[8.x] [Fleet] Reuse shared integration policies when duplicating agent policies (#217872) (#218002)

# Backport This will backport the following commits from `main` to `8.x`: - [[Fleet] Reuse shared integration policies when duplicating agent policies (#217872)](https://github.com/elastic/kibana/pull/217872)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Jill Guyonnet <jill.guyonnet@elastic.co>
2025-04-24 09:48:58 -04:00 · 2025-04-11 19:51:59 +02:00 · 2025-04-11 19:51:59 +02:00 · df83efc556
commit df83efc556
parent 92623b406a
2 changed files with 130 additions and 22 deletions
--- a/x-pack/platform/plugins/shared/fleet/server/services/agent_policy.test.ts
+++ b/x-pack/platform/plugins/shared/fleet/server/services/agent_policy.test.ts
@ -1337,6 +1337,98 @@ describe('Agent policy', () => {
        );
      }
    });
+
+    it('should link shared package policies', async () => {
+      agentPolicyService.requireUniqueName = async () => {};
+      soClient = savedObjectsClientMock.create();
+      const mockPolicy = {
+        type: LEGACY_AGENT_POLICY_SAVED_OBJECT_TYPE,
+        references: [],
+        attributes: { revision: 1, package_policies: ['package-1'] } as any,
+      };
+      soClient.get.mockImplementation(async (type: string, id: string) => {
+        return {
+          id,
+          ...mockPolicy,
+        };
+      });
+      soClient.find
+        .mockImplementationOnce(async () => ({
+          saved_objects: [
+            {
+              id: 'agent-policy-id',
+              score: 1,
+              ...{ ...mockPolicy, name: 'mocked-policy' },
+            },
+          ],
+          total: 1,
+          page: 1,
+          per_page: 1,
+        }))
+        .mockImplementationOnce(async () => ({
+          saved_objects: [
+            {
+              id: 'agent-policy-id-copy',
+              score: 1,
+              ...{ ...mockPolicy, name: 'mocked-policy' },
+            },
+          ],
+          total: 1,
+          page: 1,
+          per_page: 1,
+        }));
+      soClient.create.mockImplementation(async (type, attributes) => {
+        return {
+          attributes: attributes as unknown as NewAgentPolicy,
+          id: 'mocked',
+          type: 'mocked',
+          references: [],
+        };
+      });
+      const packagePolicies = [
+        {
+          id: 'package-1',
+          name: 'package-1',
+          policy_id: 'policy_1',
+          policy_ids: ['policy_1', 'policy_2'],
+        },
+        {
+          id: 'package-2',
+          name: 'package-2',
+          policy_id: 'policy_1',
+          policy_ids: ['policy_1'],
+        },
+      ] as any;
+      mockedPackagePolicyService.findAllForAgentPolicy.mockReturnValue(packagePolicies);
+      mockedPackagePolicyService.list.mockResolvedValue({ items: packagePolicies } as any);
+      await agentPolicyService.copy(soClient, esClient, 'mocked', {
+        name: 'copy mocked',
+      });
+      expect(mockedPackagePolicyService.bulkCreate).toBeCalledWith(
+        expect.anything(),
+        expect.anything(),
+        [
+          {
+            name: 'package-2 (copy)',
+            policy_id: 'policy_1',
+            policy_ids: ['mocked'],
+          },
+        ],
+        expect.anything()
+      );
+      expect(mockedPackagePolicyService.bulkUpdate).toBeCalledWith(
+        expect.anything(),
+        expect.anything(),
+        [
+          {
+            id: 'package-1',
+            name: 'package-1',
+            policy_id: 'policy_1',
+            policy_ids: ['policy_1', 'policy_2', 'mocked'],
+          },
+        ]
+      );
+    });
  });

  describe('deployPolicy', () => {
--- a/x-pack/platform/plugins/shared/fleet/server/services/agent_policy.ts
+++ b/x-pack/platform/plugins/shared/fleet/server/services/agent_policy.ts
@ -831,32 +831,48 @@ class AgentPolicyService {
      options
    );

-    // Copy all package policies and append (copy n) to their names
    if (baseAgentPolicy.package_policies) {
-      const newPackagePolicies = await pMap(
-        baseAgentPolicy.package_policies as PackagePolicy[],
-        async (packagePolicy: PackagePolicy) => {
-          const { id: packagePolicyId, version, ...newPackagePolicy } = packagePolicy;
+      // Copy non-shared package policies and append (copy n) to their names.
+      const basePackagePolicies = baseAgentPolicy.package_policies.filter(
+        (packagePolicy) => packagePolicy.policy_ids.length < 2
+      );
+      if (basePackagePolicies.length > 0) {
+        const newPackagePolicies = await pMap(
+          basePackagePolicies,
+          async (packagePolicy: PackagePolicy) => {
+            const { id: packagePolicyId, version, ...newPackagePolicy } = packagePolicy;

-          const updatedPackagePolicy = {
+            const updatedPackagePolicy = {
+              ...newPackagePolicy,
+              name: await incrementPackagePolicyCopyName(soClient, packagePolicy.name),
+            };
+            return updatedPackagePolicy;
+          }
+        );
+        await packagePolicyService.bulkCreate(
+          soClient,
+          esClient,
+          newPackagePolicies.map((newPackagePolicy) => ({
            ...newPackagePolicy,
-            name: await incrementPackagePolicyCopyName(soClient, packagePolicy.name),
-          };
-          return updatedPackagePolicy;
-        }
-      );
-      await packagePolicyService.bulkCreate(
-        soClient,
-        esClient,
-        newPackagePolicies.map((newPackagePolicy) => ({
-          ...newPackagePolicy,
-          policy_ids: [newAgentPolicy.id],
-        })),
-        {
-          ...options,
-          bumpRevision: false,
-        }
+            policy_ids: [newAgentPolicy.id],
+          })),
+          {
+            ...options,
+            bumpRevision: false,
+          }
+        );
+      }
+      // Link shared package policies to new agent policy.
+      const sharedBasePackagePolicies = baseAgentPolicy.package_policies.filter(
+        (packagePolicy) => packagePolicy.policy_ids.length > 1
      );
+      if (sharedBasePackagePolicies.length > 0) {
+        const updatedSharedPackagePolicies = sharedBasePackagePolicies.map((packagePolicy) => ({
+          ...packagePolicy,
+          policy_ids: [...packagePolicy.policy_ids, newAgentPolicy.id],
+        }));
+        await packagePolicyService.bulkUpdate(soClient, esClient, updatedSharedPackagePolicies);
+      }
    }

    // Tamper protection is dependent on endpoint package policy