Skip to content

Commit 75b772d

Browse files
rjernstrjernst
authored
Share more entitlement IT setup (#120846)
This commit adds an AbstractEntitlementsIT and moves the entitlement cluster setup into a bespoke EntitlementTestRule. That allows most of the common code to be deduplicated. This change also automatically creates a temp dir which the test passes along into the test cluster.
1 parent 160bdab commit 75b772d

File tree

7 files changed

+170
-188
lines changed

7 files changed

+170
-188
lines changed

‎libs/entitlement/qa/src/javaRestTest/java/org/elasticsearch/entitlement/qa/AbstractEntitlementsIT.java‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the "Elastic License
4+
* 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
5+
* Public License v 1"; you may not use this file except in compliance with, at
6+
* your election, the "Elastic License 2.0", the "GNU Affero General Public
7+
* License v3.0 only", or the "Server Side Public License, v 1".
8+
*/
9+
10+
package org.elasticsearch.entitlement.qa;
11+
12+
import org.elasticsearch.client.Request;
13+
import org.elasticsearch.client.Response;
14+
import org.elasticsearch.test.rest.ESRestTestCase;
15+
16+
import java.io.IOException;
17+
import java.util.List;
18+
import java.util.Map;
19+
20+
import static org.hamcrest.Matchers.containsString;
21+
import static org.hamcrest.Matchers.equalTo;
22+
23+
public abstract class AbstractEntitlementsIT extends ESRestTestCase {
24+
25+
static final EntitlementsTestRule.PolicyBuilder ALLOWED_TEST_ENTITLEMENTS = (builder, tempDir) -> {
26+
builder.value("create_class_loader");
27+
builder.value("set_https_connection_properties");
28+
builder.value("inbound_network");
29+
builder.value("outbound_network");
30+
builder.value("load_native_libraries");
31+
builder.value(
32+
Map.of(
33+
"write_system_properties",
34+
Map.of("properties", List.of("es.entitlements.checkSetSystemProperty", "es.entitlements.checkClearSystemProperty"))
35+
)
36+
);
37+
};
38+
39+
private final String actionName;
40+
private final boolean expectAllowed;
41+
42+
AbstractEntitlementsIT(String actionName, boolean expectAllowed) {
43+
this.actionName = actionName;
44+
this.expectAllowed = expectAllowed;
45+
}
46+
47+
private Response executeCheck() throws IOException {
48+
var request = new Request("GET", "/_entitlement_check");
49+
request.addParameter("action", actionName);
50+
return client().performRequest(request);
51+
}
52+
53+
public void testAction() throws IOException {
54+
logger.info("Executing Entitlement test for [{}]", actionName);
55+
if (expectAllowed) {
56+
Response result = executeCheck();
57+
assertThat(result.getStatusLine().getStatusCode(), equalTo(200));
58+
} else {
59+
var exception = expectThrows(IOException.class, this::executeCheck);
60+
assertThat(exception.getMessage(), containsString("not_entitled_exception"));
61+
}
62+
}
63+
}

‎libs/entitlement/qa/src/javaRestTest/java/org/elasticsearch/entitlement/qa/EntitlementsAllowedIT.java‎

Lines changed: 4 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -12,31 +12,16 @@
1212
import com.carrotsearch.randomizedtesting.annotations.Name;
1313
import com.carrotsearch.randomizedtesting.annotations.ParametersFactory;
1414

15-
import org.elasticsearch.client.Request;
16-
import org.elasticsearch.client.Response;
1715
import org.elasticsearch.entitlement.qa.test.RestEntitlementsCheckAction;
18-
import org.elasticsearch.test.cluster.ElasticsearchCluster;
19-
import org.elasticsearch.test.rest.ESRestTestCase;
2016
import org.junit.ClassRule;
2117

22-
import java.io.IOException;
23-
24-
import static org.elasticsearch.entitlement.qa.EntitlementsUtil.ALLOWED_ENTITLEMENTS;
25-
import static org.hamcrest.Matchers.equalTo;
26-
27-
public class EntitlementsAllowedIT extends ESRestTestCase {
18+
public class EntitlementsAllowedIT extends AbstractEntitlementsIT {
2819

2920
@ClassRule
30-
public static ElasticsearchCluster cluster = ElasticsearchCluster.local()
31-
.module("entitlement-test-plugin", spec -> EntitlementsUtil.setupEntitlements(spec, true, ALLOWED_ENTITLEMENTS))
32-
.systemProperty("es.entitlements.enabled", "true")
33-
.setting("xpack.security.enabled", "false")
34-
.build();
35-
36-
private final String actionName;
21+
public static EntitlementsTestRule testRule = new EntitlementsTestRule(true, ALLOWED_TEST_ENTITLEMENTS);
3722

3823
public EntitlementsAllowedIT(@Name("actionName") String actionName) {
39-
this.actionName = actionName;
24+
super(actionName, true);
4025
}
4126

4227
@ParametersFactory
@@ -46,14 +31,6 @@ public static Iterable<Object[]> data() {
4631

4732
@Override
4833
protected String getTestRestCluster() {
49-
return cluster.getHttpAddresses();
50-
}
51-
52-
public void testCheckActionWithPolicyPass() throws IOException {
53-
logger.info("Executing Entitlement test for [{}]", actionName);
54-
var request = new Request("GET", "/_entitlement_check");
55-
request.addParameter("action", actionName);
56-
Response result = client().performRequest(request);
57-
assertThat(result.getStatusLine().getStatusCode(), equalTo(200));
34+
return testRule.cluster.getHttpAddresses();
5835
}
5936
}

‎libs/entitlement/qa/src/javaRestTest/java/org/elasticsearch/entitlement/qa/EntitlementsAllowedNonModularIT.java‎

Lines changed: 4 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -12,31 +12,16 @@
1212
import com.carrotsearch.randomizedtesting.annotations.Name;
1313
import com.carrotsearch.randomizedtesting.annotations.ParametersFactory;
1414

15-
import org.elasticsearch.client.Request;
16-
import org.elasticsearch.client.Response;
1715
import org.elasticsearch.entitlement.qa.test.RestEntitlementsCheckAction;
18-
import org.elasticsearch.test.cluster.ElasticsearchCluster;
19-
import org.elasticsearch.test.rest.ESRestTestCase;
2016
import org.junit.ClassRule;
2117

22-
import java.io.IOException;
23-
24-
import static org.elasticsearch.entitlement.qa.EntitlementsUtil.ALLOWED_ENTITLEMENTS;
25-
import static org.hamcrest.Matchers.equalTo;
26-
27-
public class EntitlementsAllowedNonModularIT extends ESRestTestCase {
18+
public class EntitlementsAllowedNonModularIT extends AbstractEntitlementsIT {
2819

2920
@ClassRule
30-
public static ElasticsearchCluster cluster = ElasticsearchCluster.local()
31-
.module("entitlement-test-plugin", spec -> EntitlementsUtil.setupEntitlements(spec, false, ALLOWED_ENTITLEMENTS))
32-
.systemProperty("es.entitlements.enabled", "true")
33-
.setting("xpack.security.enabled", "false")
34-
.build();
35-
36-
private final String actionName;
21+
public static EntitlementsTestRule testRule = new EntitlementsTestRule(false, ALLOWED_TEST_ENTITLEMENTS);
3722

3823
public EntitlementsAllowedNonModularIT(@Name("actionName") String actionName) {
39-
this.actionName = actionName;
24+
super(actionName, true);
4025
}
4126

4227
@ParametersFactory
@@ -46,14 +31,6 @@ public static Iterable<Object[]> data() {
4631

4732
@Override
4833
protected String getTestRestCluster() {
49-
return cluster.getHttpAddresses();
50-
}
51-
52-
public void testCheckActionWithPolicyPass() throws IOException {
53-
logger.info("Executing Entitlement test for [{}]", actionName);
54-
var request = new Request("GET", "/_entitlement_check");
55-
request.addParameter("action", actionName);
56-
Response result = client().performRequest(request);
57-
assertThat(result.getStatusLine().getStatusCode(), equalTo(200));
34+
return testRule.cluster.getHttpAddresses();
5835
}
5936
}

‎libs/entitlement/qa/src/javaRestTest/java/org/elasticsearch/entitlement/qa/EntitlementsDeniedIT.java‎

Lines changed: 6 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -12,50 +12,25 @@
1212
import com.carrotsearch.randomizedtesting.annotations.Name;
1313
import com.carrotsearch.randomizedtesting.annotations.ParametersFactory;
1414

15-
import org.elasticsearch.client.Request;
1615
import org.elasticsearch.entitlement.qa.test.RestEntitlementsCheckAction;
17-
import org.elasticsearch.test.cluster.ElasticsearchCluster;
18-
import org.elasticsearch.test.rest.ESRestTestCase;
1916
import org.junit.ClassRule;
2017

21-
import java.io.IOException;
22-
23-
import static org.hamcrest.Matchers.containsString;
24-
25-
public class EntitlementsDeniedIT extends ESRestTestCase {
18+
public class EntitlementsDeniedIT extends AbstractEntitlementsIT {
2619

2720
@ClassRule
28-
public static ElasticsearchCluster cluster = ElasticsearchCluster.local()
29-
.module("entitlement-test-plugin", spec -> EntitlementsUtil.setupEntitlements(spec, true, null))
30-
.systemProperty("es.entitlements.enabled", "true")
31-
.setting("xpack.security.enabled", "false")
32-
// Logs in libs/entitlement/qa/build/test-results/javaRestTest/TEST-org.elasticsearch.entitlement.qa.EntitlementsDeniedIT.xml
33-
// .setting("logger.org.elasticsearch.entitlement", "DEBUG")
34-
.build();
35-
36-
@Override
37-
protected String getTestRestCluster() {
38-
return cluster.getHttpAddresses();
39-
}
40-
41-
private final String actionName;
21+
public static EntitlementsTestRule testRule = new EntitlementsTestRule(true, null);
4222

4323
public EntitlementsDeniedIT(@Name("actionName") String actionName) {
44-
this.actionName = actionName;
24+
super(actionName, false);
4525
}
4626

4727
@ParametersFactory
4828
public static Iterable<Object[]> data() {
4929
return RestEntitlementsCheckAction.getAllCheckActions().stream().map(action -> new Object[] { action }).toList();
5030
}
5131

52-
public void testCheckThrows() {
53-
logger.info("Executing Entitlement test for [{}]", actionName);
54-
var exception = expectThrows(IOException.class, () -> {
55-
var request = new Request("GET", "/_entitlement_check");
56-
request.addParameter("action", actionName);
57-
client().performRequest(request);
58-
});
59-
assertThat(exception.getMessage(), containsString("not_entitled_exception"));
32+
@Override
33+
protected String getTestRestCluster() {
34+
return testRule.cluster.getHttpAddresses();
6035
}
6136
}

‎libs/entitlement/qa/src/javaRestTest/java/org/elasticsearch/entitlement/qa/EntitlementsDeniedNonModularIT.java‎

Lines changed: 6 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -12,50 +12,25 @@
1212
import com.carrotsearch.randomizedtesting.annotations.Name;
1313
import com.carrotsearch.randomizedtesting.annotations.ParametersFactory;
1414

15-
import org.elasticsearch.client.Request;
1615
import org.elasticsearch.entitlement.qa.test.RestEntitlementsCheckAction;
17-
import org.elasticsearch.test.cluster.ElasticsearchCluster;
18-
import org.elasticsearch.test.rest.ESRestTestCase;
1916
import org.junit.ClassRule;
2017

21-
import java.io.IOException;
22-
23-
import static org.hamcrest.Matchers.containsString;
24-
25-
public class EntitlementsDeniedNonModularIT extends ESRestTestCase {
18+
public class EntitlementsDeniedNonModularIT extends AbstractEntitlementsIT {
2619

2720
@ClassRule
28-
public static ElasticsearchCluster cluster = ElasticsearchCluster.local()
29-
.module("entitlement-test-plugin", spec -> EntitlementsUtil.setupEntitlements(spec, false, null))
30-
.systemProperty("es.entitlements.enabled", "true")
31-
.setting("xpack.security.enabled", "false")
32-
// Logs in libs/entitlement/qa/build/test-results/javaRestTest/TEST-org.elasticsearch.entitlement.qa.EntitlementsDeniedIT.xml
33-
// .setting("logger.org.elasticsearch.entitlement", "DEBUG")
34-
.build();
35-
36-
@Override
37-
protected String getTestRestCluster() {
38-
return cluster.getHttpAddresses();
39-
}
40-
41-
private final String actionName;
21+
public static EntitlementsTestRule testRule = new EntitlementsTestRule(false, null);
4222

4323
public EntitlementsDeniedNonModularIT(@Name("actionName") String actionName) {
44-
this.actionName = actionName;
24+
super(actionName, false);
4525
}
4626

4727
@ParametersFactory
4828
public static Iterable<Object[]> data() {
4929
return RestEntitlementsCheckAction.getAllCheckActions().stream().map(action -> new Object[] { action }).toList();
5030
}
5131

52-
public void testCheckThrows() {
53-
logger.info("Executing Entitlement test for [{}]", actionName);
54-
var exception = expectThrows(IOException.class, () -> {
55-
var request = new Request("GET", "/_entitlement_check");
56-
request.addParameter("action", actionName);
57-
client().performRequest(request);
58-
});
59-
assertThat(exception.getMessage(), containsString("not_entitled_exception"));
32+
@Override
33+
protected String getTestRestCluster() {
34+
return testRule.cluster.getHttpAddresses();
6035
}
6136
}

‎libs/entitlement/qa/src/javaRestTest/java/org/elasticsearch/entitlement/qa/EntitlementsTestRule.java‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the "Elastic License
4+
* 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
5+
* Public License v 1"; you may not use this file except in compliance with, at
6+
* your election, the "Elastic License 2.0", the "GNU Affero General Public
7+
* License v3.0 only", or the "Server Side Public License, v 1".
8+
*/
9+
10+
package org.elasticsearch.entitlement.qa;
11+
12+
import org.elasticsearch.common.Strings;
13+
import org.elasticsearch.test.cluster.ElasticsearchCluster;
14+
import org.elasticsearch.test.cluster.local.PluginInstallSpec;
15+
import org.elasticsearch.test.cluster.util.resource.Resource;
16+
import org.elasticsearch.xcontent.XContentBuilder;
17+
import org.elasticsearch.xcontent.yaml.YamlXContent;
18+
import org.junit.rules.RuleChain;
19+
import org.junit.rules.TemporaryFolder;
20+
import org.junit.rules.TestRule;
21+
import org.junit.runner.Description;
22+
import org.junit.runners.model.Statement;
23+
24+
import java.io.IOException;
25+
import java.io.UncheckedIOException;
26+
import java.nio.file.Path;
27+
28+
class EntitlementsTestRule implements TestRule {
29+
30+
interface PolicyBuilder {
31+
void build(XContentBuilder builder, Path tempDir) throws IOException;
32+
}
33+
34+
final TemporaryFolder testDir;
35+
final ElasticsearchCluster cluster;
36+
final TestRule ruleChain;
37+
38+
@SuppressWarnings("this-escape")
39+
EntitlementsTestRule(boolean modular, PolicyBuilder policyBuilder) {
40+
testDir = new TemporaryFolder();
41+
cluster = ElasticsearchCluster.local()
42+
.module("entitlement-test-plugin", spec -> setupEntitlements(spec, modular, policyBuilder))
43+
.systemProperty("es.entitlements.enabled", "true")
44+
.systemProperty("es.entitlements.testdir", () -> testDir.getRoot().getAbsolutePath())
45+
.setting("xpack.security.enabled", "false")
46+
.build();
47+
ruleChain = RuleChain.outerRule(testDir).around(cluster);
48+
}
49+
50+
@Override
51+
public Statement apply(Statement statement, Description description) {
52+
return ruleChain.apply(statement, description);
53+
}
54+
55+
private void setupEntitlements(PluginInstallSpec spec, boolean modular, PolicyBuilder policyBuilder) {
56+
String moduleName = modular ? "org.elasticsearch.entitlement.qa.test" : "ALL-UNNAMED";
57+
if (policyBuilder != null) {
58+
spec.withEntitlementsOverride(old -> {
59+
try {
60+
try (var builder = YamlXContent.contentBuilder()) {
61+
builder.startObject();
62+
builder.field(moduleName);
63+
builder.startArray();
64+
policyBuilder.build(builder, testDir.getRoot().toPath());
65+
builder.endArray();
66+
builder.endObject();
67+
68+
String policy = Strings.toString(builder);
69+
System.out.println("Using entitlement policy:\n" + policy);
70+
return Resource.fromString(policy);
71+
}
72+
73+
} catch (IOException e) {
74+
throw new UncheckedIOException(e);
75+
}
76+
});
77+
}
78+
79+
if (modular == false) {
80+
spec.withPropertiesOverride(old -> {
81+
String props = old.replace("modulename=org.elasticsearch.entitlement.qa.test", "");
82+
System.out.println("Using plugin properties:\n" + props);
83+
return Resource.fromString(props);
84+
});
85+
}
86+
}
87+
}

0 commit comments

Comments
 (0)