Enforce license for cross-cluster API key APIs#96307
Conversation
Enforce the same license level as the advanced remote cluster security feature for these APIs.
ywangd
added
>non-issue
:Security/License
|
Pinging @elastic/es-security (Team:Security) |
| @Override | ||
| protected Exception checkFeatureAvailable(RestRequest request) { | ||
| final Exception failedFeature = super.checkFeatureAvailable(request); | ||
| if (failedFeature != null) { | ||
| return failedFeature; | ||
| } else if (ADVANCED_REMOTE_CLUSTER_SECURITY_FEATURE.checkWithoutTracking(licenseState)) { | ||
| return null; | ||
| } else { | ||
| return LicenseUtils.newComplianceException(ADVANCED_REMOTE_CLUSTER_SECURITY_FEATURE.getName()); | ||
| } | ||
| } |
There was a problem hiding this comment.
This method is duplicated in RestUpdateCrossClusterApiKeyAction. If we get to add more REST APIs for cross-cluster API keys, we can extract a superclass to have this method in one place. For now I am keeping it this way. Please let me know if you think otherwise.
| final Exception failedFeature = super.checkFeatureAvailable(request); | ||
| if (failedFeature != null) { | ||
| return failedFeature; | ||
| } else if (ADVANCED_REMOTE_CLUSTER_SECURITY_FEATURE.checkWithoutTracking(licenseState)) { |
There was a problem hiding this comment.
I went back and forth with whether this should check or checkWithoutTracking. At the end, I went with checkWithoutTracking because it is more consistent to track actual usage of cross-cluster access. Otherwise, the stats can be skewed by just playing with these APIs.
| .nodes(1) | ||
| .apply(commonClusterConfig) | ||
| .setting("xpack.license.self_generated.type", "basic") | ||
| .setting("xpack.license.self_generated.type", "trial") |
There was a problem hiding this comment.
Need to change the initial license for FC to be trial. Otherwise the whole test suite fails because it cannot create the cross-cluster API key. Fortunately, this change does not really impact the essence of what we are trying to test here.
3 participants
Enforce the same license level as the advanced remote cluster security feature for these APIs.