Setup E2E against Serverless ES, Kibana, Fleet server standalone and Elastic endpoint agent in VM

.buildkite/ftr_configs.yml

@@ -27,8 +27,7 @@ disabled:
   - x-pack/test/functional_enterprise_search/cypress.config.ts
   - x-pack/test/defend_workflows_cypress/cli_config.ts
   - x-pack/test/defend_workflows_cypress/config.ts
-  - x-pack/test/defend_workflows_cypress/endpoint_config.ts
-  - x-pack/test/defend_workflows_cypress/endpoint_serverless_config.ts
+  - x-pack/test/defend_workflows_cypress/serverless_config.ts
   - x-pack/plugins/observability_onboarding/e2e/ftr_config_open.ts
   - x-pack/plugins/observability_onboarding/e2e/ftr_config_runner.ts
   - x-pack/plugins/observability_onboarding/e2e/ftr_config.ts

packages/kbn-es/src/cli_commands/serverless.ts

@@ -35,6 +35,7 @@ export const serverless: Command = {
       --basePath          Path to the directory where the ES cluster will store data
       --clean             Remove existing file system object store before running
       --kill              Kill running ES serverless nodes if detected on startup
+      --host              Publish ES docker container on additional host IP
       --port              The port to bind to on 127.0.0.1 [default: ${DEFAULT_PORT}]
       --ssl               Enable HTTP SSL on the ES cluster
       --skipTeardown      If this process exits, leave the ES cluster running in the background
@@ -72,7 +73,7 @@ export const serverless: Command = {
         files: 'F',
       },
 
-      string: ['tag', 'image', 'basePath', 'resources'],
+      string: ['tag', 'image', 'basePath', 'resources', 'host'],
       boolean: ['clean', 'ssl', 'kill', 'background', 'skipTeardown', 'waitForReady'],
 
       default: defaults,

packages/kbn-es/src/utils/docker.test.ts

@@ -29,6 +29,7 @@ import {
   teardownServerlessClusterSync,
   verifyDockerInstalled,
   getESp12Volume,
+  ServerlessOptions,
 } from './docker';
 import { ToolingLog, ToolingLogCollectingWriter } from '@kbn/tooling-log';
 import { ES_P12_PATH } from '@kbn/dev-utils';
@@ -155,6 +156,19 @@ describe('resolvePort()', () => {
     `);
   });
 
+  test('should return default port when custom host passed in options', () => {
+    const port = resolvePort({ host: '192.168.25.1' } as ServerlessOptions);
+
+    expect(port).toMatchInlineSnapshot(`
+      Array [
+        "-p",
+        "127.0.0.1:9200:9200",
+        "-p",
+        "192.168.25.1:9200:9200",
+      ]
+    `);
+  });
+
   test('should return custom port when passed in options', () => {
     const port = resolvePort({ port: 9220 });
 
@@ -167,6 +181,21 @@ describe('resolvePort()', () => {
       ]
     `);
   });
+
+  test('should return custom port and host when passed in options', () => {
+    const port = resolvePort({ port: 9220, host: '192.168.25.1' });
+
+    expect(port).toMatchInlineSnapshot(`
+      Array [
+        "-p",
+        "127.0.0.1:9220:9220",
+        "-p",
+        "192.168.25.1:9220:9220",
+        "--env",
+        "http.port=9220",
+      ]
+    `);
+  });
 });
 
 describe('verifyDockerInstalled()', () => {

packages/kbn-es/src/utils/docker.ts

@@ -56,6 +56,8 @@ export interface DockerOptions extends EsClusterExecOptions, BaseOptions {
 }
 
 export interface ServerlessOptions extends EsClusterExecOptions, BaseOptions {
+  /** Publish ES docker container on additional host IP */
+  host?: string;
   /** Clean (or delete) all data created by the ES cluster after it is stopped */
   clean?: boolean;
   /** Path to the directory where the ES cluster will store data */
@@ -306,19 +308,21 @@ export function resolveDockerImage({
 }
 
 /**
- * Determine the port to bind the Serverless index node or Docker node to
+ * Determine the port and optionally an additional host to bind the Serverless index node or Docker node to
  */
 export function resolvePort(options: ServerlessOptions | DockerOptions) {
+  const port = options.port || DEFAULT_PORT;
+  const value = ['-p', `127.0.0.1:${port}:${port}`];
+
+  if ((options as ServerlessOptions).host) {
+    value.push('-p', `${(options as ServerlessOptions).host}:${port}:${port}`);
+  }
+
   if (options.port) {
-    return [
-      '-p',
-      `127.0.0.1:${options.port}:${options.port}`,
-      '--env',
-      `http.port=${options.port}`,
-    ];
+    value.push('--env', `http.port=${options.port}`);
   }
 
-  return ['-p', `127.0.0.1:${DEFAULT_PORT}:${DEFAULT_PORT}`];
+  return value;
 }
 
 /**

packages/kbn-test/src/es/test_es_cluster.ts

@@ -19,6 +19,7 @@ import { Client, HttpConnection } from '@elastic/elasticsearch';
 import type { ToolingLog } from '@kbn/tooling-log';
 import { REPO_ROOT } from '@kbn/repo-info';
 import type { ArtifactLicense } from '@kbn/es';
+import type { ServerlessOptions } from '@kbn/es/src/utils';
 import { CI_PARALLEL_PROCESS_PREFIX } from '../ci_parallel_process_prefix';
 import { esTestConfig } from './es_test_config';
 
@@ -70,10 +71,7 @@ export interface CreateTestEsClusterOptions {
    */
   esArgs?: string[];
   esFrom?: string;
-  esServerlessOptions?: {
-    image?: string;
-    tag?: string;
-  };
+  esServerlessOptions?: Pick<ServerlessOptions, 'image' | 'tag' | 'host'>;
   esJavaOpts?: string;
   /**
    * License to run your cluster under. Keep in mind that a `trial` license
@@ -246,6 +244,7 @@ export function createTestEsCluster<
           esArgs: customEsArgs,
           image: esServerlessOptions?.image,
           tag: esServerlessOptions?.tag,
+          host: esServerlessOptions?.host,
           port,
           clean: true,
           background: true,

packages/kbn-test/src/functional_test_runner/lib/config/schema.ts

@@ -214,6 +214,12 @@ export const schema = Joi.object()
       })
       .default(),
 
+    esServerlessOptions: Joi.object()
+      .keys({
+        host: Joi.string().ip(),
+      })
+      .default(),
+
     kbnTestServer: Joi.object()
       .keys({
         buildArgs: Joi.array(),

packages/kbn-test/src/functional_tests/lib/run_elasticsearch.ts

@@ -166,16 +166,24 @@ function getESServerlessOptions(esServerlessImageFromArg: string | undefined, co
     esTestConfig.getESServerlessImage() ||
     (config.has('esTestCluster.esServerlessImage') &&
       config.get('esTestCluster.esServerlessImage'));
+  const serverlessHost: string | undefined =
+    config.has('esServerlessOptions.host') && config.get('esServerlessOptions.host');
 
   if (esServerlessImageUrlOrTag) {
     if (esServerlessImageUrlOrTag.includes(':')) {
       return {
         image: esServerlessImageUrlOrTag,
+        host: serverlessHost,
       };
     } else {
       return {
         tag: esServerlessImageUrlOrTag,
+        host: serverlessHost,
       };
     }
   }
+
+  return {
+    host: serverlessHost,
+  };
 }

x-pack/plugins/security_solution/package.json

@@ -13,7 +13,7 @@
     "cypress:dw": "NODE_OPTIONS=--openssl-legacy-provider node ./scripts/start_cypress_parallel --config-file ./public/management/cypress/cypress.config.ts --ftr-config-file ../../test/defend_workflows_cypress/cli_config",
     "cypress:dw:open": "yarn cypress:dw open",
     "cypress:dw:run": "yarn cypress:dw run",
-    "cypress:dw:serverless": "NODE_OPTIONS=--openssl-legacy-provider node ./scripts/start_cypress_parallel --config-file ./public/management/cypress/cypress_serverless.config.ts --ftr-config-file ../../../x-pack/test_serverless/functional/test_suites/security/cypress/security_config",
+    "cypress:dw:serverless": "NODE_OPTIONS=--openssl-legacy-provider node ./scripts/start_cypress_parallel --config-file ./public/management/cypress/cypress_serverless.config.ts --ftr-config-file ../../test/defend_workflows_cypress/serverless_config",
     "cypress:dw:serverless:open": "yarn cypress:dw:serverless open",
     "cypress:dw:serverless:run": "yarn cypress:dw:serverless run",
     "cypress:dw:endpoint": "echo '\n** WARNING **: Run script `cypress:dw:endpoint` no longer valid! Use `cypress:dw` instead\n'",

x-pack/plugins/security_solution/public/management/cypress/cypress_base.config.ts

@@ -63,16 +63,8 @@ export const getCypressBaseConfig = (
         experimentalInteractiveRunEvents: true,
         setupNodeEvents: (on: Cypress.PluginEvents, config: Cypress.PluginConfigOptions) => {
           dataLoaders(on, config);
-
-          // skip dataLoadersForRealEndpoints() if running in serverless
-          // https://github.com/elastic/security-team/issues/7467
-          // Once we are able to run Fleet server in serverless mode (see: https://github.com/elastic/kibana/pull/166183)
-          // this `if()` statement needs to be removed and `dataLoadersForRealEndpoints()` should
-          // just be called without having any checks around it.
-          if (!config.env.IS_SERVERLESS) {
-            // Data loaders specific to "real" Endpoint testing
-            dataLoadersForRealEndpoints(on, config);
-          }
+          // Data loaders specific to "real" Endpoint testing
+          dataLoadersForRealEndpoints(on, config);
 
           responseActionTasks(on, config);
 

x-pack/plugins/security_solution/public/management/cypress/e2e/artifacts/artifacts_mocked_data.cy.ts

@@ -30,7 +30,7 @@ const loginWithoutAccess = (url: string) => {
   loadPage(url);
 };
 
-describe('Artifacts pages', { tags: '@ess' }, () => {
+describe('Artifacts pages', { tags: ['@ess', '@serverless', '@brokenInServerless'] }, () => {
   before(() => {
     login();
     loadEndpointDataForEventFiltersIfNeeded();

x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/form.cy.ts

@@ -18,7 +18,7 @@ import { cleanupRule, generateRandomStringName, loadRule } from '../../tasks/api
 import { RESPONSE_ACTION_TYPES } from '../../../../../common/api/detection_engine';
 import { login, ROLE } from '../../tasks/login';
 
-describe('Form', { tags: '@ess' }, () => {
+describe('Form', { tags: ['@ess', '@serverless', '@brokenInServerless'] }, () => {
   describe('User with no access can not create an endpoint response action', () => {
     before(() => {
       login(ROLE.endpoint_response_actions_no_access);

x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/history_log.cy.ts

@@ -12,79 +12,83 @@ import { indexEndpointRuleAlerts } from '../../tasks/index_endpoint_rule_alerts'
 
 import { login, ROLE } from '../../tasks/login';
 
-describe('Response actions history page', { tags: '@ess' }, () => {
-  let endpointData: ReturnTypeFromChainable<typeof indexEndpointHosts> | undefined;
-  let endpointDataWithAutomated: ReturnTypeFromChainable<typeof indexEndpointHosts> | undefined;
-  let alertData: ReturnTypeFromChainable<typeof indexEndpointRuleAlerts> | undefined;
-  const [endpointAgentId, endpointHostname] = generateRandomStringName(2);
+describe(
+  'Response actions history page',
+  { tags: ['@ess', '@serverless', '@brokenInServerless'] },
+  () => {
+    let endpointData: ReturnTypeFromChainable<typeof indexEndpointHosts> | undefined;
+    let endpointDataWithAutomated: ReturnTypeFromChainable<typeof indexEndpointHosts> | undefined;
+    let alertData: ReturnTypeFromChainable<typeof indexEndpointRuleAlerts> | undefined;
+    const [endpointAgentId, endpointHostname] = generateRandomStringName(2);
 
-  before(() => {
-    login(ROLE.endpoint_response_actions_access);
+    before(() => {
+      login(ROLE.endpoint_response_actions_access);
 
-    indexEndpointHosts({ numResponseActions: 2 }).then((indexEndpoints) => {
-      endpointData = indexEndpoints;
-    });
-    indexEndpointRuleAlerts({
-      endpointAgentId,
-      endpointHostname,
-      endpointIsolated: false,
-    }).then((indexedAlert) => {
-      alertData = indexedAlert;
-      const alertId = alertData.alerts[0]._id;
-      return indexEndpointHosts({
-        numResponseActions: 1,
-        alertIds: [alertId],
-      }).then((indexEndpoints) => {
-        endpointDataWithAutomated = indexEndpoints;
+      indexEndpointHosts({ numResponseActions: 2 }).then((indexEndpoints) => {
+        endpointData = indexEndpoints;
+      });
+      indexEndpointRuleAlerts({
+        endpointAgentId,
+        endpointHostname,
+        endpointIsolated: false,
+      }).then((indexedAlert) => {
+        alertData = indexedAlert;
+        const alertId = alertData.alerts[0]._id;
+        return indexEndpointHosts({
+          numResponseActions: 1,
+          alertIds: [alertId],
+        }).then((indexEndpoints) => {
+          endpointDataWithAutomated = indexEndpoints;
+        });
       });
     });
-  });
 
-  after(() => {
-    if (endpointDataWithAutomated) {
-      endpointDataWithAutomated.cleanup();
-      endpointDataWithAutomated = undefined;
-    }
-    if (endpointData) {
-      endpointData.cleanup();
-      endpointData = undefined;
-    }
+    after(() => {
+      if (endpointDataWithAutomated) {
+        endpointDataWithAutomated.cleanup();
+        endpointDataWithAutomated = undefined;
+      }
+      if (endpointData) {
+        endpointData.cleanup();
+        endpointData = undefined;
+      }
 
-    if (alertData) {
-      alertData.cleanup();
-      alertData = undefined;
-    }
-  });
+      if (alertData) {
+        alertData.cleanup();
+        alertData = undefined;
+      }
+    });
 
-  it('enable filtering by type', () => {
-    cy.visit(`/app/security/administration/response_actions_history`);
+    it('enable filtering by type', () => {
+      cy.visit(`/app/security/administration/response_actions_history`);
 
-    let maxLength: number;
-    cy.getByTestSubj('response-actions-list').then(($table) => {
-      maxLength = $table.find('tbody .euiTableRow').length;
-      cy.get('tbody .euiTableRow').should('have.lengthOf', maxLength);
-    });
+      let maxLength: number;
+      cy.getByTestSubj('response-actions-list').then(($table) => {
+        maxLength = $table.find('tbody .euiTableRow').length;
+        cy.get('tbody .euiTableRow').should('have.lengthOf', maxLength);
+      });
 
-    cy.getByTestSubj('response-actions-list-type-filter-popoverButton').click();
-    cy.getByTestSubj('type-filter-option').contains('Triggered by rule').click();
-    cy.getByTestSubj('response-actions-list').within(() => {
-      cy.get('tbody .euiTableRow').should('have.lengthOf', 1);
-      cy.get('tbody .euiTableRow').eq(0).contains('Triggered by rule');
-    });
-    cy.getByTestSubj('type-filter-option').contains('Triggered by rule').click();
-    cy.getByTestSubj('response-actions-list').within(() => {
-      cy.get('tbody .euiTableRow').should('have.lengthOf', maxLength);
-    });
-    cy.getByTestSubj('type-filter-option').contains('Triggered manually').click();
-    cy.getByTestSubj('response-actions-list').within(() => {
-      cy.get('tbody .euiTableRow').should('have.lengthOf', maxLength - 1);
-    });
-    cy.getByTestSubj('type-filter-option').contains('Triggered by rule').click();
-    cy.getByTestSubj('response-actions-list').within(() => {
-      cy.get('tbody .euiTableRow').should('have.lengthOf', maxLength);
-      cy.get('tbody .euiTableRow').eq(0).contains('Triggered by rule').click();
+      cy.getByTestSubj('response-actions-list-type-filter-popoverButton').click();
+      cy.getByTestSubj('type-filter-option').contains('Triggered by rule').click();
+      cy.getByTestSubj('response-actions-list').within(() => {
+        cy.get('tbody .euiTableRow').should('have.lengthOf', 1);
+        cy.get('tbody .euiTableRow').eq(0).contains('Triggered by rule');
+      });
+      cy.getByTestSubj('type-filter-option').contains('Triggered by rule').click();
+      cy.getByTestSubj('response-actions-list').within(() => {
+        cy.get('tbody .euiTableRow').should('have.lengthOf', maxLength);
+      });
+      cy.getByTestSubj('type-filter-option').contains('Triggered manually').click();
+      cy.getByTestSubj('response-actions-list').within(() => {
+        cy.get('tbody .euiTableRow').should('have.lengthOf', maxLength - 1);
+      });
+      cy.getByTestSubj('type-filter-option').contains('Triggered by rule').click();
+      cy.getByTestSubj('response-actions-list').within(() => {
+        cy.get('tbody .euiTableRow').should('have.lengthOf', maxLength);
+        cy.get('tbody .euiTableRow').eq(0).contains('Triggered by rule').click();
+      });
+      // check if we were moved to Rules app after clicking Triggered by rule
+      cy.getByTestSubj('breadcrumb last').contains('Detection rules (SIEM)');
     });
-    // check if we were moved to Rules app after clicking Triggered by rule
-    cy.getByTestSubj('breadcrumb last').contains('Detection rules (SIEM)');
-  });
-});
+  }
+);

x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/results.cy.ts

@@ -15,7 +15,7 @@ import { indexEndpointRuleAlerts } from '../../tasks/index_endpoint_rule_alerts'
 
 import { login, ROLE } from '../../tasks/login';
 
-describe('Results', { tags: '@ess' }, () => {
+describe('Results', { tags: ['@ess', '@serverless', '@brokenInServerless'] }, () => {
   let endpointData: ReturnTypeFromChainable<typeof indexEndpointHosts> | undefined;
   let alertData: ReturnTypeFromChainable<typeof indexEndpointRuleAlerts> | undefined;
   const [endpointAgentId, endpointHostname] = generateRandomStringName(2);

x-pack/plugins/security_solution/public/management/cypress/e2e/endpoint_list/endpoints.cy.ts

@@ -32,7 +32,7 @@ import { createEndpointHost } from '../../tasks/create_endpoint_host';
 import { deleteAllLoadedEndpointData } from '../../tasks/delete_all_endpoint_data';
 import { enableAllPolicyProtections } from '../../tasks/endpoint_policy';
 
-describe('Endpoints page', { tags: '@ess' }, () => {
+describe('Endpoints page', { tags: ['@ess', '@serverless', '@brokenInServerless'] }, () => {
   let indexedPolicy: IndexedFleetEndpointPolicyResponse;
   let policy: PolicyData;
   let createdHost: CreateAndEnrollEndpointHostResponse;