abnormal_security,aws_bedrock,crowdstrike: add required variables in system tests #15832
Conversation
moxarth-rathod
added
bugfix
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
🚀 Benchmarks reportTo see the full report comment with |
andrewkroh
added
the
Team:Obs-InfraObs
There was a problem hiding this comment.
Why are there three different YAML approaches to defining the required variables? This change has
wait_interval: ""
file_selectors: |
queue_url:
ssl: |which equates to either empty string or null
{
"wait_interval": "",
"file_selectors": "",
"queue_url": null,
"ssl": ""
}Could we use the same approach in all cases?
(To be clear, I'm not thrilled that we can bypass the required variable check by passing empty strings or nulls, but that's a different problem.)
I initially tried using null everywhere, but it didn’t resolve issue in system test. So, I went with a different approach. For consistency, I’ll change it to use an empty string everywhere. |
efd6
changed the title
There was a problem hiding this comment.
Looking at the change that added this configuration value (#14235), I think that it would be entirely reasonable for the config to be made non-required. This is based on the agent config code that was added and the description in the commit.
| queue_url: '{{TF_OUTPUT_queue_url}}' | ||
| preserve_original_event: true | ||
| preserve_duplicate_custom_fields: true | ||
| file_selectors: "" |
There was a problem hiding this comment.
The complaint from ep is that this should be an array. Should this not be null?
There was a problem hiding this comment.
It throws the same error when I use null. The other option was to use an empty array, like file_selectors: |
So, I’ve changed it to an empty string for consistency.
There was a problem hiding this comment.
Why not use the empty array? file_selectors: [] (file_selectors: | is an empty string, depending on the lines that follow).
It seems to me that the validation is missing something if it allows a string in an array slot.
There was a problem hiding this comment.
@efd6 I've made the changes as per your suggestion.
andrewkroh
added
the
documentation
| preserve_original_event: true | ||
| hosts: | ||
| - http://{{Hostname}}:{{Port}}/metrics | ||
| ssl: [] |
There was a problem hiding this comment.
This satisfies the required var check, but I think there is a bug here because the ssl configuration should not have multi: true. Also the handlebar template is wonky because the if check is looking at ssl.certificate_authorities.
I think the package needs a policy test to check the handlebar rendering. If my assumption is correct, then multi: true should be removed, and then an empty string can satisfy the required check.
It may be best to merge this as is, and open a separate ticket for the nvidia_gpu package owner to sort this out, because I'm not sure of their original intent with the certificate_authorities if check.
There was a problem hiding this comment.
Public issue: #15928
@moxarth-rathod, please change the team label in the issue as per CODEOWNERS
moxarth-rathod
removed
Integration:nvidia_gpu
💚 Build Succeeded
History
|
moxarth-rathod
changed the title
5 participants
Proposed commit message
Checklist
changelog.ymlfile.How to test this PR locally
integrations/packages/crowdstrike directory.
Related issues