[Fleet] Package policy external callback are not called for preconfigured policies

[nchaulet]

Description

Fleet allow other plugin to register callback that are called when a package policy is created/updated, these callbacks are actually called in the API handler and are not called for preconfigured policies, it seems a bug to me.

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[joshdover]

@paul-tavares Do you have an idea of how impactful this bug may be on your use case?

[paul-tavares]

@joshdover ,
I don't think this impacts us in Endpoint security. We don't have pre-configured endpoint integration policies.

[joshdover]

@paul-tavares I guess put another way, if a user tries to use a preconfigured policy (any customer can do this in the kibana.yml config, also think about internal test environments), what is the impact of the callbacks not being run?

[paul-tavares]

@joshdover , @nchaulet ,
Ohhhh. I did not realize that you can do that in the kibana.yml. The impact would be that the endpoint policy would not contain the endpoint specific configurations that these callbacks inject into it when they are created. This would likely cause the Endpoint to report policy failures back up to ES and Fleet to report the integration as being in error state. I guess one could include the endpoint configuration in the preconfigured policy, but would not be able to include the artifact manifest data as that is generated based on artifacts that are created in the background. The manifest data would likely be added automatically the next time our background task runs.

FYI: Our code does the following for endpoint integration policies:

1. On create:
   1. it adds the default set of endpoint configuration (under the inputs[0].config.policy. Our policies only have 1 input)
   2. it adds the artifact manifest data to the endpoint configuration (under the input[0].config. artifact_manifest)
2. On Edit:
   1. It checks (and possibly updates) that the endpoint configuration features are being used in accordance to the current kibana license
3. On Delete:
   1. It updates endpoint artifacts that might be defined "by policy" and referencing the policy id that is being deleted

[sorenlouv]

This is an issue for APM. In #147650 fleet callbacks were introduced to add api keys to APM package policies. This doesn't apply to the preconfigured APM cloud policy elastic-cloud-apm.

This behaviour is needed by APM Server to query ES and is needed for 8.7. Are there known workarounds for adding metadata (api keys) to preconfigured policies?

[sorenlouv]

I've opened a draft PR to fix this: #149272

[elasticmachine]

Pinging @elastic/apm-ui (Team:APM)