You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[Framework] Clean up native connector secrets code #2990
We no longer rely on connector secrets in 9.0.0 for agentless managed connectors. Go over the code and clean up the usages: some tests and logic were removed in #2989, more thorough cleanup is needed
Connector.api_key_secret_id property (protocol/connectors.py) — read accessor
with no callers. The doc field itself untouched
ApiKeyNotFoundError (sync_job_runner.py) — never raised, caught or imported
Features.native_connector_api_keys_enabled() and Features.NATIVE_CONNECTOR_API_KEYS
(connectors_sdk/utils.py) — no in-repo callers, just an orphaned mock in test_sync_job_runner.py
...plus the tests covering them.
One flag on the last two: they're public on the published elasticsearch-connectors-sdk,
so removing them is an API change for consumers outside this repo. Happy to leave them
in if you'd rather do that separately.
Left alone — protocol-visible, and I can't tell from this repo whether Kibana still
depends on them:
The native_connector_api_keys key in BaseDataSource.features(), and the native_connector_api_keys_enabled = False flag that only exists to feed it. For a
non-native connector the whole features object is rewritten whenever it differs, so
dropping the key would rewrite those docs on next start; native connectors merge, so
the stale key would persist. Should it go?
connectors connector create --native still calls create_connector_secret() and
writes api_key_secret_id into the connector doc (cli/connector.py), and CONNECTOR_PROTOCOL.md documents the field. Should the CLI stop doing this?
Glad to do either or both as a follow-up once you've decided.
Minor aside, unrelated: test_management_client.py::test_get_index_or_alias (~line 296)
is a copy-paste of the create-secret test and never calls get_index_or_alias.
Pre-existing — get_index_or_alias is still covered by the test_extract_index_or_alias_*
cases.
Also, my open PR #4523 touches management_client.py just above get_connector_secret,
so whichever of the two lands second will need a trivial rebase.
Thanks for the breakdown @ShivamSharma43 — we landed this in #4524 (remove unused read path) and #4579 (CLI no longer creates connector secrets; api_key_secret_id stays on the doc but is null from the CLI). We’re keeping native_connector_api_keys in features and the api_key_secret_id field in the protocol, since ES/Kibana still define them and dropping the features key would churn native connector docs on every scheduler poll.
Activity
ShivamSharma43 commentedon Sep 27, 2026
I'd like to take this. I've gone through what's left after #2989 — here's what I found.
Dead in-repo, proposing to remove in a first PR:
ESManagementClient.get_connector_secret()— its only caller went with_update_native_connector_authentication()in [Agent] Respect connector_id defined in agentless #2989; only tests reference it nowConnector.api_key_secret_idproperty (protocol/connectors.py) — read accessorwith no callers. The doc field itself untouched
ApiKeyNotFoundError(sync_job_runner.py) — never raised, caught or importedFeatures.native_connector_api_keys_enabled()andFeatures.NATIVE_CONNECTOR_API_KEYS(
connectors_sdk/utils.py) — no in-repo callers, just an orphaned mock intest_sync_job_runner.py...plus the tests covering them.
One flag on the last two: they're public on the published
elasticsearch-connectors-sdk,so removing them is an API change for consumers outside this repo. Happy to leave them
in if you'd rather do that separately.
Left alone — protocol-visible, and I can't tell from this repo whether Kibana still
depends on them:
The
native_connector_api_keyskey inBaseDataSource.features(), and thenative_connector_api_keys_enabled = Falseflag that only exists to feed it. For anon-native connector the whole
featuresobject is rewritten whenever it differs, sodropping the key would rewrite those docs on next start; native connectors merge, so
the stale key would persist. Should it go?
connectors connector create --nativestill callscreate_connector_secret()andwrites
api_key_secret_idinto the connector doc (cli/connector.py), andCONNECTOR_PROTOCOL.mddocuments the field. Should the CLI stop doing this?Glad to do either or both as a follow-up once you've decided.
Minor aside, unrelated:
test_management_client.py::test_get_index_or_alias(~line 296)is a copy-paste of the create-secret test and never calls
get_index_or_alias.Pre-existing —
get_index_or_aliasis still covered by thetest_extract_index_or_alias_*cases.
Also, my open PR #4523 touches
management_client.pyjust aboveget_connector_secret,so whichever of the two lands second will need a trivial rebase.
chore: remove unused native connector secrets code
chore: remove unused native connector secrets code (#4524)
Jan-Kazlouski-elastic commentedon Oct 8, 2026
Thanks for the breakdown @ShivamSharma43 — we landed this in #4524 (remove unused read path) and #4579 (CLI no longer creates connector secrets;
api_key_secret_idstays on the doc but isnullfrom the CLI). We’re keepingnative_connector_api_keysinfeaturesand theapi_key_secret_idfield in the protocol, since ES/Kibana still define them and dropping the features key would churn native connector docs on every scheduler poll.chore(cli): stop creating connector secrets for native connectors (el…