From 7c7f0edbffdd697abcd271e061295ac76850079b Mon Sep 17 00:00:00 2001 From: Keith Massey Date: Fri, 5 Dec 2025 15:16:14 -0600 Subject: [PATCH 1/2] Adding support to DLM for the new .workflows-execution-data-stream-logs data stream --- .../elasticsearch/xpack/core/security/user/InternalUsers.java | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/user/InternalUsers.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/user/InternalUsers.java index f61e7dd1ad4dd..aaef3b048175d 100644 --- a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/user/InternalUsers.java +++ b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/user/InternalUsers.java @@ -180,7 +180,9 @@ public class InternalUsers { // System data stream for result history of fleet actions (see Fleet#fleetActionsResultsDescriptor) ".fleet-actions-results", // System data streams for storing uploaded file data for Agent diagnostics and Endpoint response actions - ".fleet-fileds*" + ".fleet-fileds*", + // System data stream for kibana workflows logs + ".workflows-execution-data-stream-logs" ) .privileges( filterNonNull( From 66a145eec649d29a7667eff4145f0aa0518b5471 Mon Sep 17 00:00:00 2001 From: Keith Massey Date: Fri, 5 Dec 2025 16:03:48 -0600 Subject: [PATCH 2/2] updating test --- .../xpack/core/security/user/InternalUsersTests.java | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/user/InternalUsersTests.java b/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/user/InternalUsersTests.java index c6e8ddc8b928a..6cdd00d2e98f5 100644 --- a/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/user/InternalUsersTests.java +++ b/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/user/InternalUsersTests.java @@ -253,7 +253,11 @@ public void testDataStreamLifecycleUser() { assertThat(role.application(), is(ApplicationPermission.NONE)); assertThat(role.remoteIndices(), is(RemoteIndicesPermission.NONE)); - final List allowedSystemDataStreams = Arrays.asList(".fleet-actions-results", ".fleet-fileds*"); + final List allowedSystemDataStreams = Arrays.asList( + ".fleet-actions-results", + ".fleet-fileds*", + ".workflows-execution-data-stream-logs" + ); for (var group : role.indices().groups()) { if (group.allowRestrictedIndices()) { assertThat(group.indices(), arrayContaining(allowedSystemDataStreams.toArray(new String[0])));