Skip to content

[8.19] (backport #7804) [Integration Test] Ensure that upgrading a FIPS-capable Agent results in a FIPS-capable Agent #8491

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 3 commits into from
Jun 23, 2025
Merged

[8.19] (backport #7804) [Integration Test] Ensure that upgrading a FIPS-capable Agent results in a FIPS-capable Agent #8491

merged 3 commits into from
Jun 23, 2025

Conversation

@mergify
Copy link
Contributor

@mergify mergify bot commented Jun 13, 2025

What does this PR do?

This PR allows a FIPS-capable Agent to upgrade to another FIPS-capable Agent. It also adds an integration test, TestFleetManagedUpgradeUnprivilegedFIPS, to check that a Fleet-managed FIPS-capable unprivileged Agent will upgrade only to another FIPS-capable Agent.

Why is it important?

To preserve FIPS-compliance across upgrades.

Checklist

  • I have read and understood the pull request guidelines of this project.
  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in ./changelog/fragments using the changelog tool
  • I have added an integration test or an E2E test

Disruptive User Impact

None; this PR adds an integration test.

This is an automatic backport of pull request #7804 done by [Mergify](https://mergify.com).

@mergify mergify bot added backport conflicts There is a conflict in the backported pull request labels Jun 13, 2025
@mergify mergify bot requested a review from a team as a code owner June 13, 2025 17:51
@mergify mergify bot removed the request for review from a team June 13, 2025 17:51
@mergify mergify bot added the conflicts There is a conflict in the backported pull request label Jun 13, 2025
@mergify mergify bot requested review from michel-laterman and swiatekm June 13, 2025 17:51
@mergify mergify bot added the backport label Jun 13, 2025
@mergify
Copy link
Contributor Author

mergify bot commented Jun 13, 2025

Cherry-pick of ac9ee9a has failed:

On branch mergify/bp/8.19/pr-7804
Your branch is up to date with 'origin/8.19'.

You are currently cherry-picking commit ac9ee9a34.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	new file:   internal/pkg/agent/application/upgrade/artifact/artifact_test.go
	modified:   internal/pkg/agent/application/upgrade/step_unpack.go
	modified:   internal/pkg/agent/application/upgrade/step_unpack_test.go
	modified:   internal/pkg/agent/cmd/enroll_cmd.go
	modified:   pkg/control/v2/client/client.go
	modified:   pkg/testing/define/define.go
	modified:   pkg/testing/fetcher_local.go
	modified:   pkg/testing/fetcher_local_test.go
	modified:   pkg/testing/fixture.go
	modified:   pkg/version/version_parser.go
	modified:   pkg/version/version_parser_test.go
	modified:   testing/integration/beats_serverless_test.go
	modified:   testing/integration/upgrade_fleet_test.go
	modified:   testing/integration/upgrade_standalone_test.go
	modified:   testing/upgradetest/versions.go

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   internal/pkg/agent/application/upgrade/upgrade.go
	both modified:   testing/upgradetest/upgrader.go

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

@elasticmachine
Copy link
Collaborator

elasticmachine commented Jun 13, 2025

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

@mergify
Copy link
Contributor Author

mergify bot commented Jun 16, 2025

This pull request has not been merged yet. Could you please review and merge it @ycombinator? 🙏

@ycombinator ycombinator mentioned this pull request Jun 17, 2025
Merged
8 tasks
michel-laterman
michel-laterman reviewed Jun 17, 2025
View reviewed changes
ycombinator
ycombinator reviewed Jun 17, 2025
View reviewed changes
@mergify
Copy link
Contributor Author

mergify bot commented Jun 17, 2025

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b mergify/bp/8.19/pr-7804 upstream/mergify/bp/8.19/pr-7804
git merge upstream/8.19
git push upstream mergify/bp/8.19/pr-7804

@ycombinator
[Integration Test] Ensure that upgrading a FIPS-capable Agent results…
3b005e5 
… in a FIPS-capable Agent (#7804)

* Adding skeleton for FIPS-to-FIPS upgrade test

* Expose FIPS compliance in GRPC client Version call response

* Test upgrade from FIPS to FIPS artifact

* Change assert to require

* Add postWatcherSuccessHook to upgrade test

* Refactor standalone upgrade test to take upgradeOpts

* Fix up FIPS upgrade test to use postWatcherSuccessHook to test FIPS compliance of upgraded Agent

* Add version constraint to test

* s/compliant/capable/

* s/compliant/capable/

* Append -fips to artifact name if current release of Agent is FIPS-capable

* Enable FIPS-capable to FIPS-capable Agent upgrades

* Running mage fmt

* Adding test to ensure FIPS-capable Agent cannot be upgraded to non-FIPS-capable Agent

* Adding return value

* Fixing function calls

* Remove post-upgrade success hook since we expect upgrade to fail

* Add minimum FIPS version check for start version

* Simplify upgradeOpts initialization

* Add version equality comparison method

* Fix version checks in tests

* Refactor version check into own helper function

* Fixing args

* No need to pass testing.T

* Remove redundant test case

* Restrict FIPS integration tests to Linux

* Add Fleet-managed Agent FIPS upgrade test

* Remove integration test trying to upgrade FIPS to non-FIPS

* Fix type of argument

* Refactoring: extract common logic into helper function

* Remove old code

* Require no error

* Fixing syntax errors

* Define tests as needing a FIPS environment

* FIPS upgrade tests should only run on Linux

* FIPS upgrade tests should start with FIPS-capable version

* Fixing comment + skip message

* Fix syntax errors

* Removing TestStandaloneUpgradeFIPStoFIPS test

* Removing TestFleetManagedUpgradePrivilegedFIPS test

* Add back accidentally-deleted function

* Combine less and equal unit tests

* Hash replaceToken only if its non-empty

* Use startFixture

(cherry picked from commit ac9ee9a)
@ycombinator
Fixing conflicts
c24d3ea
@ycombinator ycombinator force-pushed the mergify/bp/8.19/pr-7804 branch from 86cadd6 to c24d3ea Compare June 17, 2025 23:49
ycombinator
ycombinator previously approved these changes Jun 17, 2025
View reviewed changes
@ycombinator ycombinator enabled auto-merge (squash) June 17, 2025 23:52
@elastic-sonarqube
Copy link

elastic-sonarqube bot commented Jun 18, 2025

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
80.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

@elasticmachine
Copy link
Collaborator

elasticmachine commented Jun 18, 2025 •
edited
Loading

💛 Build succeeded, but was flaky

Failed CI Steps

History

cc @ycombinator

@mergify
Copy link
Contributor Author

mergify bot commented Jun 23, 2025

This pull request has not been merged yet. Could you please review and merge it @ycombinator? 🙏

@ycombinator ycombinator merged commit 39ca58b into 8.19 Jun 23, 2025
19 checks passed
@ycombinator ycombinator deleted the mergify/bp/8.19/pr-7804 branch June 23, 2025 16:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@michel-laterman michel-laterman michel-laterman left review comments

@ycombinator ycombinator ycombinator approved these changes

@swiatekm swiatekm Awaiting requested review from swiatekm swiatekm is a code owner automatically assigned from elastic/elastic-agent-control-plane

+1 more reviewer

@kaanyalti kaanyalti kaanyalti left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

@ycombinator ycombinator

Labels

backport conflicts There is a conflict in the backported pull request skip-changelog Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team Testing

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@elasticmachine @ycombinator @kaanyalti @michel-laterman