[8.19] (backport #7804) [Integration Test] Ensure that upgrading a FIPS-capable Agent results in a FIPS-capable Agent #8491

mergify · 2025-06-13T17:51:09Z

What does this PR do?

This PR allows a FIPS-capable Agent to upgrade to another FIPS-capable Agent. It also adds an integration test, TestFleetManagedUpgradeUnprivilegedFIPS, to check that a Fleet-managed FIPS-capable unprivileged Agent will upgrade only to another FIPS-capable Agent.

Why is it important?

To preserve FIPS-compliance across upgrades.

Checklist

I have read and understood the pull request guidelines of this project.
My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
~~I have made corresponding changes to the documentation~~
~~I have made corresponding change to the default configuration files~~
~~I have added tests that prove my fix is effective or that my feature works~~
~~I have added an entry in ./changelog/fragments using the changelog tool~~
I have added an integration test or an E2E test

Disruptive User Impact

None; this PR adds an integration test.

This is an automatic backport of pull request #7804 done by [Mergify](https://mergify.com).

mergify · 2025-06-13T17:51:11Z

Cherry-pick of ac9ee9a has failed:

On branch mergify/bp/8.19/pr-7804
Your branch is up to date with 'origin/8.19'.

You are currently cherry-picking commit ac9ee9a34.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	new file:   internal/pkg/agent/application/upgrade/artifact/artifact_test.go
	modified:   internal/pkg/agent/application/upgrade/step_unpack.go
	modified:   internal/pkg/agent/application/upgrade/step_unpack_test.go
	modified:   internal/pkg/agent/cmd/enroll_cmd.go
	modified:   pkg/control/v2/client/client.go
	modified:   pkg/testing/define/define.go
	modified:   pkg/testing/fetcher_local.go
	modified:   pkg/testing/fetcher_local_test.go
	modified:   pkg/testing/fixture.go
	modified:   pkg/version/version_parser.go
	modified:   pkg/version/version_parser_test.go
	modified:   testing/integration/beats_serverless_test.go
	modified:   testing/integration/upgrade_fleet_test.go
	modified:   testing/integration/upgrade_standalone_test.go
	modified:   testing/upgradetest/versions.go

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   internal/pkg/agent/application/upgrade/upgrade.go
	both modified:   testing/upgradetest/upgrader.go

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

elasticmachine · 2025-06-13T17:51:22Z

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

mergify · 2025-06-16T04:04:53Z

This pull request has not been merged yet. Could you please review and merge it @ycombinator? 🙏

internal/pkg/agent/application/upgrade/upgrade.go

mergify · 2025-06-17T18:43:42Z

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b mergify/bp/8.19/pr-7804 upstream/mergify/bp/8.19/pr-7804
git merge upstream/8.19
git push upstream mergify/bp/8.19/pr-7804

… in a FIPS-capable Agent (#7804) * Adding skeleton for FIPS-to-FIPS upgrade test * Expose FIPS compliance in GRPC client Version call response * Test upgrade from FIPS to FIPS artifact * Change assert to require * Add postWatcherSuccessHook to upgrade test * Refactor standalone upgrade test to take upgradeOpts * Fix up FIPS upgrade test to use postWatcherSuccessHook to test FIPS compliance of upgraded Agent * Add version constraint to test * s/compliant/capable/ * s/compliant/capable/ * Append -fips to artifact name if current release of Agent is FIPS-capable * Enable FIPS-capable to FIPS-capable Agent upgrades * Running mage fmt * Adding test to ensure FIPS-capable Agent cannot be upgraded to non-FIPS-capable Agent * Adding return value * Fixing function calls * Remove post-upgrade success hook since we expect upgrade to fail * Add minimum FIPS version check for start version * Simplify upgradeOpts initialization * Add version equality comparison method * Fix version checks in tests * Refactor version check into own helper function * Fixing args * No need to pass testing.T * Remove redundant test case * Restrict FIPS integration tests to Linux * Add Fleet-managed Agent FIPS upgrade test * Remove integration test trying to upgrade FIPS to non-FIPS * Fix type of argument * Refactoring: extract common logic into helper function * Remove old code * Require no error * Fixing syntax errors * Define tests as needing a FIPS environment * FIPS upgrade tests should only run on Linux * FIPS upgrade tests should start with FIPS-capable version * Fixing comment + skip message * Fix syntax errors * Removing TestStandaloneUpgradeFIPStoFIPS test * Removing TestFleetManagedUpgradePrivilegedFIPS test * Add back accidentally-deleted function * Combine less and equal unit tests * Hash replaceToken only if its non-empty * Use startFixture (cherry picked from commit ac9ee9a)

elastic-sonarqube · 2025-06-18T05:35:36Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
80.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

elasticmachine · 2025-06-18T06:08:01Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 7a1d059

Failed CI Steps

History

💔 Build #22657 failed c24d3ea
💔 Build #22616 failed 86cadd6
💔 Build #22400 failed ceac017

cc @ycombinator

mergify · 2025-06-23T04:03:23Z

This pull request has not been merged yet. Could you please review and merge it @ycombinator? 🙏

mergify bot added backport conflicts There is a conflict in the backported pull request labels Jun 13, 2025

mergify bot requested a review from a team as a code owner June 13, 2025 17:51

mergify bot removed the request for review from a team June 13, 2025 17:51

mergify bot added the conflicts There is a conflict in the backported pull request label Jun 13, 2025

mergify bot requested review from michel-laterman and swiatekm June 13, 2025 17:51

mergify bot added the backport label Jun 13, 2025

mergify bot assigned ycombinator Jun 13, 2025

github-actions bot added Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team skip-changelog Testing labels Jun 13, 2025

ycombinator mentioned this pull request Jun 17, 2025

[Integration Test] Ensure that upgrading a FIPS-capable Agent results in a FIPS-capable Agent #7804

Merged

8 tasks

michel-laterman reviewed Jun 17, 2025

View reviewed changes

internal/pkg/agent/application/upgrade/upgrade.go Outdated Show resolved Hide resolved

ycombinator reviewed Jun 17, 2025

View reviewed changes

internal/pkg/agent/application/upgrade/upgrade.go Show resolved Hide resolved

ycombinator added 2 commits June 17, 2025 16:49

Fixing conflicts

c24d3ea

ycombinator force-pushed the mergify/bp/8.19/pr-7804 branch from 86cadd6 to c24d3ea Compare June 17, 2025 23:49

ycombinator previously approved these changes Jun 17, 2025

View reviewed changes

ycombinator enabled auto-merge (squash) June 17, 2025 23:52

Add missing constant

7a1d059

ycombinator dismissed their stale review via 7a1d059 June 18, 2025 04:34

ycombinator approved these changes Jun 23, 2025

View reviewed changes

ycombinator merged commit 39ca58b into 8.19 Jun 23, 2025
19 checks passed

ycombinator deleted the mergify/bp/8.19/pr-7804 branch June 23, 2025 16:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[8.19] (backport #7804) [Integration Test] Ensure that upgrading a FIPS-capable Agent results in a FIPS-capable Agent #8491

[8.19] (backport #7804) [Integration Test] Ensure that upgrading a FIPS-capable Agent results in a FIPS-capable Agent #8491

Uh oh!

mergify bot commented Jun 13, 2025

Uh oh!

mergify bot commented Jun 13, 2025

Uh oh!

elasticmachine commented Jun 13, 2025

Uh oh!

mergify bot commented Jun 16, 2025

Uh oh!

Uh oh!

Uh oh!

mergify bot commented Jun 17, 2025

Uh oh!

elastic-sonarqube bot commented Jun 18, 2025

Uh oh!

elasticmachine commented Jun 18, 2025 •

edited

Loading

Uh oh!

mergify bot commented Jun 23, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

[8.19] (backport #7804) [Integration Test] Ensure that upgrading a FIPS-capable Agent results in a FIPS-capable Agent #8491

[8.19] (backport #7804) [Integration Test] Ensure that upgrading a FIPS-capable Agent results in a FIPS-capable Agent #8491

Uh oh!

Conversation

mergify bot commented Jun 13, 2025

What does this PR do?

Why is it important?

Checklist

Disruptive User Impact

Uh oh!

mergify bot commented Jun 13, 2025

Uh oh!

elasticmachine commented Jun 13, 2025

Uh oh!

mergify bot commented Jun 16, 2025

Uh oh!

Uh oh!

Uh oh!

mergify bot commented Jun 17, 2025

Uh oh!

elastic-sonarqube bot commented Jun 18, 2025

Quality Gate passed

Uh oh!

elasticmachine commented Jun 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💛 Build succeeded, but was flaky

Failed CI Steps

History

Uh oh!

mergify bot commented Jun 23, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

elasticmachine commented Jun 18, 2025 •

edited

Loading