FTR - adjust auth for esSupertest in serverless #166745
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
pheyos
added
release_note:skip
|
@elasticmachine merge upstream |
|
@elasticmachine merge upstream |
💚 Build Succeeded
Metrics [docs]
History
To update your PR or re-run it, just comment with: cc @pheyos |
gergoabraham
pushed a commit
to gergoabraham/kibana
that referenced
this pull request
Sep 21, 2023
## Summary
This PR removes the `systemIndicesSuperuser` auth in the `esSupertest`
service for serverless test runs, adds `certificateAuthorities` to the
Elasticsearch server config in serverless and adds a tiny test to verify
functionality of this fix.
### Details
Issues before this PR when using the `esSupertest` service in serverless
tests (can be reproduced by running the added `elasticsearch_api` test
without the supertest and config changes):
1. Running against a local `functional_tests_server`, `esSupertest`
produces an error: `Error: self-signed certificate in certificate chain`
2. Running against an MKI project produces an error: `unable to
authenticate user [system_indices_superuser] for REST request [/]`,
because the `system_indices_superuser` doesn't exist in MKI.
How this PR addresses the issues:
1. Add `certificateAuthorities` to `servers.elasticsearch` in
`x-pack/test_serverless/shared/config.base.ts` in the same way we
already have it for `servers.kibana`
2. Modify the `esSUpertest` service to not override the default ES auth
when running in serverless, instead go with the default auth (regular
superuser), which is the best we can get.
### Additional information
It has been considered to add a serverless specific version of
`esSupertest` in order to avoid the `config.get('serverless') ?` code.
The fact that a number of stateful services are planned to be re-used in
serverless and rely on `esSupertest` in combination with the very small
change in a central service made it seem worth to make an exception
here.
Note that service methods or tests that use `esSupertest` can still run
into issues on serverless if they actually try to modify system indices.
This should be avoided anyways and particularly for serverless tests.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR removes the
systemIndicesSuperuserauth in theesSupertestservice for serverless test runs, addscertificateAuthoritiesto the Elasticsearch server config in serverless and adds a tiny test to verify functionality of this fix.Details
Issues before this PR when using the
esSupertestservice in serverless tests (can be reproduced by running the addedelasticsearch_apitest without the supertest and config changes):functional_tests_server,esSupertestproduces an error:Error: self-signed certificate in certificate chainunable to authenticate user [system_indices_superuser] for REST request [/], because thesystem_indices_superuserdoesn't exist in MKI.How this PR addresses the issues:
certificateAuthoritiestoservers.elasticsearchinx-pack/test_serverless/shared/config.base.tsin the same way we already have it forservers.kibanaesSUpertestservice to not override the default ES auth when running in serverless, instead go with the default auth (regular superuser), which is the best we can get.Additional information
It has been considered to add a serverless specific version of
esSupertestin order to avoid theconfig.get('serverless') ?code. The fact that a number of stateful services are planned to be re-used in serverless and rely onesSupertestin combination with the very small change in a central service made it seem worth to make an exception here.Note that service methods or tests that use
esSupertestcan still run into issues on serverless if they actually try to modify system indices. This should be avoided anyways and particularly for serverless tests.