Skip to content

Reinstate S3SearchableSnapshotsCredentialsReloadIT in FIPS JVMs #126324

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Apr 4, 2025
Merged

Reinstate S3SearchableSnapshotsCredentialsReloadIT in FIPS JVMs #126324

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5eb7c37
Reinstate `S3SearchableSnapshotsCredentialsReloadIT` in FIPS JVMs
DaveCTurner Apr 4, 2025
cd592f5
CI poke
DaveCTurner Apr 4, 2025
006548b
Merge branch '8.x' into 2025/04/04/backport-126109-S3SearchableSnapsh…
DaveCTurner Apr 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 0 additions & 9 deletions ...aRestTest/java/org/elasticsearch/repositories/s3/RepositoryS3RestReloadCredentialsIT.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@
package org.elasticsearch.repositories.s3;

import fixture.s3.S3HttpFixture;
import io.netty.handler.codec.http.HttpMethod;

import org.elasticsearch.client.Request;
import org.elasticsearch.client.ResponseException;
Expand Down Expand Up @@ -106,12 +105,4 @@ public void testReloadCredentialsFromKeystore() throws IOException {
// Check access using refreshed credentials
assertOK(client().performRequest(verifyRequest));
}

private Request createReloadSecureSettingsRequest() throws IOException {
return newXContentRequest(
HttpMethod.POST,
"/_nodes/reload_secure_settings",
(b, p) -> inFipsJvm() ? b.field("secure_settings_password", "keystore-password") : b
);
}
}
17 changes: 17 additions & 0 deletions test/framework/src/main/java/org/elasticsearch/test/rest/ESRestTestCase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2705,4 +2705,21 @@ protected static void assertResultMap(
) {
assertMap(result, mapMatcher.entry("columns", columnMatcher).entry("values", valuesMatcher));
}

public static final String FIPS_KEYSTORE_PASSWORD = "keystore-password";

/**
* @return a REST {@link Request} which will reload the keystore in the test cluster.
*/
protected final Request createReloadSecureSettingsRequest() {
try {
return newXContentRequest(
HttpMethod.POST,
"/_nodes/reload_secure_settings",
(b, p) -> inFipsJvm() ? b.field("secure_settings_password", FIPS_KEYSTORE_PASSWORD) : b
);
} catch (IOException e) {
throw new AssertionError("impossible", e);
}
}
}
22 changes: 8 additions & 14 deletions .../elasticsearch/xpack/searchablesnapshots/s3/S3SearchableSnapshotsCredentialsReloadIT.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,6 @@
import org.elasticsearch.test.rest.ObjectPath;
import org.elasticsearch.xcontent.XContentBuilder;
import org.elasticsearch.xcontent.XContentType;
import org.junit.Before;
import org.junit.ClassRule;
import org.junit.rules.RuleChain;
import org.junit.rules.TestRule;
Expand Down Expand Up @@ -76,11 +75,6 @@ protected String getTestRestCluster() {
return cluster.getHttpAddresses();
}

@Before
public void skipFips() {
assumeFalse("getting these tests to run in a FIPS JVM is kinda fiddly and we don't really need the extra coverage", inFipsJvm());
}

public void testReloadCredentialsFromKeystore() throws IOException {
final TestHarness testHarness = new TestHarness();
testHarness.putRepository();
Expand All @@ -89,9 +83,9 @@ public void testReloadCredentialsFromKeystore() throws IOException {
final String accessKey1 = randomIdentifier();
repositoryAccessKey = accessKey1;
keystoreSettings.put("s3.client.default.access_key", accessKey1);
keystoreSettings.put("s3.client.default.secret_key", randomIdentifier());
keystoreSettings.put("s3.client.default.secret_key", randomSecretKey());
cluster.updateStoredSecureSettings();
assertOK(client().performRequest(new Request("POST", "/_nodes/reload_secure_settings")));
assertOK(client().performRequest(createReloadSecureSettingsRequest()));

testHarness.createFrozenSearchableSnapshotIndex();

Expand All @@ -111,7 +105,7 @@ public void testReloadCredentialsFromKeystore() throws IOException {
logger.info("--> update keystore contents");
keystoreSettings.put("s3.client.default.access_key", accessKey2);
cluster.updateStoredSecureSettings();
assertOK(client().performRequest(new Request("POST", "/_nodes/reload_secure_settings")));
assertOK(client().performRequest(createReloadSecureSettingsRequest()));

// Check access using refreshed credentials
logger.info("--> expect success");
Expand All @@ -129,11 +123,11 @@ public void testReloadCredentialsFromAlternativeClient() throws IOException {

repositoryAccessKey = accessKey1;
keystoreSettings.put("s3.client.default.access_key", accessKey1);
keystoreSettings.put("s3.client.default.secret_key", randomIdentifier());
keystoreSettings.put("s3.client.default.secret_key", randomSecretKey());
keystoreSettings.put("s3.client." + alternativeClient + ".access_key", accessKey2);
keystoreSettings.put("s3.client." + alternativeClient + ".secret_key", randomIdentifier());
keystoreSettings.put("s3.client." + alternativeClient + ".secret_key", randomSecretKey());
cluster.updateStoredSecureSettings();
assertOK(client().performRequest(new Request("POST", "/_nodes/reload_secure_settings")));
assertOK(client().performRequest(createReloadSecureSettingsRequest()));

testHarness.createFrozenSearchableSnapshotIndex();

Expand Down Expand Up @@ -165,7 +159,7 @@ public void testReloadCredentialsFromMetadata() throws IOException {
final String accessKey1 = randomIdentifier();
final String accessKey2 = randomValueOtherThan(accessKey1, ESTestCase::randomIdentifier);

testHarness.putRepository(b -> b.put("access_key", accessKey1).put("secret_key", randomIdentifier()));
testHarness.putRepository(b -> b.put("access_key", accessKey1).put("secret_key", randomSecretKey()));
repositoryAccessKey = accessKey1;

testHarness.createFrozenSearchableSnapshotIndex();
Expand All @@ -183,7 +177,7 @@ public void testReloadCredentialsFromMetadata() throws IOException {

// Adjust repository to use new client
logger.info("--> update repository metadata");
testHarness.putRepository(b -> b.put("access_key", accessKey2).put("secret_key", randomIdentifier()));
testHarness.putRepository(b -> b.put("access_key", accessKey2).put("secret_key", randomSecretKey()));

// Check access using refreshed credentials
logger.info("--> expect success");
Expand Down