Add test for HTTP and Transport TLS on basic license by tvernum · Pull Request #40714 · elastic/elasticsearch

tvernum · 2019-04-02T04:15:34Z

This adds a new x-pack/qa test for TLS on a basic license.

It starts a 2 node cluster with a basic license, and TLS enabled
on both HTTP and Transport, and verifies the license type, SSL
tessting and SSL certificates API.

It also upgrades the cluster to a trial license and performs that
same set of checks (to ensure that clusters with basic license
and TLS enabled can be upgraded to a higher feature license)

Relates: #37433

- Always output "ssl" usage, even if security is not enabled - Adds a QA test for running on basic with TLS on transport and http

elasticmachine · 2019-04-02T04:15:36Z

Pinging @elastic/es-security

jaymode · 2019-04-02T15:24:08Z

Would you mind moving this from x-pack/qa to x-pack/plugin/security/qa? That has been the trend that we've been moving towards so that tests for specific components are co-located with the source such as CCR and SQL

jaymode · 2019-04-02T15:28:52Z

x-pack/qa/security-tls-basic/src/test/resources/rest-api-spec/test/10_tls_basic.yml

@@ -0,0 +1,27 @@
+setup:


My 2 cents is that a rest test isn't the right thing here. They are harder to debug and unless we'd want these to be run by language clients, I think a Java test is a better alternative.

jkakavas

@jaymode 's comments seem valid. I don't have a strong opinion on rest vs java tests. I don't see troubleshooting this being too problematic as we need to verify that the cluster started and if not and this will be obvious in either test format and rest responses will be clear enough in case of failures. LGTM after we move to x-pack/plugin/security/qa

jkakavas · 2019-04-03T06:27:48Z

x-pack/qa/security-tls-basic/build.gradle

+  testCompile project(path: xpackModule('core'), configuration: 'default')
+  testCompile project(path: xpackModule('security'), configuration: 'testArtifacts')
+  testCompile project(path: xpackModule('core'), configuration: 'testArtifacts')
+  testCompile project(path: ':modules:reindex')


I don't think we need this dependency

jkakavas · 2019-04-03T06:30:35Z

x-pack/qa/security-tls-basic/build.gradle

+    exclude '**/*.key'
+    exclude '**/*.pem'
+    exclude '**/*.p12'
+    exclude '**/*.jks'


no jks used so far

tvernum · 2019-04-04T07:16:01Z

I decided that @jaymode was right, and a Java test was clearer.
The logic is much the same as it was (except I can now test the paths in the SSL response, which I couldn't do before due to unpredictable ordering).

jkakavas

LGTM

* master: (63 commits) Suppress lease background sync failures if stopping (elastic#40902) [DOCS] Added settings page for ILM. (elastic#40880) [Docs] Remove extraneous text (elastic#40914) Move test classes to test root in Painless (elastic#40873) Fix date index name processor default date_formats (elastic#40915) Source additional files correctly in elasticsearch-cli (elastic#40890) Allow AVX-512 on JDK 11+ (elastic#40828) [Docs] Change example to show col headers (elastic#40822) Update apache httpclient to version 4.5.8 (elastic#40875) Update monitoring-kibana.json (elastic#40899) Introduce Delegating ActionListener Wrappers (elastic#40129) Deprecate old transport settings (elastic#40821) Add Kibana application privileges for monitoring and ml reserved roles (elastic#40651) Use Writeable for TransportReplAction derivatives (elastic#40894) Add test for HTTP and Transport TLS on basic license (elastic#40714) Remove unneded cluster config from test (elastic#40856) Make Fuzziness reject illegal values earlier (elastic#33511) Remove test-only customisation from TransReplAct (elastic#40863) Fix dense/sparse vector limit documentation (elastic#40852) Make -try xlint warning disabled by default. (elastic#40833) ...

* master: (77 commits) Suppress lease background sync failures if stopping (elastic#40902) [DOCS] Added settings page for ILM. (elastic#40880) [Docs] Remove extraneous text (elastic#40914) Move test classes to test root in Painless (elastic#40873) Fix date index name processor default date_formats (elastic#40915) Source additional files correctly in elasticsearch-cli (elastic#40890) Allow AVX-512 on JDK 11+ (elastic#40828) [Docs] Change example to show col headers (elastic#40822) Update apache httpclient to version 4.5.8 (elastic#40875) Update monitoring-kibana.json (elastic#40899) Introduce Delegating ActionListener Wrappers (elastic#40129) Deprecate old transport settings (elastic#40821) Add Kibana application privileges for monitoring and ml reserved roles (elastic#40651) Use Writeable for TransportReplAction derivatives (elastic#40894) Add test for HTTP and Transport TLS on basic license (elastic#40714) Remove unneded cluster config from test (elastic#40856) Make Fuzziness reject illegal values earlier (elastic#33511) Remove test-only customisation from TransReplAct (elastic#40863) Fix dense/sparse vector limit documentation (elastic#40852) Make -try xlint warning disabled by default. (elastic#40833) ...

This adds a new security/qa test for TLS on a basic license. It starts a 2 node cluster with a basic license, and TLS enabled on both HTTP and Transport, and verifies the license type, x-pack SSL usage and SSL certificates API. It also upgrades the cluster to a trial license and performs that same set of checks (to ensure that clusters with basic license and TLS enabled can be upgraded to a higher feature license) Backport of: elastic#40714

This adds a new security/qa test for TLS on a basic license. It starts a 2 node cluster with a basic license, and TLS enabled on both HTTP and Transport, and verifies the license type, x-pack SSL usage and SSL certificates API. It also upgrades the cluster to a trial license and performs that same set of checks (to ensure that clusters with basic license and TLS enabled can be upgraded to a higher feature license) Backport of: #40714

This adds a new security/qa test for TLS on a basic license. It starts a 2 node cluster with a basic license, and TLS enabled on both HTTP and Transport, and verifies the license type and SSL certificates API. It also upgrades the cluster to a trial license and performs that same set of checks (to ensure that clusters with basic license and TLS enabled can be upgraded to a higher feature license) Backport of: #40714

This adds a new security/qa test for TLS on a basic license. It starts a 2 node cluster with a basic license, and TLS enabled on both HTTP and Transport, and verifies the license type, x-pack SSL usage and SSL certificates API. It also upgrades the cluster to a trial license and performs that same set of checks (to ensure that clusters with basic license and TLS enabled can be upgraded to a higher feature license) Backport of: elastic#40714

…42418) This adds a new security/qa test for TLS on a basic license. It starts a 2 node cluster with a basic license, and TLS enabled on both HTTP and Transport, and verifies the license type, x-pack SSL usage and SSL certificates API. It also upgrades the cluster to a trial license and performs that same set of checks (to ensure that clusters with basic license and TLS enabled can be upgraded to a higher feature license) Backport of: #40714 This also enables the "security-basic" QA test, which was previously ignored due to a missing config in build.gradle

This adds a new security/qa test for TLS on a basic license. It starts a 2 node cluster with a basic license, and TLS enabled on both HTTP and Transport, and verifies the license type, x-pack SSL usage and SSL certificates API. It also upgrades the cluster to a trial license and performs that same set of checks (to ensure that clusters with basic license and TLS enabled can be upgraded to a higher feature license)

tvernum added 4 commits March 29, 2019 18:15

Support TLS on basic licenses

35acb53

- Always output "ssl" usage, even if security is not enabled - Adds a QA test for running on basic with TLS on transport and http

Merge branch 'master' into tls-basic

4b6955d

Switch to new "wait-for-resource" over SSL

e995992

Merge branch 'master' into tls-basic

5c0f8d2

tvernum added >test Issues or PRs that are addressing/adding tests :Security/TLS SSL/TLS, Certificates v8.0.0 v7.2.0 labels Apr 2, 2019

tvernum requested a review from jkakavas April 2, 2019 04:15

jaymode reviewed Apr 2, 2019

View reviewed changes

jkakavas reviewed Apr 3, 2019

View reviewed changes

tvernum added 2 commits April 4, 2019 14:24

Merge branch 'master' into tls-basic

88e69d9

Switch to java test in security/qa

ce6e16f

Address build feedback

ebb2a9f

tvernum added the v7.0.0 label Apr 4, 2019

tvernum requested a review from jkakavas April 5, 2019 08:01

jkakavas approved these changes Apr 5, 2019

View reviewed changes

tvernum merged commit 75a5a64 into elastic:master Apr 5, 2019

tvernum added the backport pending label Apr 5, 2019

tvernum mentioned this pull request Apr 8, 2019

[BACKPORT 7.x] Add test for HTTP and Transport TLS on basic license #40932

Merged

tvernum mentioned this pull request Apr 8, 2019

[BACKPORT 7.0] Add test for HTTP and Transport TLS on basic license #40938

Merged

tvernum removed the backport pending label Apr 8, 2019

tvernum mentioned this pull request May 21, 2019

Allow TLS to work with a basic license #37433

Closed

tvernum mentioned this pull request May 23, 2019

[Backport 6.8] Add test for HTTP and Transport TLS on basic license #42418

Merged

jakelandis added v8.0.0-alpha1 and removed v8.0.0 labels Jul 26, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add test for HTTP and Transport TLS on basic license#40714

Add test for HTTP and Transport TLS on basic license#40714
tvernum merged 7 commits intoelastic:masterfrom
tvernum:tls-basic

tvernum commented Apr 2, 2019

Uh oh!

elasticmachine commented Apr 2, 2019

Uh oh!

jaymode commented Apr 2, 2019

Uh oh!

jaymode Apr 2, 2019

Uh oh!

jkakavas left a comment

Uh oh!

jkakavas Apr 3, 2019

Uh oh!

jkakavas Apr 3, 2019

Uh oh!

tvernum commented Apr 4, 2019

Uh oh!

jkakavas left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

tvernum commented Apr 2, 2019

Uh oh!

elasticmachine commented Apr 2, 2019

Uh oh!

jaymode commented Apr 2, 2019

Uh oh!

jaymode Apr 2, 2019

Choose a reason for hiding this comment

Uh oh!

jkakavas left a comment

Choose a reason for hiding this comment

Uh oh!

jkakavas Apr 3, 2019

Choose a reason for hiding this comment

Uh oh!

jkakavas Apr 3, 2019

Choose a reason for hiding this comment

Uh oh!

tvernum commented Apr 4, 2019

Uh oh!

jkakavas left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants