[8.11] [Fleet] Modify bulk unenroll to include inactive agents (#170249) (#170825)

# Backport This will backport the following commits from `main` to `8.11`: - [[Fleet] Modify bulk unenroll to include inactive agents (#170249)](https://github.com/elastic/kibana/pull/170249)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)  Co-authored-by: Cristina Amico <criamico@users.noreply.github.com>
2025-04-24 01:38:56 -04:00 · 2023-11-08 07:42:11 -05:00 · 2023-11-08 07:42:11 -05:00 · f083d2da2e
commit f083d2da2e
parent f0a4ac01b5
9 changed files with 112 additions and 21 deletions
--- a/x-pack/plugins/fleet/common/openapi/bundled.json
+++ b/x-pack/plugins/fleet/common/openapi/bundled.json
@ -2740,14 +2740,6 @@
              "schema": {
                "type": "object",
                "properties": {
-                  "revoke": {
-                    "type": "boolean",
-                    "description": "Revokes API keys of agents"
-                  },
-                  "force": {
-                    "type": "boolean",
-                    "description": "Unenroll hosted agents too"
-                  },
                  "agents": {
                    "oneOf": [
                      {
@ -2762,6 +2754,18 @@
                        "description": "list of agent IDs"
                      }
                    ]
+                  },
+                  "revoke": {
+                    "type": "boolean",
+                    "description": "Revokes API keys of agents"
+                  },
+                  "force": {
+                    "type": "boolean",
+                    "description": "Unenrolls hosted agents too"
+                  },
+                  "includeInactive": {
+                    "type": "boolean",
+                    "description": "When passing agents by KQL query, unenrolls inactive agents too"
                  }
                },
                "required": [
--- a/x-pack/plugins/fleet/common/openapi/bundled.yaml
+++ b/x-pack/plugins/fleet/common/openapi/bundled.yaml
@ -1719,12 +1719,6 @@ paths:
            schema:
              type: object
              properties:
-                revoke:
-                  type: boolean
-                  description: Revokes API keys of agents
-                force:
-                  type: boolean
-                  description: Unenroll hosted agents too
                agents:
                  oneOf:
                    - type: string
@ -1733,6 +1727,17 @@ paths:
                      items:
                        type: string
                      description: list of agent IDs
+                revoke:
+                  type: boolean
+                  description: Revokes API keys of agents
+                force:
+                  type: boolean
+                  description: Unenrolls hosted agents too
+                includeInactive:
+                  type: boolean
+                  description: >-
+                    When passing agents by KQL query, unenrolls inactive agents
+                    too
              required:
                - agents
            example:
--- a/x-pack/plugins/fleet/common/openapi/paths/agents@bulk_unenroll.yaml
+++ b/x-pack/plugins/fleet/common/openapi/paths/agents@bulk_unenroll.yaml
@ -23,12 +23,6 @@ post:
        schema:
          type: object
          properties:
-            revoke:
-              type: boolean
-              description: Revokes API keys of agents
-            force:
-              type: boolean
-              description: Unenroll hosted agents too
            agents:
              oneOf:
                - type: string
@ -37,6 +31,15 @@ post:
                  items:
                    type: string
                  description: list of agent IDs
+            revoke:
+              type: boolean
+              description: Revokes API keys of agents
+            force:
+              type: boolean
+              description: Unenrolls hosted agents too
+            includeInactive:
+              type: boolean
+              description: When passing agents by KQL query, unenrolls inactive agents too
          required:
            - agents
        example:
--- a/x-pack/plugins/fleet/common/types/rest_spec/agent.ts
+++ b/x-pack/plugins/fleet/common/types/rest_spec/agent.ts
@ -85,6 +85,7 @@ export interface PostBulkAgentUnenrollRequest {
    agents: string[] | string;
    force?: boolean;
    revoke?: boolean;
+    includeInactive?: boolean;
  };
 }

--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_unenroll_modal/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/components/agent_unenroll_modal/index.tsx
@ -47,6 +47,8 @@ export const AgentUnenrollAgentModal: React.FunctionComponent<Props> = ({
        : await sendPostBulkAgentUnenroll({
            agents: Array.isArray(agents) ? agents.map((agent) => agent.id) : agents,
            revoke: forceUnenroll,
+            // includeInactive is only used when the agents are selected by query, it's ignored in the case of agent ids
+            includeInactive: true,
          });
      if (error) {
        throw error;
--- a/x-pack/plugins/fleet/server/routes/agent/unenroll_handler.ts
+++ b/x-pack/plugins/fleet/server/routes/agent/unenroll_handler.ts
@ -55,6 +55,7 @@ export const postBulkAgentsUnenrollHandler: RequestHandler<
      revoke: request.body?.revoke,
      force: request.body?.force,
      batchSize: request.body?.batchSize,
+      showInactive: request.body?.includeInactive,
    });

    return response.ok({ body: { actionId: results.actionId } });
--- a/x-pack/plugins/fleet/server/services/agents/unenroll.ts
+++ b/x-pack/plugins/fleet/server/services/agents/unenroll.ts
@ -73,6 +73,7 @@ export async function unenrollAgents(
    force?: boolean;
    revoke?: boolean;
    batchSize?: number;
+    showInactive?: boolean;
  }
 ): Promise<{ actionId: string }> {
  if ('agentIds' in options) {
--- a/x-pack/plugins/fleet/server/types/rest_spec/agent.ts
+++ b/x-pack/plugins/fleet/server/types/rest_spec/agent.ts
@ -95,6 +95,7 @@ export const PostBulkAgentUnenrollRequestSchema = {
    force: schema.maybe(schema.boolean()),
    revoke: schema.maybe(schema.boolean()),
    batchSize: schema.maybe(schema.number()),
+    includeInactive: schema.maybe(schema.boolean()),
  }),
 };

--- a/x-pack/test/fleet_api_integration/apis/agents/unenroll.ts
+++ b/x-pack/test/fleet_api_integration/apis/agents/unenroll.ts
@ -8,6 +8,7 @@
 import expect from '@kbn/expect';
 import { v4 as uuidv4 } from 'uuid';

+import { AGENTS_INDEX } from '@kbn/fleet-plugin/common';
 import { FtrProviderContext } from '../../../api_integration/ftr_provider_context';
 import { setupFleetAndAgents } from './services';
 import { skipIfNoDockerRegistry } from '../../helpers';
@ -149,7 +150,7 @@ export default function (providerContext: FtrProviderContext) {
      expect(actionStatus.nbAgentsFailed).to.eql(2);
    });

-    it('/agents/bulk_unenroll should allow to unenroll multiple agents by id from an regular agent policy', async () => {
+    it('/agents/bulk_unenroll should allow to unenroll multiple agents by id from a regular agent policy', async () => {
      // set policy to regular
      await supertest
        .put(`/api/fleet/agent_policies/policy1`)
@ -188,6 +189,78 @@ export default function (providerContext: FtrProviderContext) {
      expect(body.total).to.eql(0);
    });

+    it('/agents/bulk_unenroll should allow to unenroll active and inactive agents by kuery with includeInactive', async () => {
+      // Agent inactive
+      await esClient.update({
+        id: 'agent4',
+        refresh: 'wait_for',
+        index: AGENTS_INDEX,
+        body: {
+          doc: {
+            policy_id: 'policy1',
+            policy_revision_idx: 1,
+            last_checkin: new Date(Date.now() - 1000 * 60).toISOString(), // policy timeout 1 min
+          },
+        },
+      });
+      // unenroll all agents that had last checkin before "now"
+      await supertest
+        .post(`/api/fleet/agents/bulk_unenroll`)
+        .set('kbn-xsrf', 'xxx')
+        .send({
+          agents: `last_checkin<="${new Date(Date.now()).toISOString()}"`,
+          revoke: true,
+          includeInactive: true,
+        })
+        .expect(200);
+
+      const { body } = await supertest.get(`/api/fleet/agents`);
+      expect(body.total).to.eql(0);
+    });
+    it('/agents/bulk_unenroll should allow to unenroll inactive agents that never had last checkin by kuery with includeInactive', async () => {
+      // Agent inactive
+      await esClient.update({
+        id: 'agent4',
+        refresh: 'wait_for',
+        index: AGENTS_INDEX,
+        body: {
+          doc: {
+            policy_id: 'policy1',
+            policy_revision_idx: 1,
+            last_checkin: new Date(Date.now() - 1000 * 60).toISOString(), // policy timeout 1 min
+          },
+        },
+      });
+      // agent inactive through enrolled_at as no last_checkin
+      await esClient.create({
+        id: 'agent5',
+        refresh: 'wait_for',
+        index: AGENTS_INDEX,
+        document: {
+          active: true,
+          access_api_key_id: 'api-key-4',
+          policy_id: 'policy1',
+          type: 'PERMANENT',
+          local_metadata: { host: { hostname: 'host6' } },
+          user_provided_metadata: {},
+          enrolled_at: new Date(Date.now() - 1000 * 60).toISOString(), // policy timeout 1 min
+        },
+      });
+      // unenroll all agents
+      await supertest
+        .post(`/api/fleet/agents/bulk_unenroll`)
+        .set('kbn-xsrf', 'xxx')
+        .send({
+          agents: 'active: true',
+          revoke: true,
+          includeInactive: true,
+        })
+        .expect(200);
+
+      const { body } = await supertest.get(`/api/fleet/agents`);
+      expect(body.total).to.eql(0);
+    });
+
    it('/agents/bulk_unenroll should allow to unenroll multiple agents by kuery in batches async', async () => {
      const { body } = await supertest
        .post(`/api/fleet/agents/bulk_unenroll`)