[Fleet] Improve package policy validation

[juliaElastic]

In #125625 it turned out that the current package policy validation is not complete, it doesn't consider package vars moved inside inputs.
This is causing a failure in aws integration tests.

Vars should be valid in different levels: elastic/package-spec#132
See this discussion: #125625 (comment)

The change in validation that caused this issue to surface was introduced here: #124215

Related issue:

• [Fleet] Support input level variable for granular integrations #112272

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[endorama]

Following up on this comment by @juliaElastic :

Yes, it works if I put it in global vars (outside of inputs), but my question is, the same vars can appear inside inputs/streams as well, should Fleet take the values any level (e.g. moved inside inputs) and load them on UI?

To clarify naming for packages different variables "levels" (I've seen some confusion around this):

• "global" (or "root") variables are package level variables
• policy_template level variables are variables in policy templates
• input level variables are variables in policy template inputs

The hierarchy for these variables is pacakge > policy template > input.

Is my understanding that the same variable (es AWS access_key_id) is not expected to be present at different levels (es package and input), but this is not prohibited by the spec. Is that correct?

Is also my understanding that so far input level variables are not exposed in Fleet UI due to lack of support, so are not used by packages.

/cc @mtojek

[juliaElastic]

@endorama based on the open issue, it seems that input level variables are not yet supported on Fleet UI. Could you give an example on which package has this problem? I checked aws and some of the azure ones, but didn't see any vars under policy_template.inputs

On the issue raised on validation, the case was that global vars were moved to input level, and that seems to be supported in package spec.

[endorama]

@endorama based on the open #112272, it seems that input level variables are not yet supported on Fleet UI. Could you give an example on which package has this problem? I checked aws and some of the azure ones, but didn't see any vars under policy_template.inputs

Not sure I'm following, no package use this because is not supported in Fleet. I was just pointing out that as you say is supported by package-spec, so is probably a meaningful case for validation.

[juliaElastic]

I'm not quite sure what would be the expected behavior on Fleet UI for package vars moved to input vars:

• Should input vars be accepted valid if they appear as package vars in spec?
• If package vars come as input vars in package policy request, the UI doesn't display them. Should it be in scope for this issue to show them as package vars?

To be honest I find this feature of moving package vars to input vars confusing.

@jen-huang could you help answering the questions above? I saw that the related issue was closed.

[jen-huang]

Going to close this as discussion in the parent issue(s) have been resolved.