[Response Ops][Alerting] Reusable functions for FAAD resource installation

[ymao1]

Resolves #152490

Summary

This PR refactors the resource installation methods in AlertsService to be reusable library functions. It exports them from the alerting plugin and changes the rule registry resource installer to use them as well.

To Verify

1. Run this branch with enableFrameworkAlerts: true. Verify that we can create a detection rule in the default space & a different space and generate a rule preview. The logs should show that the rule registry creates the resources for the preview indices and for indices in the non-default space.
2. Verify that when running this branch on rule registry rules from main or a previous version, the rules continue to run successfully.

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[CoenWarmer]

Hey @ymao1,

I'm using a CCS setup. I've attempted to follow the testing instructions provided. I have added xpack.alerting.enableFrameworkAlerts: true to kibana.dev.yml.

I then proceeded to create an APM Latency Threshold rule, which I have configured like this:

When I clicked save, I got an error:

[2023-03-10T11:16:09.488+01:00][ERROR][plugins.alerting.apm.transaction_duration] Executing Rule default:apm.transaction_duration:8433ce40-bf2b-11ed-a8ca-e57eefdc2c75 has resulted in Error: Alert instance execution has already been scheduled, cannot schedule twice - Error: Alert instance execution has already been scheduled, cannot schedule twice
    at Alert.ensureHasNoScheduledActions (alert.ts:174:13)
    at Alert.scheduleActions (alert.ts:157:10)
    at executor (register_transaction_duration_rule_type.ts:281:12)
    at runMicrotasks (<anonymous>)
    at processTicksAndRejections (node:internal/process/task_queues:96:5)
    at Object.executor (create_lifecycle_executor.ts:215:35)
    at task_runner.ts:340:28
    at TaskRunnerTimer.runWithTimer (task_runner_timer.ts:49:20)
    at TaskRunner.runRule (task_runner.ts:304:38)
    at TaskRunner.run (task_runner.ts:671:31)
    at TaskManagerRunner.run (task_runner.ts:304:22)

I am unsure if this relates to your PR or not, but as it stands I couldn't successfully test your PR.

[ymao1]

@CoenWarmer, thanks for taking a look. That error looks to be unrelated to this PR as it's coming from the APM transaction duration rule executor. The framework throws that error if an alert with the same ID is reported twice during the same execution. Looking at the coding inside register_transaction_duration_rule_type.ts, it looks like alerts are being reported in a for loop that loops over buckets that contains values for serviceName, environment, transactionType, transactionDuration, sourceFields

kibana/x-pack/plugins/apm/server/routes/alerts/rule_types/transaction_duration/register_transaction_duration_rule_type.ts

Lines 224 to 231 in e8a251a

	for (const {
	serviceName,
	environment,
	transactionType,
	transactionDuration,
	sourceFields,
	} of triggeredBuckets) {
	const environmentLabel = getEnvironmentLabel(environment);

However inside the for loop, you are creating and reporting an alertId based only on the environment value:

const id = `${ApmRuleType.TransactionDuration}_${environmentLabel}`;

This means if you have buckets with the same value for environment but different values for serviceName or transactionType (which seems likely because of the multi-terms aggregation being performed), they will get reported back to the framework with the same alertID, causing this error.

This seems like a bug within the rule type executor, would you like me to open an issue for this?

[mikecote]

Changes LGTM! Tested locally and worked as expected 👍

[ymao1]

@elasticmachine merge upstream

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: 75956a0

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
alerting	518	531	+13

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
alerting	41	42	+1

Unknown metric groups

API count

id	before	after	diff
alerting	534	550	+16

ESLint disabled line counts

id	before	after	diff
securitySolution	433	436	+3

Total ESLint disabled count

id	before	after	diff
securitySolution	513	516	+3

History

• 💛 Build #113221 was flaky 9faecef
• 💛 Build #112914 was flaky 3c46ed8
• 💔 Build #112755 failed 60ef606
• 💛 Build #112523 was flaky 9cf3a9e5824205bfd0d592cee62fcdb28b1a6ad6

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @ymao1

[CoenWarmer]

Tested and works as expected! LGTM!