Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add test for HTTP and Transport TLS on basic license #40714

Merged
merged 7 commits into from
Apr 5, 2019
Merged

Add test for HTTP and Transport TLS on basic license #40714

merged 7 commits into from
Apr 5, 2019

Conversation

tvernum
Copy link
Contributor

@tvernum tvernum commented Apr 2, 2019

This adds a new x-pack/qa test for TLS on a basic license.

It starts a 2 node cluster with a basic license, and TLS enabled
on both HTTP and Transport, and verifies the license type, SSL
tessting and SSL certificates API.

It also upgrades the cluster to a trial license and performs that
same set of checks (to ensure that clusters with basic license
and TLS enabled can be upgraded to a higher feature license)

Relates: #37433

@tvernum
Support TLS on basic licenses
35acb53 
- Always output "ssl" usage, even if security is not enabled
- Adds a QA test for running on basic with TLS on transport and http
@tvernum
Merge branch 'master' into tls-basic
4b6955d
@tvernum
Switch to new "wait-for-resource" over SSL
e995992
@tvernum
Merge branch 'master' into tls-basic
5c0f8d2
@tvernum tvernum added >test Issues or PRs that are addressing/adding tests :Security/TLS SSL/TLS, Certificates v8.0.0 v7.2.0 labels Apr 2, 2019
@tvernum tvernum requested a review from jkakavas April 2, 2019 04:15
@elasticmachine
Copy link
Collaborator

Pinging @elastic/es-security

@jaymode
Copy link
Member

jaymode commented Apr 2, 2019

Would you mind moving this from x-pack/qa to x-pack/plugin/security/qa? That has been the trend that we've been moving towards so that tests for specific components are co-located with the source such as CCR and SQL

jaymode
jaymode reviewed Apr 2, 2019
View reviewed changes
x-pack/qa/security-tls-basic/src/test/resources/rest-api-spec/test/10_tls_basic.yml Outdated
@@ -0,0 +1,27 @@
setup:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My 2 cents is that a rest test isn't the right thing here. They are harder to debug and unless we'd want these to be run by language clients, I think a Java test is a better alternative.

jkakavas
jkakavas reviewed Apr 3, 2019
View reviewed changes
Copy link
Member

@jkakavas jkakavas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jaymode 's comments seem valid. I don't have a strong opinion on rest vs java tests. I don't see troubleshooting this being too problematic as we need to verify that the cluster started and if not and this will be obvious in either test format and rest responses will be clear enough in case of failures. LGTM after we move to x-pack/plugin/security/qa

x-pack/qa/security-tls-basic/build.gradle Outdated
testCompile project(path: xpackModule('core'), configuration: 'default')
testCompile project(path: xpackModule('security'), configuration: 'testArtifacts')
testCompile project(path: xpackModule('core'), configuration: 'testArtifacts')
testCompile project(path: ':modules:reindex')
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we need this dependency

x-pack/qa/security-tls-basic/build.gradle Outdated
exclude '**/*.key'
exclude '**/*.pem'
exclude '**/*.p12'
exclude '**/*.jks'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

no jks used so far

@tvernum
Copy link
Contributor Author

tvernum commented Apr 4, 2019

I decided that @jaymode was right, and a Java test was clearer.
The logic is much the same as it was (except I can now test the paths in the SSL response, which I couldn't do before due to unpredictable ordering).

@tvernum tvernum added the v7.0.0 label Apr 4, 2019
@tvernum tvernum requested a review from jkakavas April 5, 2019 08:01
jkakavas
jkakavas approved these changes Apr 5, 2019
View reviewed changes
Copy link
Member

@jkakavas jkakavas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@tvernum tvernum merged commit 75a5a64 into elastic:master Apr 5, 2019
jasontedor added a commit to jasontedor/elasticsearch that referenced this pull request Apr 6, 2019
@jasontedor
Merge branch 'master' into build-flavor-type-leniency
cad967f 
* master: (63 commits)
  Suppress lease background sync failures if stopping (elastic#40902)
  [DOCS] Added settings page for ILM. (elastic#40880)
  [Docs] Remove extraneous text (elastic#40914)
  Move test classes to test root in Painless (elastic#40873)
  Fix date index name processor default date_formats (elastic#40915)
  Source additional files correctly in elasticsearch-cli (elastic#40890)
  Allow AVX-512 on JDK 11+ (elastic#40828)
  [Docs] Change example to show col headers (elastic#40822)
  Update apache httpclient to version 4.5.8 (elastic#40875)
  Update monitoring-kibana.json (elastic#40899)
  Introduce Delegating ActionListener Wrappers (elastic#40129)
  Deprecate old transport settings (elastic#40821)
  Add Kibana application privileges for monitoring and ml reserved roles (elastic#40651)
  Use Writeable for TransportReplAction derivatives (elastic#40894)
  Add test for HTTP and Transport TLS on basic license (elastic#40714)
  Remove unneded cluster config from test (elastic#40856)
  Make Fuzziness reject illegal values earlier (elastic#33511)
  Remove test-only customisation from TransReplAct (elastic#40863)
  Fix dense/sparse vector limit documentation (elastic#40852)
  Make -try xlint warning disabled by default. (elastic#40833)
  ...
jasontedor added a commit to jasontedor/elasticsearch that referenced this pull request Apr 6, 2019
@jasontedor
Merge branch 'master' into minimum-java-11
889cf14 
* master: (77 commits)
  Suppress lease background sync failures if stopping (elastic#40902)
  [DOCS] Added settings page for ILM. (elastic#40880)
  [Docs] Remove extraneous text (elastic#40914)
  Move test classes to test root in Painless (elastic#40873)
  Fix date index name processor default date_formats (elastic#40915)
  Source additional files correctly in elasticsearch-cli (elastic#40890)
  Allow AVX-512 on JDK 11+ (elastic#40828)
  [Docs] Change example to show col headers (elastic#40822)
  Update apache httpclient to version 4.5.8 (elastic#40875)
  Update monitoring-kibana.json (elastic#40899)
  Introduce Delegating ActionListener Wrappers (elastic#40129)
  Deprecate old transport settings (elastic#40821)
  Add Kibana application privileges for monitoring and ml reserved roles (elastic#40651)
  Use Writeable for TransportReplAction derivatives (elastic#40894)
  Add test for HTTP and Transport TLS on basic license (elastic#40714)
  Remove unneded cluster config from test (elastic#40856)
  Make Fuzziness reject illegal values earlier (elastic#33511)
  Remove test-only customisation from TransReplAct (elastic#40863)
  Fix dense/sparse vector limit documentation (elastic#40852)
  Make -try xlint warning disabled by default. (elastic#40833)
  ...
tvernum added a commit to tvernum/elasticsearch that referenced this pull request Apr 8, 2019
@tvernum
Add test for HTTP and Transport TLS on basic license
18cc0ef 
This adds a new security/qa test for TLS on a basic license.

It starts a 2 node cluster with a basic license, and TLS enabled
on both HTTP and Transport, and verifies the license type, x-pack
SSL usage and SSL certificates API.

It also upgrades the cluster to a trial license and performs that
same set of checks (to ensure that clusters with basic license
and TLS enabled can be upgraded to a higher feature license)

Backport of: elastic#40714
@tvernum tvernum mentioned this pull request Apr 8, 2019
Merged
tvernum added a commit that referenced this pull request Apr 8, 2019
@tvernum
Add test for HTTP and Transport TLS on basic license (#40932)
26c63e0 
This adds a new security/qa test for TLS on a basic license.

It starts a 2 node cluster with a basic license, and TLS enabled
on both HTTP and Transport, and verifies the license type, x-pack
SSL usage and SSL certificates API.

It also upgrades the cluster to a trial license and performs that
same set of checks (to ensure that clusters with basic license
and TLS enabled can be upgraded to a higher feature license)

Backport of: #40714
@tvernum tvernum mentioned this pull request Apr 8, 2019
Merged
tvernum added a commit that referenced this pull request Apr 8, 2019
@tvernum
Add test for HTTP and Transport TLS on basic license (#40938)
4feb627 
This adds a new security/qa test for TLS on a basic license.

It starts a 2 node cluster with a basic license, and TLS enabled
on both HTTP and Transport, and verifies the license type
and SSL certificates API.

It also upgrades the cluster to a trial license and performs that
same set of checks (to ensure that clusters with basic license
and TLS enabled can be upgraded to a higher feature license)

Backport of: #40714
@tvernum tvernum mentioned this pull request May 21, 2019
Closed
tvernum added a commit to tvernum/elasticsearch that referenced this pull request May 23, 2019
@tvernum
Add test for HTTP and Transport TLS on basic license
90b8843 
This adds a new security/qa test for TLS on a basic license.

It starts a 2 node cluster with a basic license, and TLS enabled
on both HTTP and Transport, and verifies the license type, x-pack
SSL usage and SSL certificates API.

It also upgrades the cluster to a trial license and performs that
same set of checks (to ensure that clusters with basic license
and TLS enabled can be upgraded to a higher feature license)

Backport of: elastic#40714
@tvernum tvernum mentioned this pull request May 23, 2019
Merged
tvernum added a commit that referenced this pull request May 24, 2019
@tvernum
[Backport 6.8] Add test for HTTP and Transport TLS on basic license (#…
b807b32 
…42418)

This adds a new security/qa test for TLS on a basic license.

It starts a 2 node cluster with a basic license, and TLS enabled
on both HTTP and Transport, and verifies the license type, x-pack
SSL usage and SSL certificates API.

It also upgrades the cluster to a trial license and performs that
same set of checks (to ensure that clusters with basic license
and TLS enabled can be upgraded to a higher feature license)

Backport of: #40714

This also enables the "security-basic" QA test, which was
previously ignored due to a missing config in build.gradle
gurkankaymak pushed a commit to gurkankaymak/elasticsearch that referenced this pull request May 27, 2019
@tvernum
Add test for HTTP and Transport TLS on basic license (elastic#40714)
dec3702 
This adds a new security/qa test for TLS on a basic license.

It starts a 2 node cluster with a basic license, and TLS enabled
on both HTTP and Transport, and verifies the license type, x-pack
SSL usage and SSL certificates API.

It also upgrades the cluster to a trial license and performs that
same set of checks (to ensure that clusters with basic license
and TLS enabled can be upgraded to a higher feature license)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jaymode jaymode jaymode left review comments

@jkakavas jkakavas jkakavas approved these changes

Assignees
No one assigned
Labels
:Security/TLS SSL/TLS, Certificates >test Issues or PRs that are addressing/adding tests v7.0.0 v7.2.0 v8.0.0-alpha1
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
5 participants
@tvernum @elasticmachine @jaymode @jkakavas @jakelandis