Add setting to restrict license types #49418
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This adds a new "xpack.license.upload.types" setting that restricts which license types may be uploaded to a cluster. By default all types are allowed (excluding basic, which can only be generated and never uploaded). This setting does not restrict APIs that generate licenses such as the start trial API. This setting is not documented as it is intended to be set by orchestrators and not end users.
tvernum
added
>enhancement
:Security/License
|
Pinging @elastic/es-security (:Security/License) |
jkakavas
requested changes
Nov 26, 2019
| @@ -193,11 +203,21 @@ public void on(License license) { | |||
| */ | |||
| public void registerLicense(final PutLicenseRequest request, final ActionListener<PutLicenseResponse> listener) { | |||
| final License newLicense = request.license(); | |||
| final License.LicenseType licenseType; | |||
| try { | |||
| licenseType = License.LicenseType.resolve(newLicense); | |||
There was a problem hiding this comment.
We should not consume any part of the license before we validate its signature first
| @@ -64,6 +64,9 @@ | |||
| return SelfGeneratedLicense.validateSelfGeneratedType(type); | |||
| }, Setting.Property.NodeScope); | |||
|
|
|||
| public static final Setting<List<License.LicenseType>> ALLOWED_LICENSE_TYPES = Setting.listSetting("xpack.license.upload.types", | |||
| License.LicenseType.ALL_TYPE_NAMES, License.LicenseType::parse, Setting.Property.NodeScope); | |||
There was a problem hiding this comment.
We do handle basic explicitly in all places, but should we exclude it from the default value of xpack.license.upload.types too ?
|
@elasticmachine run elasticsearch-ci/1 (failed to download ml artifact, transient network issue ) |
|
@elasticmachine update branch |
tvernum
added a commit
to tvernum/elasticsearch
that referenced
this pull request
Dec 16, 2019
This adds a new "xpack.license.upload.types" setting that restricts which license types may be uploaded to a cluster. By default all types are allowed (excluding basic, which can only be generated and never uploaded). This setting does not restrict APIs that generate licenses such as the start trial API. This setting is not documented as it is intended to be set by orchestrators and not end users. Backport of: elastic#49418
tvernum
added a commit
that referenced
this pull request
Dec 17, 2019
This adds a new "xpack.license.upload.types" setting that restricts which license types may be uploaded to a cluster. By default all types are allowed (excluding basic, which can only be generated and never uploaded). This setting does not restrict APIs that generate licenses such as the start trial API. This setting is not documented as it is intended to be set by orchestrators and not end users. Backport of: #49418
SivagurunathanV
pushed a commit
to SivagurunathanV/elasticsearch
that referenced
this pull request
Jan 23, 2020
This adds a new "xpack.license.upload.types" setting that restricts which license types may be uploaded to a cluster. By default all types are allowed (excluding basic, which can only be generated and never uploaded). This setting does not restrict APIs that generate licenses such as the start trial API. This setting is not documented as it is intended to be set by orchestrators and not end users.
This was referenced Feb 3, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This adds a new "xpack.license.upload.types" setting that restricts
which license types may be uploaded to a cluster.
By default all types are allowed (excluding basic, which can only be
generated and never uploaded).
This setting does not restrict APIs that generate licenses such as the
start trial API.
This setting is not documented as it is intended to be set by
orchestrators and not end users.
Closes: #48508