[Fleet] Support preconfigured output secrets

package.json

@@ -866,6 +866,7 @@
     "ansi-regex": "^5.0.1",
     "antlr4ts": "^0.5.0-alpha.3",
     "archiver": "^5.3.1",
+    "argon2": "0.31.1",
     "async": "^3.2.3",
     "aws4": "^1.12.0",
     "axios": "^1.6.0",

x-pack/plugins/fleet/common/types/models/output.ts

@@ -23,7 +23,12 @@ export type KafkaPartitionType = typeof kafkaPartitionType;
 export type KafkaTopicWhenType = typeof kafkaTopicWhenType;
 export type KafkaAcknowledgeReliabilityLevel = typeof kafkaAcknowledgeReliabilityLevel;
 export type KafkaVerificationMode = typeof kafkaVerificationModes;
-
+export type OutputSecret =
+  | string
+  | {
+      id: string;
+      hash?: string;
+    };
 interface NewBaseOutput {
   is_default: boolean;
   is_default_monitoring: boolean;
@@ -45,11 +50,7 @@ interface NewBaseOutput {
   allow_edit?: string[];
   secrets?: {
     ssl?: {
-      key?:
-        | string
-        | {
-            id: string;
-          };
+      key?: OutputSecret;
     };
   };
 }
@@ -131,17 +132,9 @@ export interface KafkaOutput extends NewBaseOutput {
   broker_timeout?: number;
   required_acks?: ValueOf<KafkaAcknowledgeReliabilityLevel>;
   secrets?: {
-    password?:
-      | string
-      | {
-          id: string;
-        };
+    password?: OutputSecret;
     ssl?: {
-      key?:
-        | string
-        | {
-            id: string;
-          };
+      key?: OutputSecret;
     };
   };
 }

x-pack/plugins/fleet/server/services/output.ts

@@ -419,7 +419,12 @@ class OutputService {
     soClient: SavedObjectsClientContract,
     esClient: ElasticsearchClient,
     output: NewOutput,
-    options?: { id?: string; fromPreconfiguration?: boolean; overwrite?: boolean }
+    options?: {
+      id?: string;
+      fromPreconfiguration?: boolean;
+      overwrite?: boolean;
+      secretHashes?: Record<string, any>;
+    }
   ): Promise<Output> {
     const data: OutputSOAttributes = { ...omit(output, ['ssl', 'secrets']) };
     if (output.type === outputType.RemoteElasticsearch) {
@@ -555,6 +560,7 @@ class OutputService {
       const { output: outputWithSecrets } = await extractAndWriteOutputSecrets({
         output,
         esClient,
+        secretHashes: output.is_preconfigured ? options?.secretHashes : undefined,
       });
 
       if (outputWithSecrets.secrets) data.secrets = outputWithSecrets.secrets;
@@ -716,7 +722,10 @@ class OutputService {
     esClient: ElasticsearchClient,
     id: string,
     data: Partial<Output>,
-    { fromPreconfiguration = false }: { fromPreconfiguration: boolean } = {
+    {
+      fromPreconfiguration = false,
+      secretHashes,
+    }: { fromPreconfiguration: boolean; secretHashes?: Record<string, any> } = {
       fromPreconfiguration: false,
     }
   ) {
@@ -747,6 +756,7 @@ class OutputService {
         oldOutput: originalOutput,
         outputUpdate: data,
         esClient,
+        secretHashes: data.is_preconfigured ? secretHashes : undefined,
       });
 
       updateData.secrets = secretsRes.outputUpdate.secrets;