Cannot successfully change output type or name in tamper protected agent polices that contain Elastic Defend #11266
Description
-
Steps to Reproduce:
- Create an Agent Policy with an Elasticsearch output and Elastic Defend and enable Tamper protection
- Enroll an Elastic Agent in this policy and verify the agent is healthy and shipping data.
- Modify the policy to use a Logstash output.
- The policy will appear to apply successfully, but Elastic Defend will continue to use the previous Elasticsearch output.
Elastic Agent identifies components by the combination of the input name and the output name ($inputType-$outputName), so an endpoint input with an Elasticsearch output named default would have the name endpoint-default. Creating a new output with a different name say logstash, and assigning it to the endpoint input would create a new component named endpoint-logstash.
Creating a new output and assigning it to endpoint is viewed as stopping the endpoint-default output and start the endpoint-logstash component. This leads to agent uninstalling and installing endpoint again. This is both unnecessary (endpoint can handle this as a normal policy change) and leads to failure to make the change, because the uninstall operation is performed without endpoint unprotecting itself (since a policy change action does not cause endpoint to unprotect unless endpoint is removed from the policy explicitly).