[Fleet] Add create/delete agentless policies API #241712

nchaulet · 2025-11-03T20:38:39Z

Summary

Related to #240879

That PR introduce a new agentless policies API to hide our complex data model to end users and avoid going in a inconsistent state where we created the agent policy but not the package policy or we did not call the agentless API.

Add a new POST /fleet/agentless_policies API and DELETE /fleet/agentless_policies/{policyId}

Note that API do not support cloud connectors yet, (it's why we keep the flag off for now), there is a process to improve cloud connector API here, they will plug into that new API once ready.

Details

New feature flags

agentlessPoliciesAPI to enable the new API will be turned on
useAgentlessAPIInUI to use new API in the package policy form off untill we support cloud connectors
disabledAgentlessLegacyAPI not implemented yet to stop allowing agentless policies to be created through regular * agent /package policy endpoints

That PR

What/How to test

Try to create a bunch of agentless policies (without cloud connector) it should work as before

API

Example request to create a cspm integration

POST kbn:/api/fleet/agentless_policies
{
  "id": "test-123",
  "package": {
    "name": "cloud_security_posture",
    "version": "3.1.1"
  },
  "name": "cspm-5",
  "description": "",
  "namespace": "",
  "inputs": {
    "kspm-cloudbeat/cis_k8s": {
      "enabled": false
    },
    "kspm-cloudbeat/cis_eks": {
      "enabled": false
    },
    "cspm-cloudbeat/cis_aws": {
      "enabled": true,
      "vars": {
        "cloud_formation_template": "https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml&stackName=Elastic-Cloud-Security-Posture-Management&param_EnrollmentToken=FLEET_ENROLLMENT_TOKEN&param_FleetUrl=FLEET_URL&param_ElasticAgentVersion=KIBANA_VERSION&param_ElasticArtifactServer=https://artifacts.elastic.co/downloads/beats/elastic-agent",
        "cloud_formation_credentials_template": "https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-direct-access-key-ACCOUNT_TYPE-9.2.0.yml",
        "cloud_formation_cloud_connectors_template": "https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cloud-connectors-ACCOUNT_TYPE-9.2.0.yml&param_ElasticResourceId=RESOURCE_ID"
      },
      "streams": {
        "cloud_security_posture.findings": {
          "enabled": true,
          "vars": {
            "access_key_id": "test",
            "secret_access_key": "tata",
            "aws.credentials.type": "direct_access_keys",
            "aws.account_type": "organization-account",
            "aws.supports_cloud_connectors": false
          }
        }
      }
    },
    "cspm-cloudbeat/cis_gcp": {
      "enabled": false
    },
    "cspm-cloudbeat/cis_azure": {
      "enabled": false
    },
    "vuln_mgmt-cloudbeat/vuln_mgmt_aws": {
      "enabled": false
    }
  },
  "vars": {
    "posture": "cspm",
    "deployment": "aws"
  }
}

nchaulet · 2025-11-04T14:04:19Z

@Omolola-Akinleye @seanrathier For info we are working on having a dedicated API for agentless policies, to hide the complexity of the fleet structure behind, and to make things a little more robust, I may need to check with you later to be sure this work as expected with cloud connectors

…atus --include-path /api/alerting/rule/ --include-path /api/alerting/rules --include-path /api/actions --include-path /api/security/role --include-path /api/spaces --include-path /api/streams --include-path /api/fleet --include-path /api/saved_objects/_import --include-path /api/saved_objects/_export --include-path /api/maintenance_window --include-path /api/agent_builder --update

…to feature-agentless-apis

…atus --include-path /api/alerting/rule/ --include-path /api/alerting/rules --include-path /api/actions --include-path /api/security/role --include-path /api/spaces --include-path /api/streams --include-path /api/fleet --include-path /api/saved_objects/_import --include-path /api/saved_objects/_export --include-path /api/maintenance_window --include-path /api/agent_builder --update

…to feature-agentless-apis

nchaulet · 2025-11-05T21:18:39Z

@seanrathier @Omolola-Akinleye thanks for the zoom on that, correct me if I am wrong.
What we discuss will be to get this one merged:

without support for cloud connectors
andbehind a feature flag,

And in second time adapt #241210 to use that API instead of a new internal one to add proper support for cloud connector

nchaulet · 2025-11-06T15:20:32Z

x-pack/platform/plugins/shared/fleet/common/types/models/package_policy_schema.ts

+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+


That file is only moved (and added a few meta description) from server so we can have get the request type from schema instead of duplicating it.

elasticmachine · 2025-11-06T15:21:33Z

Pinging @elastic/fleet (Team:Fleet)

jbudz

.buildkite/ftr_platform_stateful_configs.yml LGTM

…atus --include-path /api/alerting/rule/ --include-path /api/alerting/rules --include-path /api/actions --include-path /api/security/role --include-path /api/spaces --include-path /api/streams --include-path /api/fleet --include-path /api/saved_objects/_import --include-path /api/saved_objects/_export --include-path /api/maintenance_window --include-path /api/agent_builder --update

…to feature-agentless-apis

nchaulet · 2025-11-07T13:06:07Z

@elasticmachine merge upstream

…to feature-agentless-apis

…atus --include-path /api/alerting/rule/ --include-path /api/alerting/rules --include-path /api/actions --include-path /api/security/role --include-path /api/spaces --include-path /api/streams --include-path /api/fleet --include-path /api/saved_objects/_import --include-path /api/saved_objects/_export --include-path /api/maintenance_window --include-path /api/agent_builder --update

…to feature-agentless-apis

MichelLosier

Looking great so far! Just a few minor things to look at. I still need to run this and smoke test it a bit.

MichelLosier · 2025-11-07T20:32:25Z

x-pack/platform/plugins/shared/fleet/common/services/routes.ts

  },
 };

+export const agentlesPolicyRouteService = {


Suggested change

export const agentlesPolicyRouteService = {

export const agentlessPolicyRouteService = {

MichelLosier · 2025-11-07T21:40:26Z

x-pack/platform/plugins/shared/fleet/public/hooks/use_request/agentless_policy.ts

+  body: CreateAgentlessPolicyRequest['body'],
+  query?: CreateAgentlessPolicyRequest['query']
+) => {
+  return sendRequestForRq<any>({


Suggested change

return sendRequestForRq<any>({

return sendRequestForRq<CreateAgentlessPolicyResponse>({

Lets swap these any types with the response types

MichelLosier · 2025-11-07T23:58:47Z

x-pack/platform/plugins/shared/fleet/common/types/rest_spec/agentless_policy.ts

+        })
+      )
+    ),
+    supports_cloud_connector: schema.maybe(


What would be the role of the supports_cloud_connector field? Is the presence of a cloud_connector_id enough to suggest as much or is there an intermediate state where an agentless policy can support cloud connectors, but not have a relationship yet?

Yes cloud_connector_id should be sufficient, also we are not going to support cloud connector yet (there is so work to refacto the cloud connector API that will be done once that PR is merged), so I am just going to clean those

MichelLosier · 2025-11-08T00:07:25Z

x-pack/platform/plugins/shared/fleet/common/types/rest_spec/agentless_policy.ts

+    }),
+  }),
+  body: SimplifiedCreatePackagePolicyRequestBodySchema.extends({
+    cloud_connector_id: schema.maybe(


I see we are first classing the relationship with cloud connectors with cloud_connector_id and we have the other field supports_cloud_connector below. Is there an option to namespace these fields together like:

cloud_connector: { isSupported: boolean, id: string }

I suggest this from a place where if we view agentless as a platform, and if we expect there to be growth in the kinds of entities, or even the types of values other entities need to provide to this policy, I wonder if we should look at namespacing these fields into their own objects instead of a flat structure. WDYT?

yes having that kind of namespaced structure totally make sense, and we should probably suggest it for the following PR that will add support for cloud connector, in addition we will support inline cloud connector creation so we should probably support something like

could_conector: { id: ..} cloud_connector: {name: "", vars: ....}

…ss-apis

…atus --include-path /api/alerting/rule/ --include-path /api/alerting/rules --include-path /api/actions --include-path /api/security/role --include-path /api/spaces --include-path /api/streams --include-path /api/fleet --include-path /api/saved_objects/_import --include-path /api/saved_objects/_export --include-path /api/maintenance_window --include-path /api/agent_builder --update

…to feature-agentless-apis

MichelLosier

Looks good as well running locally 🚀

elasticmachine · 2025-11-10T17:07:13Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: e15ee8b

Failed CI Steps

Test Failures

[job] [logs] FTR Configs #76 / Alerting improving alert severity should correctly set severity_improving and previous_action_group data in alert document
[job] [logs] FTR Configs #86 / Core Analysis - Entity Store @ess @skipInServerlessMKI Entity Store APIs get and list "before all" hook in "get and list"

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`fleet`	1369	1370	+1

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`fleet`	1534	1542	+8

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`fleet`	2.1MB	2.1MB	+1.3KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`fleet`	176.6KB	177.1KB	+500.0B

Unknown metric groups

API count

id	before	after	diff
`fleet`	1666	1674	+8

History

💔 Build #359864 failed 3d418d8
💛 Build #359511 was flaky 1976e0a
💔 Build #359475 failed dc6585e
💔 Build #359456 failed 9bb9e41
💔 Build #359172 failed bf68680

nchaulet added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:Fleet Team label for Observability Data Collection Fleet team labels Nov 3, 2025

nchaulet force-pushed the feature-agentless-apis branch 3 times, most recently from 811ff17 to 1a8ea7a Compare November 4, 2025 17:06

[Fleet] Add create agentless policies API

35bc539

nchaulet force-pushed the feature-agentless-apis branch from d9054bb to 35bc539 Compare November 4, 2025 21:11

kibanamachine and others added 10 commits November 4, 2025 21:23

Changes from make api-docs

37f709f

use API in UI

2dec6cc

Merge branch 'feature-agentless-apis' of github.com:elastic/kibana in…

2459171

…to feature-agentless-apis

UI support

e7828cf

Changes from make api-docs

e8634cf

add response schema

cc849bc

Merge branch 'feature-agentless-apis' of github.com:elastic/kibana in…

829d741

…to feature-agentless-apis

few fixes

4d6a7c3

add more tests

3d8c4e1

nchaulet commented Nov 6, 2025

View reviewed changes

nchaulet marked this pull request as ready for review November 6, 2025 15:21

nchaulet requested review from a team as code owners November 6, 2025 15:21

jbudz approved these changes Nov 6, 2025

View reviewed changes

nchaulet mentioned this pull request Nov 6, 2025

[Fleet][Agentless] Improve agentless APIs #240879

Open

more oas description

7a82da7

kibanamachine and others added 5 commits November 6, 2025 19:43

Changes from make api-docs

3c1d667

Changes from node scripts/eslint_all_files --no-cache --fix

bf68680

fix tests

fb9f518

Merge branch 'feature-agentless-apis' of github.com:elastic/kibana in…

7937660

…to feature-agentless-apis

elasticmachine and others added 3 commits November 7, 2025 14:06

Merge branch 'main' into feature-agentless-apis

8447027

Changes from make api-docs

ea42e99

Delete agentless API

0d0d476

nchaulet changed the title ~~[Fleet] Add create agentless policies API~~ [Fleet] Add create/delete agentless policies API Nov 7, 2025

nchaulet and others added 7 commits November 7, 2025 10:14

Merge branch 'feature-agentless-apis' of github.com:elastic/kibana in…

8d19f3d

…to feature-agentless-apis

Changes from make api-docs

648b6d9

use delete in UI

3cdf1ae

Merge branch 'feature-agentless-apis' of github.com:elastic/kibana in…

9bb9e41

…to feature-agentless-apis

fix linting issue

dc6585e

fix linting

1976e0a

MichelLosier reviewed Nov 8, 2025

View reviewed changes

nchaulet and others added 6 commits November 10, 2025 08:42

Merge branch 'main' of github.com:elastic/kibana into feature-agentle…

12afb84

…ss-apis

fix after review

a8b77d0

Changes from make api-docs

3d418d8

fix type

ec7ce55

Merge branch 'feature-agentless-apis' of github.com:elastic/kibana in…

e15ee8b

…to feature-agentless-apis

nchaulet requested a review from MichelLosier November 10, 2025 15:45

MichelLosier approved these changes Nov 10, 2025

View reviewed changes

nchaulet merged commit c577a5f into main Nov 10, 2025
13 checks passed

nchaulet deleted the feature-agentless-apis branch November 10, 2025 17:26

kibanamachine added the v9.3.0 label Nov 10, 2025

	export const agentlesPolicyRouteService = {
	export const agentlessPolicyRouteService = {

	return sendRequestForRq<any>({
	return sendRequestForRq<CreateAgentlessPolicyResponse>({

[Fleet] Add create/delete agentless policies API #241712

[Fleet] Add create/delete agentless policies API #241712

Uh oh!

Conversation

nchaulet commented Nov 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Details

New feature flags

What/How to test

API

Uh oh!

nchaulet commented Nov 4, 2025

Uh oh!

nchaulet commented Nov 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nchaulet Nov 6, 2025

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Nov 6, 2025

Uh oh!

jbudz left a comment

Choose a reason for hiding this comment

Uh oh!

nchaulet commented Nov 7, 2025

Uh oh!

MichelLosier left a comment

Choose a reason for hiding this comment

Uh oh!

MichelLosier Nov 7, 2025

Choose a reason for hiding this comment

Uh oh!

MichelLosier Nov 7, 2025

Choose a reason for hiding this comment

Uh oh!

MichelLosier Nov 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nchaulet Nov 10, 2025

Choose a reason for hiding this comment

Uh oh!

MichelLosier Nov 8, 2025

Choose a reason for hiding this comment

Uh oh!

nchaulet Nov 10, 2025

Choose a reason for hiding this comment

Uh oh!

MichelLosier left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Nov 10, 2025

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Module Count

Public APIs missing comments

Async chunks

Page load bundle

API count

History

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

nchaulet commented Nov 3, 2025 •

edited

Loading

nchaulet commented Nov 5, 2025 •

edited

Loading

MichelLosier Nov 7, 2025 •

edited

Loading