[CI] Use INTEG_TEST distribution in FIPS 140 testing when possible

[jkakavas]

In #64024 , we changed our test setup for FIPS 140 to always use the default distribution because we always wanted to set xpack.security.fips_mode.enabled: true and we can't do this with INTEG_TEST distribution as in tests for non-xpack modules, that setting is not available.

We should try to refrain from setting a specific distribution in fips and use INTEG_TEST as much as possible ( to the extent that the test suites themselves already use it). This has two benefits:

• Improves cacheability and allows us to have a smaller footprint for our test clusters
• Most importantly, it allows us to have similar setups for fips and non-fips CI testing, which would alleviate most of the issues highlighted by the flakiness of Netty4HeadBodyIsEmptyIT.testTemplateExists fails in fips mode #66820

This issue is for tracking the problem so that we can schedule for the appropriate time for investigation and come up with a proposal on how to do this.

[elasticmachine]

Pinging @elastic/es-security (Team:Security)

[ywangd]

I don't fully understand the conversation in #66820. But is the proposal to just allow extra xpack settings but make them no-op? If so, why don't we just stop running FIPS for these tests at all? Also, FIPS is a bit of a cross-cutting mode. So even if a test does not seem to use it directly, is it possible that they would still fail in FIPS mode? A not-great example is the md5 hasher used for fingerprint ingestion processor. I know md5 is still allowed by BC-FIPS, but assume it is not. If it uses the INTEG_TEST distribution, the test will not catch this issue?

[jkakavas]

But is the proposal to just allow extra xpack settings but make them no-op? If so, why don't we just stop running FIPS for these tests at all?

There is no proposal in this issue. The issue tracks the need to look into using INTEG_TEST distribution as much as we can and the proposal will come from that investigation. For the question you raise, I think we'd need to not set xpack.security.fips_mode.enabled when there are no xpack modules ( as setting it has no effect ). The security provider will still be in use and in fips mode.

I'm not sure what the argument is with "using FIPS mode", are you talking about the security provider? If so, I don't think we'll end up suggesting not using the security provider in FIPS mode.

[ywangd]

Thanks for the clarification. My questions are not well formulated and they are based on my misunderstanding of the conversation in #66820. Please disregard them.

[jkakavas]

No worries Yang, thanks for asking. I think the issue description is not as clear as it should be and the questions are valid, I'll try and rewrite it an clean way