[Observability AI Assistant] Feature controls

[dgieselaar]

This adds feature controls for the AI Assistant feature.

[elasticmachine]

Pinging @elastic/apm-ui (Team:APM)

[apmmachine]

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

• /oblt-deploy : Deploy a Kibana instance using the Observability test environments.
• /oblt-deploy-serverless : Deploy a serverless Kibana instance using the Observability test environments.
• run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

[cauemarcondes]

Profiling changes LGTM

[thomheymann]

Can you provide a bit more information about the different components of AI Assistant both client and server side?

The feature controls you have introduced as part of this PR only seem to be toggling the UI so I would like to understand a bit better what services this feature uses.

[dgieselaar]

@thomheymann There are two client-side features:

• Chat with the LLM, either through a header action menu item, which will be added in a follow-up PR, or a page in the Observability app, which doesn't have a link in the menu item.
• Contextual insights in specific views, which are LLM-generated based on metadata. E.g., we offer a callout with an accordion that shows performance improvement suggestions for functions detected in Universal Profiling.

We'll have the following APIs:

• chat (to talk to the LLM)
• get/delete/put/post conversation(s)
• connectors (to get the generative AI connectors)
• functions (to execute data calls on the user's behalf)

Can you elaborate on:

The feature controls you have introduced as part of this PR only seem to be toggling the UI so I would like to understand a bit better what services this feature uses.

it is my understanding that the privileges object also gives access to APIs, by virtue of an access:ai_assistant tag - is that incorrect?

I've also asked this on Slack, but adding here for posterity: what is the recommended way to gate this entire feature behind an enterprise license?

[mohamedhamed-ahmed]

Infra changes LGTM

[yngrdyn]

LGTM

[kibana-ci]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: eb9b83f

Failed CI Steps

• APM Cypress Tests #1

Metrics [docs]

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
observabilityAIAssistant	6.5KB	6.6KB	+108.0B

History

• 💚 Build #147945 succeeded eb9b83f
• 💚 Build #147754 succeeded 5c3b467
• 💔 Build #147752 failed 636be7c

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[thomheymann]

it is my understanding that the privileges object also gives access to APIs, by virtue of an access:ai_assistant tag - is that incorrect?

Perfect, yeh, this is the best way of protecting your endpoint.

As long as all API routes related to this feature are using the correct access tags, users that don't have the required permissions to use the feature won't be able to work around that by calling the APIs directly.

I just wanted to ensure that is the case since I didn't see these in the PR.

[thomheymann]

security changes LGTM