Add fleet reserved variable validation by MichelLosier · Pull Request #1134 · elastic/package-spec

MichelLosier · 2026-04-08T22:50:31Z

What does this PR do?

Adds validation around the inclusion of use_apm, and data_stream.dataset variable overrides, which fleet already injects automatically if not present.
use_apm
- is of type bool
- is used only on otelcol inputs of streams that are traces or dynamic_signal_types
data_stream.dataset
- is of type text

Where we do injection in fleet, but defer to existing declarations:

https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/fleet/common/services/policy_template.ts#L212-L221

Why is it important?

While already allowing integrations to decide on the default value of these special handled variables, these validations make sure that the expected variable types and constraints are observed.

Checklist

I have added test packages to test/packages that prove my change is effective.
I have added an entry in spec/changelog.yml.

Related issues

Closes: [Change Proposal] Support providing a default value for use_apm variable in integration type packages #1100

MichelLosier · 2026-04-09T21:01:45Z

test integrations

coderabbitai · 2026-04-09T21:06:21Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

A new semantic validator ValidateFleetReservedVars was added and wired into the spec validation pipeline for package types integration and input (gated to version >= 3.6.1). It reads package and data-stream manifests, normalizes streams, and enforces Fleet-reserved variable rules: use_apm must be declared on otelcol inputs, be type: bool, and be allowed only for traces streams unless dynamic_signal_types: true; data_stream.dataset must be type: text. Unit tests and package fixtures for valid and invalid cases were added.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	PR implements all requirements from `#1100`: validates use_apm for integration packages with otelcol inputs, allows default values, and enforces proper scoping.
Out of Scope Changes check	✅ Passed	All changes directly support Fleet-reserved variable validation (use_apm and data_stream.dataset). No unrelated modifications detected.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

🛠️ Update Documentation: Commit on current branch
🛠️ Update Documentation: Create PR

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@code/go/internal/validator/spec.go`:
- Line 233: The semantic validator registration for ValidateFleetReservedVars is
currently unconditional; update its entry in the validator registrations list
(the slice containing {fn: semantic.ValidateFleetReservedVars}) to include the
package types it applies to (e.g., types.Integration or the appropriate types
enum) via a types field and add the since field with the spec version when this
validator was introduced (e.g., "vX.Y.Z"), so the rule is only enforced for the
intended package type(s) and for specs at or after that version.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4c6725de-024d-40e3-b069-bd15b3c09c76

📥 Commits

Reviewing files that changed from the base of the PR and between 06b46cb and 7f1d76c.

📒 Files selected for processing (29)

code/go/internal/validator/semantic/validate_fleet_reserved_vars.go
code/go/internal/validator/semantic/validate_fleet_reserved_vars_test.go
code/go/internal/validator/spec.go
code/go/pkg/validator/validator_test.go
test/packages/bad_input_fleet_reserved_vars/agent/input/input.yml.hbs
test/packages/bad_input_fleet_reserved_vars/changelog.yml
test/packages/bad_input_fleet_reserved_vars/docs/README.md
test/packages/bad_input_fleet_reserved_vars/manifest.yml
test/packages/bad_integration_fleet_reserved_vars/LICENSE.txt
test/packages/bad_integration_fleet_reserved_vars/changelog.yml
test/packages/bad_integration_fleet_reserved_vars/data_stream/sample/agent/stream/stream.yml.hbs
test/packages/bad_integration_fleet_reserved_vars/data_stream/sample/fields/base-fields.yml
test/packages/bad_integration_fleet_reserved_vars/data_stream/sample/manifest.yml
test/packages/bad_integration_fleet_reserved_vars/docs/README.md
test/packages/bad_integration_fleet_reserved_vars/manifest.yml
test/packages/good_input_fleet_reserved_vars/agent/input/input.yml.hbs
test/packages/good_input_fleet_reserved_vars/changelog.yml
test/packages/good_input_fleet_reserved_vars/docs/README.md
test/packages/good_input_fleet_reserved_vars/manifest.yml
test/packages/good_integration_fleet_reserved_vars/LICENSE.txt
test/packages/good_integration_fleet_reserved_vars/changelog.yml
test/packages/good_integration_fleet_reserved_vars/data_stream/log/agent/stream/stream.yml.hbs
test/packages/good_integration_fleet_reserved_vars/data_stream/log/fields/base-fields.yml
test/packages/good_integration_fleet_reserved_vars/data_stream/log/manifest.yml
test/packages/good_integration_fleet_reserved_vars/data_stream/otel/agent/stream/stream.yml.hbs
test/packages/good_integration_fleet_reserved_vars/data_stream/otel/fields/base-fields.yml
test/packages/good_integration_fleet_reserved_vars/data_stream/otel/manifest.yml
test/packages/good_integration_fleet_reserved_vars/docs/README.md
test/packages/good_integration_fleet_reserved_vars/manifest.yml

elastic-vault-github-plugin-prod · 2026-04-09T21:09:03Z

Created or updated PR in integrations repository to test this version. Check elastic/integrations#18319

teresaromero · 2026-04-10T07:34:46Z

+	}
+
+	for _, ds := range dataStreams {
+		manifestPath := dataStreamDir + "/" + ds + "/manifest.yml"


i always struggle with path construction between linux/windows. use path.Join instead to avoid slash errors between platforms

i see the tests passed with this config 🤔 interesting

oof yes, good catch! 😄

i always struggle with path construction between linux/windows. use path.Join instead to avoid slash errors between platforms

For local filesystems filepath.Join should be used, that is the one taking into account the different platforms. path.Join always uses /.

i see the tests passed with this config 🤔 interesting

Here we are using a fs.FS, that always uses unix paths, so path.Join, or just joining with / is fine. If we were using a local filesystem and supporting multiple platforms, we would need to use filepath.Join.

teresaromero

looks good! couple thoughts:

variables for integrations can be defined also at package root level (vars) and policy template input level (vars), i think we are missing these cases. for input packages is also a vars at root level and the one at the policy templates
i was thinking if perhaps instead of creating the streams variables and then running again a loop, we could run validation on the only loop when normalizing. this way we just go through once and we can append validation errors on the go, skipping the variables we are not interested. if i read correctly, the streams list have variables we dont even care. wdyt?

MichelLosier · 2026-04-10T20:39:03Z

Thanks!

variables for integrations can be defined also at package root level (vars) and policy template input level (vars), i think we are missing these cases. for input packages is also a vars at root level and the one at the policy templates

Good callout, I've added to the validation of these vars constraints at what scope they can be used, since data_stream.dataset and use_apm are stream level concerns, and also where fleet currently expects them. So with that validation will now error if they are found at integration: package root, and policy template input level, or input: root level.

i was thinking if perhaps instead of creating the streams variables and then running again a loop, we could run validation on the only loop when normalizing. this way we just go through once and we can append validation errors on the go, skipping the variables we are not interested. if i read correctly, the streams list have variables we dont even care. wdyt?

Sounds good to me, I've refactored it run on normalization and validation in the same pass.

…pe context

elasticmachine · 2026-04-13T17:30:58Z

💚 Build Succeeded

Buildkite Build
Commit: 1d4a21f

History

💚 Build #2053 succeeded f59b180
💔 Build #2052 failed 0547227
💚 Build #2051 succeeded 204f3cc
💚 Build #2050 succeeded 99378db
💚 Build #2049 succeeded 7547cfd
💚 Build #2047 succeeded f38767f

MichelLosier · 2026-04-13T21:26:17Z

Addressed merged conflicts ^

MichelLosier marked this pull request as ready for review April 9, 2026 21:01

MichelLosier requested a review from a team as a code owner April 9, 2026 21:01

coderabbitai bot reviewed Apr 9, 2026

View reviewed changes

Comment thread code/go/internal/validator/spec.go Outdated

elastic-vault-github-plugin-prod bot mentioned this pull request Apr 9, 2026

Test branch package-spec#1134 - DO NOT MERGE elastic/integrations#18319

Closed

teresaromero reviewed Apr 10, 2026

View reviewed changes

jsoriano previously approved these changes Apr 13, 2026

View reviewed changes

MichelLosier added 14 commits April 13, 2026 10:02

Add validation of fleet reserved vars

3c4bac9

Register ValidateFleetReservedVars

1111e82

Add test packages for fleet reserved vars validation

921fb64

Add unit tests for validate_fleet_reserved_vars

16312b6

Add data stream type validation for use_apm

c676549

Fix path building, update changelog

4082342

Reduce looping on reserved var validation

cd36700

Formatting

aab980a

Add scope restraint validation for fleet reserved vars

f315be5

Clean up comments

01bc49b

Have scope validation require scope param

4670050

Refactor validate_fleet_reserved_vars validation funcs to receive sco…

b010c8e

…pe context

Formatting

a270d55

Formatting

1d4a21f

MichelLosier dismissed jsoriano’s stale review via 1d4a21f April 13, 2026 17:11

MichelLosier force-pushed the 1100-add-use-apm-var-validation branch from f59b180 to 1d4a21f Compare April 13, 2026 17:11

jsoriano approved these changes Apr 14, 2026

View reviewed changes

teresaromero approved these changes Apr 14, 2026

View reviewed changes

jsoriano merged commit 50675cc into elastic:main Apr 14, 2026
5 checks passed

Conversation

MichelLosier commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Why is it important?

Checklist

Related issues

Uh oh!

MichelLosier commented Apr 9, 2026

Uh oh!

coderabbitai bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod bot commented Apr 9, 2026

Uh oh!

teresaromero Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

teresaromero Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

MichelLosier Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

jsoriano Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

teresaromero left a comment

Choose a reason for hiding this comment

Uh oh!

MichelLosier commented Apr 10, 2026

Uh oh!

elasticmachine commented Apr 13, 2026

💚 Build Succeeded

History

Uh oh!

MichelLosier commented Apr 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

MichelLosier commented Apr 8, 2026 •

edited

Loading

coderabbitai bot commented Apr 9, 2026 •

edited

Loading