elastic
diff --git a/‎x-pack/platform/plugins/shared/alerting/server/alerts_service/alerts_service.test.ts‎
Lines changed: 1 addition & 0 deletions b/‎x-pack/platform/plugins/shared/alerting/server/alerts_service/alerts_service.test.ts‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎x-pack/platform/plugins/shared/alerting/server/alerts_service/lib/create_or_update_component_template.test.ts‎
Lines changed: 97 additions & 2 deletions b/‎x-pack/platform/plugins/shared/alerting/server/alerts_service/lib/create_or_update_component_template.test.ts‎
Lines changed: 97 additions & 2 deletions
diff --git a/‎x-pack/platform/plugins/shared/alerting/server/alerts_service/lib/create_or_update_component_template.ts‎
Lines changed: 57 additions & 1 deletion b/‎x-pack/platform/plugins/shared/alerting/server/alerts_service/lib/create_or_update_component_template.ts‎
Lines changed: 57 additions & 1 deletion
diff --git a/‎x-pack/platform/plugins/shared/alerting/server/alerts_service/lib/create_or_update_ilm_policy.test.ts‎
Lines changed: 87 additions & 1 deletion b/‎x-pack/platform/plugins/shared/alerting/server/alerts_service/lib/create_or_update_ilm_policy.test.ts‎
Lines changed: 87 additions & 1 deletion
diff --git a/‎x-pack/platform/plugins/shared/alerting/server/alerts_service/lib/create_or_update_ilm_policy.ts‎
Lines changed: 51 additions & 1 deletion b/‎x-pack/platform/plugins/shared/alerting/server/alerts_service/lib/create_or_update_ilm_policy.ts‎
Lines changed: 51 additions & 1 deletion
@@ -110,6 +110,7 @@ const IlmPutBody = {
   policy: {
     _meta: {
       managed: true,
+      content_hash: expect.stringMatching(/^[0-9a-f]{16}$/),
     },
     phases: {
       hot: {
 
@@ -42,15 +42,110 @@ describe('createOrUpdateComponentTemplate', () => {
     jest.spyOn(global.Math, 'random').mockReturnValue(randomDelayMultiplier);
   });
 
-  it(`should call esClient to put component template`, async () => {
+  const stampedComponentTemplate = {
+    ...ComponentTemplate,
+    _meta: {
+      ...ComponentTemplate._meta,
+      content_hash: expect.stringMatching(/^[0-9a-f]{16}$/),
+    },
+  };
+
+  it(`should call esClient to put component template, stamped with a content hash`, async () => {
+    await createOrUpdateComponentTemplate({
+      logger,
+      esClient: clusterClient,
+      template: ComponentTemplate,
+      totalFieldsLimit: 2500,
+    });
+
+    expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledWith(
+      stampedComponentTemplate
+    );
+  });
+
+  it(`should skip the PUT when the installed content hash matches`, async () => {
+    // First install to capture the hash this template stamps.
+    await createOrUpdateComponentTemplate({
+      logger,
+      esClient: clusterClient,
+      template: ComponentTemplate,
+      totalFieldsLimit: 2500,
+    });
+    const installedHash = (
+      clusterClient.cluster.putComponentTemplate.mock.calls[0][0] as unknown as {
+        _meta: { content_hash: string };
+      }
+    )._meta.content_hash;
+    clusterClient.cluster.putComponentTemplate.mockClear();
+
+    clusterClient.cluster.getComponentTemplate.mockResolvedValue({
+      component_templates: [
+        { name: 'test-mappings', component_template: { _meta: { content_hash: installedHash } } },
+      ],
+    } as unknown as Awaited<ReturnType<typeof clusterClient.cluster.getComponentTemplate>>);
+
+    await createOrUpdateComponentTemplate({
+      logger,
+      esClient: clusterClient,
+      template: ComponentTemplate,
+      totalFieldsLimit: 2500,
+    });
+
+    expect(clusterClient.cluster.putComponentTemplate).not.toHaveBeenCalled();
+  });
+
+  it(`should PUT when the installed content hash differs`, async () => {
+    clusterClient.cluster.getComponentTemplate.mockResolvedValue({
+      component_templates: [
+        { name: 'test-mappings', component_template: { _meta: { content_hash: 'stale-hash' } } },
+      ],
+    } as unknown as Awaited<ReturnType<typeof clusterClient.cluster.getComponentTemplate>>);
+
+    await createOrUpdateComponentTemplate({
+      logger,
+      esClient: clusterClient,
+      template: ComponentTemplate,
+      totalFieldsLimit: 2500,
+    });
+
+    expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledWith(
+      stampedComponentTemplate
+    );
+  });
+
+  it(`should PUT when the installed template carries no content hash`, async () => {
+    clusterClient.cluster.getComponentTemplate.mockResolvedValue({
+      component_templates: [
+        { name: 'test-mappings', component_template: { _meta: { managed: true } } },
+      ],
+    } as unknown as Awaited<ReturnType<typeof clusterClient.cluster.getComponentTemplate>>);
+
+    await createOrUpdateComponentTemplate({
+      logger,
+      esClient: clusterClient,
+      template: ComponentTemplate,
+      totalFieldsLimit: 2500,
+    });
+
+    expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledTimes(1);
+  });
+
+  it(`should PUT when the installed template cannot be read`, async () => {
+    clusterClient.cluster.getComponentTemplate.mockRejectedValue(new Error('security_exception'));
+
     await createOrUpdateComponentTemplate({
       logger,
       esClient: clusterClient,
       template: ComponentTemplate,
       totalFieldsLimit: 2500,
     });
 
-    expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledWith(ComponentTemplate);
+    expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledWith(
+      stampedComponentTemplate
+    );
+    expect(logger.debug).toHaveBeenCalledWith(
+      `Could not read installed component template test-mappings content hash; will install (security_exception)`
+    );
   });
 
   it(`should retry on transient ES errors`, async () => {
 
@@ -13,6 +13,7 @@ import type { Logger, ElasticsearchClient } from '@kbn/core/server';
 import { asyncForEach } from '@kbn/std';
 import { retryTransientEsErrors } from '../../lib/retry_transient_es_errors';
 import { updateIndexTemplateFieldsLimit } from './update_index_template_fields_limit';
+import { computeResourceHash, RESOURCE_CONTENT_HASH_META_FIELD } from './resource_hash';
 
 interface CreateOrUpdateComponentTemplateOpts {
   logger: Logger;
@@ -21,6 +22,35 @@ interface CreateOrUpdateComponentTemplateOpts {
   totalFieldsLimit: number;
 }
 
+/**
+ * Reads the content hash stamped in `_meta` on the currently-installed component
+ * template, or `undefined` if the template does not exist, carries no stamp, or
+ * cannot be read.
+ */
+const getInstalledComponentTemplateHash = async (
+  esClient: ElasticsearchClient,
+  name: string,
+  logger: Logger
+): Promise<string | undefined> => {
+  try {
+    const response = await retryTransientEsErrors(
+      () => esClient.cluster.getComponentTemplate({ name }),
+      { logger }
+    );
+    const existing = (response?.component_templates ?? []).find((ct) => ct.name === name);
+    const meta = existing?.component_template?._meta;
+    return meta?.[RESOURCE_CONTENT_HASH_META_FIELD];
+  } catch (err) {
+    // Any failure reading the installed hash (404, permissions, exhausted
+    // retries) leaves the installed content unknown, which falls through to the
+    // PUT. The check must never block an install that would otherwise succeed.
+    logger.debug(
+      `Could not read installed component template ${name} content hash; will install (${err.message})`
+    );
+    return undefined;
+  }
+};
+
 const getIndexTemplatesUsingComponentTemplate = async (
   esClient: ElasticsearchClient,
   componentTemplateName: string,
@@ -108,8 +138,34 @@ export const createOrUpdateComponentTemplate = async ({
 }: CreateOrUpdateComponentTemplateOpts) => {
   logger.debug(`Installing component template ${template.name}`);
 
+  // Stamp the content hash so a later install can detect an unchanged template
+  // and skip the cluster-state write. The hash covers the template body only
+  // (settings + mappings); `_meta` is excluded so it never hashes itself.
+  const contentHash = computeResourceHash(template.template);
+  const stampedTemplate: ClusterPutComponentTemplateRequest = {
+    ...template,
+    _meta: {
+      ...template._meta,
+      [RESOURCE_CONTENT_HASH_META_FIELD]: contentHash,
+    },
+  };
+
   try {
-    await createOrUpdateComponentTemplateHelper(esClient, template, totalFieldsLimit, logger);
+    // Skip only on a positive hash match; any missing stamp / error falls through to the PUT.
+    const installedHash = await getInstalledComponentTemplateHash(esClient, template.name, logger);
+    if (installedHash === contentHash) {
+      logger.debug(
+        `Skipping install of component template ${template.name}; content unchanged (${contentHash})`
+      );
+      return;
+    }
+
+    await createOrUpdateComponentTemplateHelper(
+      esClient,
+      stampedTemplate,
+      totalFieldsLimit,
+      logger
+    );
   } catch (err) {
     logger.error(`Error installing component template ${template.name} - ${err.message}`);
     throw err;
 
@@ -36,7 +36,7 @@ describe('createOrUpdateIlmPolicy', () => {
     jest.spyOn(global.Math, 'random').mockReturnValue(randomDelayMultiplier);
   });
 
-  it(`should call esClient to put ILM policy`, async () => {
+  it(`should call esClient to put ILM policy, stamped with a content hash`, async () => {
     await createOrUpdateIlmPolicy({
       logger,
       esClient: clusterClient,
@@ -46,9 +46,95 @@ describe('createOrUpdateIlmPolicy', () => {
     });
 
     expect(clusterClient.ilm.putLifecycle).toHaveBeenCalledWith({
+      name: 'test-policy',
+      policy: {
+        ...IlmPolicy,
+        _meta: {
+          managed: true,
+          content_hash: expect.stringMatching(/^[0-9a-f]{16}$/),
+        },
+      },
+    });
+  });
+
+  it(`should skip the PUT when the installed content hash matches`, async () => {
+    // First install to capture the hash this policy stamps.
+    await createOrUpdateIlmPolicy({
+      logger,
+      esClient: clusterClient,
+      name: 'test-policy',
+      policy: IlmPolicy,
+      dataStreamAdapter,
+    });
+    const installedHash = (
+      clusterClient.ilm.putLifecycle.mock.calls[0][0] as unknown as {
+        policy: { _meta: { content_hash: string } };
+      }
+    ).policy._meta.content_hash;
+    clusterClient.ilm.putLifecycle.mockClear();
+
+    clusterClient.ilm.getLifecycle.mockResolvedValue({
+      'test-policy': { policy: { _meta: { managed: true, content_hash: installedHash } } },
+    } as unknown as Awaited<ReturnType<typeof clusterClient.ilm.getLifecycle>>);
+
+    await createOrUpdateIlmPolicy({
+      logger,
+      esClient: clusterClient,
+      name: 'test-policy',
+      policy: IlmPolicy,
+      dataStreamAdapter,
+    });
+
+    expect(clusterClient.ilm.putLifecycle).not.toHaveBeenCalled();
+  });
+
+  it(`should PUT when the installed content hash differs`, async () => {
+    clusterClient.ilm.getLifecycle.mockResolvedValue({
+      'test-policy': { policy: { _meta: { managed: true, content_hash: 'stale-hash' } } },
+    } as unknown as Awaited<ReturnType<typeof clusterClient.ilm.getLifecycle>>);
+
+    await createOrUpdateIlmPolicy({
+      logger,
+      esClient: clusterClient,
+      name: 'test-policy',
+      policy: IlmPolicy,
+      dataStreamAdapter,
+    });
+
+    expect(clusterClient.ilm.putLifecycle).toHaveBeenCalledTimes(1);
+  });
+
+  it(`should PUT when the installed policy carries no content hash`, async () => {
+    clusterClient.ilm.getLifecycle.mockResolvedValue({
+      'test-policy': { policy: { _meta: { managed: true } } },
+    } as unknown as Awaited<ReturnType<typeof clusterClient.ilm.getLifecycle>>);
+
+    await createOrUpdateIlmPolicy({
+      logger,
+      esClient: clusterClient,
       name: 'test-policy',
       policy: IlmPolicy,
+      dataStreamAdapter,
     });
+
+    expect(clusterClient.ilm.putLifecycle).toHaveBeenCalledTimes(1);
+  });
+
+  it(`should PUT when the installed policy cannot be read`, async () => {
+    clusterClient.ilm.getLifecycle.mockRejectedValue(new Error('security_exception'));
+
+    await createOrUpdateIlmPolicy({
+      logger,
+      esClient: clusterClient,
+      name: 'test-policy',
+      policy: IlmPolicy,
+      dataStreamAdapter,
+    });
+
+    expect(clusterClient.ilm.putLifecycle).toHaveBeenCalledTimes(1);
+    expect(logger.debug).toHaveBeenCalledWith(
+      `Could not read installed ILM policy test-policy content hash; will install (security_exception)`
+    );
   });
 
   it(`should retry on transient ES errors`, async () => {
 
@@ -7,8 +7,10 @@
 
 import type { IlmPolicy } from '@elastic/elasticsearch/lib/api/types';
 import type { Logger, ElasticsearchClient } from '@kbn/core/server';
+import { omit } from 'lodash';
 import { retryTransientEsErrors } from '../../lib/retry_transient_es_errors';
 import type { DataStreamAdapter } from './data_stream_adapter';
+import { computeResourceHash, RESOURCE_CONTENT_HASH_META_FIELD } from './resource_hash';
 
 interface CreateOrUpdateIlmPolicyOpts {
   logger: Logger;
@@ -17,6 +19,34 @@ interface CreateOrUpdateIlmPolicyOpts {
   policy: IlmPolicy;
   dataStreamAdapter: DataStreamAdapter;
 }
+
+/**
+ * Reads the content hash stamped in `_meta` on the currently-installed ILM
+ * policy, or `undefined` if the policy does not exist, carries no stamp, or
+ * cannot be read.
+ */
+const getInstalledIlmPolicyHash = async (
+  esClient: ElasticsearchClient,
+  name: string,
+  logger: Logger
+): Promise<string | undefined> => {
+  try {
+    const response = await retryTransientEsErrors(() => esClient.ilm.getLifecycle({ name }), {
+      logger,
+    });
+    const meta = response?.[name]?.policy?._meta;
+    return meta?.[RESOURCE_CONTENT_HASH_META_FIELD];
+  } catch (err) {
+    // Any failure reading the installed hash (404, permissions, exhausted
+    // retries) leaves the installed content unknown, which falls through to the
+    // PUT. The check must never block an install that would otherwise succeed.
+    logger.debug(
+      `Could not read installed ILM policy ${name} content hash; will install (${err.message})`
+    );
+    return undefined;
+  }
+};
+
 /**
  * Creates ILM policy if it doesn't already exist, updates it if it does
  */
@@ -31,8 +61,28 @@ export const createOrUpdateIlmPolicy = async ({
 
   logger.debug(`Installing ILM policy ${name}`);
 
+  // Stamp the content hash (over the policy body, excluding `_meta`) so a later
+  // install can detect an unchanged policy and skip the write.
+  const contentHash = computeResourceHash(omit(policy, '_meta'));
+  const stampedPolicy: IlmPolicy = {
+    ...policy,
+    _meta: {
+      ...policy._meta,
+      [RESOURCE_CONTENT_HASH_META_FIELD]: contentHash,
+    },
+  };
+
   try {
-    await retryTransientEsErrors(() => esClient.ilm.putLifecycle({ name, policy }), { logger });
+    // Skip only on a positive hash match; any missing stamp / error falls through to the PUT.
+    const installedHash = await getInstalledIlmPolicyHash(esClient, name, logger);
+    if (installedHash === contentHash) {
+      logger.debug(`Skipping install of ILM policy ${name}; content unchanged (${contentHash})`);
+      return;
+    }
+
+    await retryTransientEsErrors(() => esClient.ilm.putLifecycle({ name, policy: stampedPolicy }), {
+      logger,
+    });
   } catch (err) {
     logger.error(`Error installing ILM policy ${name} - ${err.message}`);
     throw err;