[Fleet] Using Reusable Integrations Policies feature in Fleet

[nimarezainia]

Reusable integrations policy is a Fleet feature which will be available in 8.15 but hidden behind a feature-flag. This issue describes how to enable the feature flag and basic instructions on how to try out the feature.
An Enterprise license is required for this feature.

1. Create an 8.15 based project.
2. Once created, go to manage the deployment. Then select Kibana → Edit configuration

3. On the edit screen scroll down to Kibana and select “Edit user settings”

4. In the user settings block, on a new line enter: xpack.fleet.enableExperimental: [‘enableReusableIntegrationPolicies’]

5. Save the edit and confirm what was changed. Once Kibana is updated with the change return to the deployment page and open Kibana

6. Navigate to Fleet and create multiple agent policies

7. There are multiple ways the same instance of an integration can be shared amongst different Agent Policies. Integration may already be installed or a new integration is being installed. Either will arrive at the integration settings page.

8. On the edit page for that integration. Step (2) allows you to modify the list of policies the integration is to be shared to:

You should see this integration added to the other agent policies as well. NOTE: that reusing an integration policy is available under the “Existing hosts” tab.

Confirm that the installed integration is being shared amongst multiple agent policies by navigating to the integration page in the integration app and selecting the “integration policies” tab. You have the option of directly modifying the reusability of the integration:

(cc: @juliaElastic @jillguyonnet @kpollich )

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[kpollich]

The feature flag should be unnecessary as of https://github.com/elastic/kibana/issues/186175

[jlind23]

The feature flag should be unnecessary as of https://github.com/elastic/kibana/issues/186175

Only if you run 8.16 but looks like Nima is running 8.15.

[lucabelluccini]

Hello @nimarezainia

In 8.15:

• Is this feature GA?
• What happens if the user enables then disables the feature flag? Is it reversible?
• Will existing policies made reusable? Or it will be limited to new integration policies?

[kpollich]

Is this feature GA?

AFAIK yes, we are shipping directly to GA here.

What happens if the user enables then disables the feature flag? Is it reversible?

@juliaElastic could you help with this? I think the underlying data would stay the same when enabling -> disabling the feature flag, but the UI wouldn't "honor" the shared nature of the integration policies.

Will existing policies made reusable? Or it will be limited to new integration policies?

There should be no difference in behavior between a new or existing integration policy in this feature. Existing integration policies will essentially be "shared with" only their current, single agent policy. They can be shared with additional agent policies if desired, but there's nothing preventing a preexisting policy from being shareable.

[juliaElastic]

@juliaElastic could you help with this? I think the underlying data would stay the same when enabling -> disabling the feature flag, but the UI wouldn't "honor" the shared nature of the integration policies.

Yes, if disabling the feature flag, the UI would switch back to the old display of single agent policy selection and wouldn't allow sharing integration policies, but it would leave existing ones as is.

[lucabelluccini]

Thanks @kpollich & @juliaElastic, just to confirm... I'll use an example.

1. I enable the reusable policy
2. I create 2 Elastic Agent policies and I deploy one in agent A and one in agent B.
3. I create 1 Custom logs integration policy
4. I add the Custom logs integration policy to the 2 Elastic Agent policies (reusable)
5. The Elastic Agents will both run the same Custom logs integration policy
6. I disable the reusable policy flag

Consequence after (6):

• What is displayed? Will the Custom logs integration still show up on the 2 Elastic Agents?
  • The Custom Logs integration will be still displayed on both Elastic Agent policies.
  • Editing the Custom Logs integration will anyway change all the Elastic Agent policies where its used?
• What will be running? Will the Custom logs integration still be deployed on the 2 Elastic Agents?
  • I assume the policies on the Elastic Agent are untouched and kept as before disabling the flag.

The only difference is you cannot add the integration policy to multiple policies.

[nimarezainia]

Is this feature GA?

AFAIK yes, we are shipping directly to GA here.

@lucabelluccini @kpollich In 8.15 it's behind this feature flag. In 8.16 the feature flag is removed. We will look into going GA in 8.16 if there're no concerns/issues. This is what I have communicated to various users interested in this feature.

[lucabelluccini]

@lucabelluccini @kpollich In 8.15 it's behind this feature flag. In 8.16 the feature flag is removed. We will look into going GA in 8.16 if there're no concerns/issues. This is what I have communicated to various users interested in this feature.

Thanks @nimarezainia If the feature is behind feature flag in 8.15 and not GA, do we report it's a Beta/Tech Preview clearly in the UI?

[nimarezainia]

@lucabelluccini @kpollich In 8.15 it's behind this feature flag. In 8.16 the feature flag is removed. We will look into going GA in 8.16 if there're no concerns/issues. This is what I have communicated to various users interested in this feature.

Thanks @nimarezainia If the feature is behind feature flag in 8.15 and not GA, do we report it's a Beta/Tech Preview clearly in the UI?

No we don't have anything in the UI, as you can see there's no much in the UI as a landing for this. The goal of this issue is really to only make it available to the large list of users who are interested in trying it out, as I wanted to get their feedback. There's currently no mention in the docs either until 8.16, so nowhere to mention it's status. It's totally hidden from users.

if you think that is necessary we can try an do something but I don;t want to over engineer for something that is hidden from users.

[juliaElastic]

What is displayed? Will the Custom logs integration still show up on the 2 Elastic Agents? The Custom Logs integration will be still displayed on both Elastic Agent policies. Editing the Custom Logs integration will anyway change all the Elastic Agent policies where its used? What will be running? Will the Custom logs integration still be deployed on the 2 Elastic Agents? I assume the policies on the Elastic Agent are untouched and kept as before disabling the flag.

I think editing the Custom Logs integration will be prevented as long as multiple policies are assigned to it when the feature flag is turned off. Other than that, the integration should work as expected even when the flag is turned off.

That said, we don't expect the feature flag to be turned off after 8.16, it is an escape hatch if we find a serious issue and want to delay releasing.

[smarthusker]

The instructions appear to be specific for Elastic Cloud. Any chance this is available in v8.15 for self-managed installs or on ECK?