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"abad64f043642b0f71c7668ba0e60e228f021a1f","branchLabelMapping":{"^v9.4.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:Fleet","backport:version","v9.4.0","v9.3.3","v9.2.8","v8.19.14"],"title":"[Fleet]
Fix kuery handling in bulk agent
actions","number":258582,"url":"https://github.com/elastic/kibana/pull/258582","mergeCommit":{"message":"[Fleet]
Fix kuery handling in bulk agent actions (#258582)\n\n##
Summary\n\nFixes
https://github.com/elastic/kibana/issues/258069\n\nTesting:\n* Create
two spaces and enroll some agents in both\n* In space 2, upgrade some
agents so that their runtime status is\n`updating`\n* In space 1, force
unenroll agents with a kuery that contains an OR on\nstatus, e.g.:\n
```\n POST kbn:/api/fleet/agents/bulk_unenroll\n {\n \"agents\":
\"status:online or status:updating\",\n \"force\": true\n }\n ```\n* On
`main`, the updating agents in space 2 would be unenrolled; with\nthis
fix they shouldn't be affected\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n\n- [ ] Any text added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n### Identify risks\n\nLow
probability risk of incorrectly selecting agents by kuery in Fleet\nbulk
agent actions.\n\n## Release note\n\nFixes space-awareness for Fleet
bulk agent actions (unenroll, upgrade,\nreassign to
policy).\n\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"abad64f043642b0f71c7668ba0e60e228f021a1f"}},"sourceBranch":"main","suggestedTargetBranches":["8.19"],"targetPullRequestStates":[{"branch":"main","label":"v9.4.0","branchLabelMappingKey":"^v9.4.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/258582","number":258582,"mergeCommit":{"message":"[Fleet]
Fix kuery handling in bulk agent actions (#258582)\n\n##
Summary\n\nFixes
https://github.com/elastic/kibana/issues/258069\n\nTesting:\n* Create
two spaces and enroll some agents in both\n* In space 2, upgrade some
agents so that their runtime status is\n`updating`\n* In space 1, force
unenroll agents with a kuery that contains an OR on\nstatus, e.g.:\n
```\n POST kbn:/api/fleet/agents/bulk_unenroll\n {\n \"agents\":
\"status:online or status:updating\",\n \"force\": true\n }\n ```\n* On
`main`, the updating agents in space 2 would be unenrolled; with\nthis
fix they shouldn't be affected\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n\n- [ ] Any text added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n### Identify risks\n\nLow
probability risk of incorrectly selecting agents by kuery in Fleet\nbulk
agent actions.\n\n## Release note\n\nFixes space-awareness for Fleet
bulk agent actions (unenroll, upgrade,\nreassign to
policy).\n\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"abad64f043642b0f71c7668ba0e60e228f021a1f"}},{"branch":"9.3","label":"v9.3.3","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/259380","number":259380,"state":"OPEN"},{"branch":"9.2","label":"v9.2.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/259391","number":259391,"state":"OPEN"},{"branch":"8.19","label":"v8.19.14","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->
jillguyonnet added a commit that referenced this pull request Mar 25, 2026
@jillguyonnet
[9.3] [Fleet] Fix kuery handling in bulk agent actions (#258582) (#25…
ed3f856 
…9380)

# Backport

This will backport the following commits from `main` to `9.3`:
- [[Fleet] Fix kuery handling in bulk agent actions
(#258582)](#258582)

<!--- Backport version: 11.0.1 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Jill
Guyonnet","email":"jill.guyonnet@elastic.co"},"sourceCommit":{"committedDate":"2026-03-24T10:47:38Z","message":"[Fleet]
Fix kuery handling in bulk agent actions (#258582)\n\n##
Summary\n\nFixes
https://github.com/elastic/kibana/issues/258069\n\nTesting:\n* Create
two spaces and enroll some agents in both\n* In space 2, upgrade some
agents so that their runtime status is\n`updating`\n* In space 1, force
unenroll agents with a kuery that contains an OR on\nstatus, e.g.:\n
```\n POST kbn:/api/fleet/agents/bulk_unenroll\n {\n \"agents\":
\"status:online or status:updating\",\n \"force\": true\n }\n ```\n* On
`main`, the updating agents in space 2 would be unenrolled; with\nthis
fix they shouldn't be affected\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n\n- [ ] Any text added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n### Identify risks\n\nLow
probability risk of incorrectly selecting agents by kuery in Fleet\nbulk
agent actions.\n\n## Release note\n\nFixes space-awareness for Fleet
bulk agent actions (unenroll, upgrade,\nreassign to
policy).\n\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"abad64f043642b0f71c7668ba0e60e228f021a1f","branchLabelMapping":{"^v9.4.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:Fleet","backport:version","v9.4.0","v9.3.3","v9.2.8","v8.19.14"],"title":"[Fleet]
Fix kuery handling in bulk agent
actions","number":258582,"url":"https://github.com/elastic/kibana/pull/258582","mergeCommit":{"message":"[Fleet]
Fix kuery handling in bulk agent actions (#258582)\n\n##
Summary\n\nFixes
https://github.com/elastic/kibana/issues/258069\n\nTesting:\n* Create
two spaces and enroll some agents in both\n* In space 2, upgrade some
agents so that their runtime status is\n`updating`\n* In space 1, force
unenroll agents with a kuery that contains an OR on\nstatus, e.g.:\n
```\n POST kbn:/api/fleet/agents/bulk_unenroll\n {\n \"agents\":
\"status:online or status:updating\",\n \"force\": true\n }\n ```\n* On
`main`, the updating agents in space 2 would be unenrolled; with\nthis
fix they shouldn't be affected\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n\n- [ ] Any text added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n### Identify risks\n\nLow
probability risk of incorrectly selecting agents by kuery in Fleet\nbulk
agent actions.\n\n## Release note\n\nFixes space-awareness for Fleet
bulk agent actions (unenroll, upgrade,\nreassign to
policy).\n\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"abad64f043642b0f71c7668ba0e60e228f021a1f"}},"sourceBranch":"main","suggestedTargetBranches":["9.3","9.2","8.19"],"targetPullRequestStates":[{"branch":"main","label":"v9.4.0","branchLabelMappingKey":"^v9.4.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/258582","number":258582,"mergeCommit":{"message":"[Fleet]
Fix kuery handling in bulk agent actions (#258582)\n\n##
Summary\n\nFixes
https://github.com/elastic/kibana/issues/258069\n\nTesting:\n* Create
two spaces and enroll some agents in both\n* In space 2, upgrade some
agents so that their runtime status is\n`updating`\n* In space 1, force
unenroll agents with a kuery that contains an OR on\nstatus, e.g.:\n
```\n POST kbn:/api/fleet/agents/bulk_unenroll\n {\n \"agents\":
\"status:online or status:updating\",\n \"force\": true\n }\n ```\n* On
`main`, the updating agents in space 2 would be unenrolled; with\nthis
fix they shouldn't be affected\n\n### Checklist\n\nCheck the PR
satisfies following conditions. \n\nReviewers should verify this PR
satisfies this list as well.\n\n- [ ] Any text added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n-
[x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\n### Identify risks\n\nLow
probability risk of incorrectly selecting agents by kuery in Fleet\nbulk
agent actions.\n\n## Release note\n\nFixes space-awareness for Fleet
bulk agent actions (unenroll, upgrade,\nreassign to
policy).\n\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"abad64f043642b0f71c7668ba0e60e228f021a1f"}},{"branch":"9.3","label":"v9.3.3","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.2","label":"v9.2.8","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.14","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->
jeramysoucy pushed a commit to jeramysoucy/kibana that referenced this pull request Mar 26, 2026
@jillguyonnet @elasticmachine @jeramysoucy
[Fleet] Fix kuery handling in bulk agent actions (elastic#258582)
603f805 
## Summary

Fixes elastic#258069

Testing:
* Create two spaces and enroll some agents in both
* In space 2, upgrade some agents so that their runtime status is
`updating`
* In space 1, force unenroll agents with a kuery that contains an OR on
status, e.g.:
   ```
   POST kbn:/api/fleet/agents/bulk_unenroll
   {
     "agents": "status:online or status:updating",
     "force": true
   }
   ```
* On `main`, the updating agents in space 2 would be unenrolled; with
this fix they shouldn't be affected

### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

### Identify risks

Low probability risk of incorrectly selecting agents by kuery in Fleet
bulk agent actions.

## Release note

Fixes space-awareness for Fleet bulk agent actions (unenroll, upgrade,
reassign to policy).

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:version Backport to applied version labels release_note:fix Team:Fleet Team label for Observability Data Collection Fleet team v8.19.14 v9.2.8 v9.3.3 v9.4.0

4 participants

@jillguyonnet @elasticmachine @kibanamachine @juliaElastic