Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[ML] Retain built-in ML roles granting Kibana privileges #80014

Merged
merged 2 commits into from
Oct 28, 2021
Merged

[ML] Retain built-in ML roles granting Kibana privileges #80014

merged 2 commits into from
Oct 28, 2021

Commits on Oct 28, 2021

  1. [ML] Retain built-in ML roles granting Kibana privileges 

    The machine_learning_admin and machine_learning_user roles
in Elasticsearch also grant access to the ML pages in Kibana.

At one time it was intended that this should change in 8.0,
so that ML privileges in Kibana would be completely separate.

However, our thinking has now changed. An administrator cannot
give a user the Elasticsearch backend roles and expect Kibana
privileges alone to then stop that user from using ML - the
user could just switch to curl or even Kibana dev console (which
uses backend privileges rather than Kibana privileges). So it's
clearer what is really being permitted if the backend roles
continue to allow access to the ML UI as well as the ML backend
endpoints. There's nothing the user can see in the ML UI that
they couldn't find out by calling ML Elasticsearch endpoints
directly and rendering the responses in a more graphical way.
    @droberts195
    droberts195 committed Oct 28, 2021
    Configuration menu
    Copy the full SHA
    1a4200a View commit details
    Browse the repository at this point in the history

  2. Revert accidental change

    @droberts195
    droberts195 committed Oct 28, 2021
    Configuration menu
    Copy the full SHA
    396e716 View commit details
    Browse the repository at this point in the history