Grant additional privileges for endpoint transform indices to kibana_system

[joshdover]

It turns out that we do need these privileges during transform upgrades on the source indices for the Endpoint package's transform

[elasticmachine]

Pinging @elastic/es-security (Team:Security)

[joshdover]

@elasticmachine merge upstream

[dasansol92]

LGTM! It fixes an error in kibana:

[2021-10-21T12:13:01.809+02:00][ERROR][plugins.fleet] Error: cannot rollover data stream {"error":{"root_cause":[{"type":"security_exception","reason":"action [indices:admin/rollover] is unauthorized for user [kibana_system] with roles [kibana_system] on indices [.ds-metrics-endpoint.metadata-default-2021.10.21-000001,metrics-endpoint.metadata-default], this action is granted by the index privileges [manage_follow_index,manage,all]"}],"type":"security_exception","reason":"action [indices:admin/rollover] is unauthorized for user [kibana_system] with roles [kibana_system] on indices [.ds-metrics-endpoint.metadata-default-2021.10.21-000001,metrics-endpoint.metadata-default], this action is granted by the index privileges [manage_follow_index,manage,all]"},"status":403}

But I'm not sure if this regex is appropriate or if it will cause other issues. Perhaps we need something more restrictive? So I would like to be sure if this is the expected result before 👍 it

[joshdover]

I've changed this PR to only exclude metrics-endpoint.metadata_current_default from the wildcard metrics-* pattern we use to assign privileges for all other Fleet package data streams. This ensures that we don't grant more privilege than needed for Endpoint's destination indices.

@dasansol92 could you test again with the most recent changes here?

[ywangd]

LGTM pending CI pass

[elasticsearchmachine]

💔 Backport failed

Status	Branch	Result
❌	8.0	The branch "8.0" is invalid or doesn't exist
✅	7.16

You can use sqren/backport to manually backport by running backport --upstream elastic/elasticsearch --pr 79619