Skip to content

[fips] do not expliclity set the default distro #91101

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 11 commits into from
Oct 26, 2022
Merged

[fips] do not expliclity set the default distro #91101

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
27426a4
[fips] do not expliclity set the default distro
jakelandis Oct 24, 2022
19ee878
spotless
jakelandis Oct 24, 2022
27f0578
temp -> align fips flag for testing
jakelandis Oct 24, 2022
95cfcd0
spotless
jakelandis Oct 24, 2022
91f7217
more fips flag shenanigans
jakelandis Oct 24, 2022
dbf20b2
Merge branch 'main' into fips_no_default_distro
jakelandis Oct 25, 2022
1b10b9b
Merge branch 'main' into fips_no_default_distro
jakelandis Oct 25, 2022
5433a44
Merge branch 'main' into fips_no_default_distro
jakelandis Oct 25, 2022
1cc2735
remove default tests.fips.enabled=true
jakelandis Oct 25, 2022
1d0b650
remove default tests.fips.enabled=true
jakelandis Oct 25, 2022
ecee769
Merge branch 'main' into fips_no_default_distro
jakelandis Oct 25, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion build-tools-internal/src/main/groovy/elasticsearch.fips.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,6 @@ if (BuildParams.inFipsJvm) {
dependsOn 'fipsResources'
}
testClusters.configureEach {
setTestDistribution(TestDistribution.DEFAULT)
extraConfigFile "fips_java.security", fipsSecurity
extraConfigFile "fips_java.policy", fipsPolicy
extraConfigFile "cacerts.bcfks", fipsTrustStore
Expand Down
3 changes: 2 additions & 1 deletion build-tools/src/main/java/org/elasticsearch/gradle/testclusters/ElasticsearchNode.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,8 @@ public class ElasticsearchNode implements TestClusterConfiguration {
"path.repo",
"discovery.seed_providers",
"cluster.deprecation_indexing.enabled",
"cluster.initial_master_nodes"
"cluster.initial_master_nodes",
"xpack.security.enabled"
Copy link
Contributor Author

@jakelandis jakelandis Oct 24, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This has the effect that allows you to enable security via the integ_test distribution (in x-pack or core). I think that is a good thing especially if we want to start using the integ_test distro for all module/plugin REST tests.

Copy link
Member

@ywangd ywangd Oct 26, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems that security is disabled by default for INTEG_TEST distribution.

elasticsearch/build-tools/src/main/java/org/elasticsearch/gradle/testclusters/ElasticsearchCluster.java

Lines 355 to 356 in 0ac81ce

if (node.getTestDistribution().equals(TestDistribution.INTEG_TEST)) {
node.defaultConfig.put("xpack.security.enabled", "false");

I think that means most FIPS related stuff will not be excercised in tests with INTEG_TEST distribution even the fips.gradle file configures a bunch of settings, e.g. xpack.security.fips_mode.enabled. Theoretically, this is probably a reduced coverage for FIPS since we are currently forcing DEFAULT distribution for FIPS tests?

That said, there are still tons of tests that use the DEFAULT distribution so that coverage is not really an issue. And we can later look into whether it is necessary and how to enable security for INTEG_TEST.

Copy link
Contributor Author

@jakelandis jakelandis Oct 26, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Theoretically, this is probably a reduced coverage for FIPS since we are currently forcing DEFAULT distribution for FIPS tests?

I don't think this will reduce coverage since security is also disabled for FIPS tests with the DEFAULT distribution. Individual tests can enable security. Before this change they could only enable security if they used the default distribution, but with this change they can override for any REST test.

elasticsearch/build-tools-internal/src/main/groovy/elasticsearch.fips.gradle

Line 73 in 0ac81ce

setting 'xpack.security.enabled', 'false'

Copy link
Member

@ywangd ywangd Oct 26, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I missed that. Thanks!


);

Expand Down