Skip to content

Reinstate S3SearchableSnapshotsCredentialsReloadIT in FIPS JVMs #126109

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Apr 4, 2025
Merged

Reinstate S3SearchableSnapshotsCredentialsReloadIT in FIPS JVMs #126109

Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
a346e27
Reinstate `S3SearchableSnapshotsCredentialsReloadIT` in FIPS JVMs
DaveCTurner Apr 2, 2025
61dd151
Merge branch 'main' into 2025/04/02/S3SearchableSnapshotsCredentialsR…
DaveCTurner Apr 2, 2025
e42e341
Reload with password
DaveCTurner Apr 3, 2025
9348400
Merge branch 'main' into 2025/04/02/S3SearchableSnapshotsCredentialsR…
DaveCTurner Apr 3, 2025
a45a04c
Merge branch 'main' into 2025/04/02/S3SearchableSnapshotsCredentialsR…
DaveCTurner Apr 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 5 additions & 11 deletions .../elasticsearch/xpack/searchablesnapshots/s3/S3SearchableSnapshotsCredentialsReloadIT.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,6 @@
import org.elasticsearch.test.rest.ObjectPath;
import org.elasticsearch.xcontent.XContentBuilder;
import org.elasticsearch.xcontent.XContentType;
import org.junit.Before;
import org.junit.ClassRule;
import org.junit.rules.RuleChain;
import org.junit.rules.TestRule;
Expand Down Expand Up @@ -75,11 +74,6 @@ protected String getTestRestCluster() {
return cluster.getHttpAddresses();
}

@Before
public void skipFips() {
assumeFalse("getting these tests to run in a FIPS JVM is kinda fiddly and we don't really need the extra coverage", inFipsJvm());
}

public void testReloadCredentialsFromKeystore() throws IOException {
final TestHarness testHarness = new TestHarness();
testHarness.putRepository();
Expand All @@ -88,7 +82,7 @@ public void testReloadCredentialsFromKeystore() throws IOException {
final String accessKey1 = randomIdentifier();
repositoryAccessKey = accessKey1;
keystoreSettings.put("s3.client.default.access_key", accessKey1);
keystoreSettings.put("s3.client.default.secret_key", randomIdentifier());
keystoreSettings.put("s3.client.default.secret_key", randomSecretKey());
cluster.updateStoredSecureSettings();
assertOK(client().performRequest(new Request("POST", "/_nodes/reload_secure_settings")));

Expand Down Expand Up @@ -128,9 +122,9 @@ public void testReloadCredentialsFromAlternativeClient() throws IOException {

repositoryAccessKey = accessKey1;
keystoreSettings.put("s3.client.default.access_key", accessKey1);
keystoreSettings.put("s3.client.default.secret_key", randomIdentifier());
keystoreSettings.put("s3.client.default.secret_key", randomSecretKey());
keystoreSettings.put("s3.client." + alternativeClient + ".access_key", accessKey2);
keystoreSettings.put("s3.client." + alternativeClient + ".secret_key", randomIdentifier());
keystoreSettings.put("s3.client." + alternativeClient + ".secret_key", randomSecretKey());
cluster.updateStoredSecureSettings();
assertOK(client().performRequest(new Request("POST", "/_nodes/reload_secure_settings")));
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reload call needs to provide keystore password when in FIPS mode similar to this.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah sorry for the noise I thought this had passed the FIPS tests when I asked for your review. Fixed that now.


Expand Down Expand Up @@ -164,7 +158,7 @@ public void testReloadCredentialsFromMetadata() throws IOException {
final String accessKey1 = randomIdentifier();
final String accessKey2 = randomValueOtherThan(accessKey1, ESTestCase::randomIdentifier);

testHarness.putRepository(b -> b.put("access_key", accessKey1).put("secret_key", randomIdentifier()));
testHarness.putRepository(b -> b.put("access_key", accessKey1).put("secret_key", randomSecretKey()));
repositoryAccessKey = accessKey1;

testHarness.createFrozenSearchableSnapshotIndex();
Expand All @@ -182,7 +176,7 @@ public void testReloadCredentialsFromMetadata() throws IOException {

// Adjust repository to use new client
logger.info("--> update repository metadata");
testHarness.putRepository(b -> b.put("access_key", accessKey2).put("secret_key", randomIdentifier()));
testHarness.putRepository(b -> b.put("access_key", accessKey2).put("secret_key", randomSecretKey()));

// Check access using refreshed credentials
logger.info("--> expect success");
Expand Down