Move index management privilege from Kibana to ElasticSearch

[byewokko]

Summary by CodeRabbit

Release Notes

• New Features

  • Authorized users can now directly manage Elasticsearch indexes, templates, and index lifecycle policies through the Elasticsearch integration.

• Configuration

  • A new configuration option for Elasticsearch index management resource has been added.

• Refactor

  • Index management functionality has been consolidated into the Elasticsearch integration, streamlining the resource authorization model and improving consistency.

[coderabbitai]

Warning

Review limit reached

@byewokko, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 25 minutes and 27 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more credits in the billing tab to continue.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 63b242e1-f762-42dd-a29c-dcc77229bdbb

📥 Commits

Reviewing files that changed from the base of the PR and between 3e256b7 and 0435b3d.

📒 Files selected for processing (2)

• CHANGELOG.md
• seacatauth/batman/elasticsearch.py

📝 Walkthrough

Walkthrough

ElasticSearchIntegration gains index-management role control: a new config option stores IndexManagementResourceId, a method upserts the Elasticsearch security role with cluster and index privileges, startup triggers the upsert after resource initialization, resources are registered in Seacat Auth, and user authorization maps to the index_management role during credential sync. Legacy Kibana index-management wiring is removed.

Changes

Elasticsearch Index Management Role Migration

Layer / File(s)	Summary
Configuration and storage seacatauth/batman/elasticsearch.py	New elasticsearch_index_management_resource_id config option added to ElasticSearchIntegration defaults and stored as IndexManagementResourceId instance variable.
Index management role upserting seacatauth/batman/elasticsearch.py	Implements _upsert_index_management_role() to fetch existing Elasticsearch role, compare required cluster privileges (index templates, ILM management) and wildcard index permissions, and update via _security/role/<name> endpoint if differences detected.
Startup initialization and resource registration seacatauth/batman/elasticsearch.py	Method called after _initialize_resources() during startup; IndexManagementResourceId registered in resource map with index-management description and global_only flag.
Credential syncing with user authorization seacatauth/batman/elasticsearch.py	User credential sync adds index_management to Elasticsearch roles when user is authorized for IndexManagementResourceId resource.
Kibana index-management removal seacatauth/batman/elasticsearch.py	kibana_index_management_resource_id removed from Kibana defaults and mappings; sync_all_spaces_and_roles() updated to sync Default-space and tenant spaces only, omitting previous Kibana index-management role sync.

Sequence Diagram

sequenceDiagram
  participant Startup as ElasticsearchIntegration
  participant InitRes as _initialize_resources()
  participant UpRole as _upsert_index_management_role()
  participant ES as Elasticsearch API
  participant CredSync as Credential Sync
  participant UserAuthz as User Authorization

  Startup->>InitRes: register IndexManagementResourceId
  InitRes-->>Startup: resources initialized
  Startup->>UpRole: upsert index_management role
  UpRole->>ES: GET _security/role/index_management
  ES-->>UpRole: existing role privileges
  UpRole->>UpRole: compare against required (cluster, indices)
  alt Missing or different privileges
    UpRole->>ES: PUT _security/role/index_management
    ES-->>UpRole: role updated
  end
  CredSync->>UserAuthz: check user resources
  UserAuthz-->>CredSync: includes IndexManagementResourceId?
  alt User authorized
    CredSync->>CredSync: add index_management to elk_roles
  end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 Index management now hops Elasticsearch way,
Roles are crafted, synced, and held in sway,
Kibana's old wiring fades to the past,
New integration grows secure and fast! 🎉

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change: moving index management privilege handling from Kibana integration to ElasticSearch integration, as confirmed by the detailed summary showing removal of Kibana index management wiring and addition of new ElasticSearch index management role management.
Docstring Coverage	✅ Passed	Docstring coverage is 92.31% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/kibana-index-management-resource

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@seacatauth/batman/elasticsearch.py`:
- Around line 444-445: The condition checking existing_index vs req_index has
mixed tabs/spaces and a problematic line break; fix by normalizing to spaces
(e.g., 4 spaces) and reformat the continuation so the binary operator is at the
start of the wrapped line or keep the whole expression inside the same
parenthesis-aligned block; specifically update the if statement that references
existing_index.get("names"), req_index.get("names"),
existing_index.get("privileges"), and req_index.get("privileges") so indentation
is consistent and the line break occurs before the 'and' (or keep the entire
condition on one line) to satisfy CI.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 995edb4e-eaa3-4501-a24f-b2e3a56315ad

📥 Commits

Reviewing files that changed from the base of the PR and between 74fc8f9 and 3e256b7.

📒 Files selected for processing (1)

• seacatauth/batman/elasticsearch.py