From 3ddaa74ae574221b3d2490f41491b7081d213078 Mon Sep 17 00:00:00 2001 From: AWSHurneyt Date: Mon, 2 Mar 2026 17:30:27 -0800 Subject: [PATCH 1/5] Add user to stashed context when sending alert notification messages. (#2027) Signed-off-by: Thomas Hurney (cherry picked from commit 528dcabcc853b931c5bed275f9024c3e967dfd9c) Signed-off-by: Thomas Hurney --- .../main/kotlin/org/opensearch/alerting/MonitorRunner.kt | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/alerting/src/main/kotlin/org/opensearch/alerting/MonitorRunner.kt b/alerting/src/main/kotlin/org/opensearch/alerting/MonitorRunner.kt index c88c77a77..2b63dfc64 100644 --- a/alerting/src/main/kotlin/org/opensearch/alerting/MonitorRunner.kt +++ b/alerting/src/main/kotlin/org/opensearch/alerting/MonitorRunner.kt @@ -23,6 +23,7 @@ import org.opensearch.alerting.util.destinationmigration.sendNotification import org.opensearch.alerting.util.isAllowed import org.opensearch.alerting.util.isTestAction import org.opensearch.client.node.NodeClient +import org.opensearch.commons.ConfigConstants import org.opensearch.commons.alerting.model.ActionRunResult import org.opensearch.commons.alerting.model.Monitor import org.opensearch.commons.alerting.model.MonitorRunResult @@ -68,7 +69,10 @@ abstract class MonitorRunner { } if (!dryrun) { val client = monitorCtx.client - client!!.threadPool().threadContext.stashContext().use { + val userStr = client!!.threadPool().threadContext + .getTransient(ConfigConstants.OPENSEARCH_SECURITY_USER_INFO_THREAD_CONTEXT) + client.threadPool().threadContext.stashContext().use { + client.threadPool().threadContext.putTransient(ConfigConstants.OPENSEARCH_SECURITY_USER_INFO_THREAD_CONTEXT, userStr) withClosableContext( InjectorContextElement( monitor.id, From 0f0306e4e6be0679dc7ee8573f0521deba0f2689 Mon Sep 17 00:00:00 2001 From: Thomas Hurney Date: Mon, 2 Mar 2026 20:27:22 -0800 Subject: [PATCH 2/5] Increase wait for cluster to start. Signed-off-by: Thomas Hurney --- .github/workflows/security-test-workflow.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security-test-workflow.yml b/.github/workflows/security-test-workflow.yml index b341af0ac..3b1febc06 100644 --- a/.github/workflows/security-test-workflow.yml +++ b/.github/workflows/security-test-workflow.yml @@ -75,7 +75,7 @@ jobs: run: | cd .. docker run -p 9200:9200 -d -p 9600:9600 -e "OPENSEARCH_INITIAL_ADMIN_PASSWORD=myStrongPassword123!" -e "discovery.type=single-node" opensearch-alerting:test - sleep 120 + sleep 300 - name: Run Alerting Test for security enabled test cases if: env.imagePresent == 'true' From 3734dd8f88c66281ea8dfef4c56731c0961ac426 Mon Sep 17 00:00:00 2001 From: Thomas Hurney Date: Mon, 2 Mar 2026 20:53:37 -0800 Subject: [PATCH 3/5] Troubleshooting github workflow failure. Signed-off-by: Thomas Hurney --- .github/workflows/security-test-workflow.yml | 39 +++++++++++++++++++- 1 file changed, 37 insertions(+), 2 deletions(-) diff --git a/.github/workflows/security-test-workflow.yml b/.github/workflows/security-test-workflow.yml index 3b1febc06..bdfbb6aba 100644 --- a/.github/workflows/security-test-workflow.yml +++ b/.github/workflows/security-test-workflow.yml @@ -74,12 +74,47 @@ jobs: if: env.imagePresent == 'true' run: | cd .. - docker run -p 9200:9200 -d -p 9600:9600 -e "OPENSEARCH_INITIAL_ADMIN_PASSWORD=myStrongPassword123!" -e "discovery.type=single-node" opensearch-alerting:test - sleep 300 + CONTAINER_ID=$(docker run -p 9200:9200 -d -p 9600:9600 -e "OPENSEARCH_INITIAL_ADMIN_PASSWORD=myStrongPassword123!" -e "discovery.type=single-node" opensearch-alerting:test) + echo "Started container: $CONTAINER_ID" + echo "CONTAINER_ID=$CONTAINER_ID" >> $GITHUB_ENV + + # Wait and check container status periodically + for i in {1..30}; do + sleep 10 + if docker ps | grep -q $CONTAINER_ID; then + echo "[$i/30] Container is running..." + # Try to connect + if curl -s -XGET https://localhost:9200/_cluster/health -u admin:myStrongPassword123! --insecure > /dev/null 2>&1; then + echo "OpenSearch is ready!" + break + fi + else + echo "Container exited! Logs:" + docker logs $CONTAINER_ID + exit 1 + fi + done + + # Final check + if ! docker ps | grep -q $CONTAINER_ID; then + echo "Container is not running after 5 minutes. Logs:" + docker logs $CONTAINER_ID + exit 1 + fi + + echo "Container status:" + docker ps | grep $CONTAINER_ID - name: Run Alerting Test for security enabled test cases if: env.imagePresent == 'true' run: | + echo "Checking OpenSearch status..." + curl -XGET https://localhost:9200/_cat/plugins -u admin:myStrongPassword123! --insecure || { + echo "Failed to connect to OpenSearch. Container logs:" + docker logs $CONTAINER_ID + exit 1 + } + cluster_running=`curl -XGET https://localhost:9200/_cat/plugins -u admin:myStrongPassword123! --insecure` echo $cluster_running security=`curl -XGET https://localhost:9200/_cat/plugins -u admin:myStrongPassword123! --insecure |grep opensearch-security|wc -l` From bee6e0e8ebd078274d5beff06154d0082eee1af8 Mon Sep 17 00:00:00 2001 From: Thomas Hurney Date: Mon, 2 Mar 2026 21:09:18 -0800 Subject: [PATCH 4/5] Revert "Troubleshooting github workflow failure." This reverts commit a3aabf78b5033a618195ae682745ad88164f6686. Signed-off-by: Thomas Hurney --- .github/workflows/security-test-workflow.yml | 39 +------------------- 1 file changed, 2 insertions(+), 37 deletions(-) diff --git a/.github/workflows/security-test-workflow.yml b/.github/workflows/security-test-workflow.yml index bdfbb6aba..3b1febc06 100644 --- a/.github/workflows/security-test-workflow.yml +++ b/.github/workflows/security-test-workflow.yml @@ -74,47 +74,12 @@ jobs: if: env.imagePresent == 'true' run: | cd .. - CONTAINER_ID=$(docker run -p 9200:9200 -d -p 9600:9600 -e "OPENSEARCH_INITIAL_ADMIN_PASSWORD=myStrongPassword123!" -e "discovery.type=single-node" opensearch-alerting:test) - echo "Started container: $CONTAINER_ID" - echo "CONTAINER_ID=$CONTAINER_ID" >> $GITHUB_ENV - - # Wait and check container status periodically - for i in {1..30}; do - sleep 10 - if docker ps | grep -q $CONTAINER_ID; then - echo "[$i/30] Container is running..." - # Try to connect - if curl -s -XGET https://localhost:9200/_cluster/health -u admin:myStrongPassword123! --insecure > /dev/null 2>&1; then - echo "OpenSearch is ready!" - break - fi - else - echo "Container exited! Logs:" - docker logs $CONTAINER_ID - exit 1 - fi - done - - # Final check - if ! docker ps | grep -q $CONTAINER_ID; then - echo "Container is not running after 5 minutes. Logs:" - docker logs $CONTAINER_ID - exit 1 - fi - - echo "Container status:" - docker ps | grep $CONTAINER_ID + docker run -p 9200:9200 -d -p 9600:9600 -e "OPENSEARCH_INITIAL_ADMIN_PASSWORD=myStrongPassword123!" -e "discovery.type=single-node" opensearch-alerting:test + sleep 300 - name: Run Alerting Test for security enabled test cases if: env.imagePresent == 'true' run: | - echo "Checking OpenSearch status..." - curl -XGET https://localhost:9200/_cat/plugins -u admin:myStrongPassword123! --insecure || { - echo "Failed to connect to OpenSearch. Container logs:" - docker logs $CONTAINER_ID - exit 1 - } - cluster_running=`curl -XGET https://localhost:9200/_cat/plugins -u admin:myStrongPassword123! --insecure` echo $cluster_running security=`curl -XGET https://localhost:9200/_cat/plugins -u admin:myStrongPassword123! --insecure |grep opensearch-security|wc -l` From 0f3f59e5afbb8051cc744730a2edc39d5c2ecd1c Mon Sep 17 00:00:00 2001 From: Thomas Hurney Date: Mon, 2 Mar 2026 21:09:18 -0800 Subject: [PATCH 5/5] Revert "Increase wait for cluster to start." This reverts commit 84354de362b8276a0a349f25de13259b97381c82. Signed-off-by: Thomas Hurney --- .github/workflows/security-test-workflow.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security-test-workflow.yml b/.github/workflows/security-test-workflow.yml index 3b1febc06..b341af0ac 100644 --- a/.github/workflows/security-test-workflow.yml +++ b/.github/workflows/security-test-workflow.yml @@ -75,7 +75,7 @@ jobs: run: | cd .. docker run -p 9200:9200 -d -p 9600:9600 -e "OPENSEARCH_INITIAL_ADMIN_PASSWORD=myStrongPassword123!" -e "discovery.type=single-node" opensearch-alerting:test - sleep 300 + sleep 120 - name: Run Alerting Test for security enabled test cases if: env.imagePresent == 'true'