Fully initialize policy checker before instrumenting #128703
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Entitlement instrumentation works by reflectively calling back into the entitlements lib to grab the checker. It must be fully in place before any classes are instrumented. This commit fixes a bug that was introduced by refactoring which caused the checker to not be set until after all classes were instrumented. In some situations this could lead the checker to being null when it is grab (and statically cached) by the entitlement bridge.
rjernst
added
>non-issue
auto-backport
Collaborator
|
Pinging @elastic/es-core-infra (Team:Core/Infra) |
jdconrad
approved these changes
May 30, 2025
| - class: org.elasticsearch.xpack.esql.expression.function.scalar.string.WildcardLikeTests | ||
| method: testEvaluateInManyThreads {TestCase=100 random code points matches self case insensitive with text} | ||
| issue: https://github.com/elastic/elasticsearch/issues/128677 | ||
| - class: org.elasticsearch.test.apmintegration.MetricsApmIT |
Contributor
There was a problem hiding this comment.
There's also TraceApmIT that needs to be unmuted.
prdoyle
approved these changes
May 30, 2025
| checker = initChecker(inst, createPolicyManager()); | ||
| // the checker _MUST_ be set before _any_ instrumentation is done | ||
| checker = initChecker(createPolicyManager()); | ||
| initInstrumentation(inst); |
Contributor
There was a problem hiding this comment.
Oh that is subtle. I had to look at it for a while.
Contributor
There was a problem hiding this comment.
The way you've written this is much more clear and robust: initialize the checker, then fire up the instrumentation.
Collaborator
💔 Backport failed
You can use sqren/backport to manually backport by running |
rjernst
added a commit
to rjernst/elasticsearch
that referenced
this pull request
May 31, 2025
Entitlement instrumentation works by reflectively calling back into the entitlements lib to grab the checker. It must be fully in place before any classes are instrumented. This commit fixes a bug that was introduced by refactoring which caused the checker to not be set until after all classes were instrumented. In some situations this could lead the checker to being null when it is grab (and statically cached) by the entitlement bridge.
elasticsearchmachine
pushed a commit
that referenced
this pull request
May 31, 2025
Entitlement instrumentation works by reflectively calling back into the entitlements lib to grab the checker. It must be fully in place before any classes are instrumented. This commit fixes a bug that was introduced by refactoring which caused the checker to not be set until after all classes were instrumented. In some situations this could lead the checker to being null when it is grab (and statically cached) by the entitlement bridge.
This was referenced Jun 2, 2025
mridula-s109
pushed a commit
that referenced
this pull request
Jun 2, 2025
Entitlement instrumentation works by reflectively calling back into the entitlements lib to grab the checker. It must be fully in place before any classes are instrumented. This commit fixes a bug that was introduced by refactoring which caused the checker to not be set until after all classes were instrumented. In some situations this could lead the checker to being null when it is grab (and statically cached) by the entitlement bridge.
mridula-s109
pushed a commit
to mridula-s109/elasticsearch
that referenced
this pull request
Jun 3, 2025
Entitlement instrumentation works by reflectively calling back into the entitlements lib to grab the checker. It must be fully in place before any classes are instrumented. This commit fixes a bug that was introduced by refactoring which caused the checker to not be set until after all classes were instrumented. In some situations this could lead the checker to being null when it is grab (and statically cached) by the entitlement bridge.
joshua-adams-1
pushed a commit
to joshua-adams-1/elasticsearch
that referenced
this pull request
Jun 3, 2025
Entitlement instrumentation works by reflectively calling back into the entitlements lib to grab the checker. It must be fully in place before any classes are instrumented. This commit fixes a bug that was introduced by refactoring which caused the checker to not be set until after all classes were instrumented. In some situations this could lead the checker to being null when it is grab (and statically cached) by the entitlement bridge.
Samiul-TheSoccerFan
pushed a commit
to Samiul-TheSoccerFan/elasticsearch
that referenced
this pull request
Jun 5, 2025
Entitlement instrumentation works by reflectively calling back into the entitlements lib to grab the checker. It must be fully in place before any classes are instrumented. This commit fixes a bug that was introduced by refactoring which caused the checker to not be set until after all classes were instrumented. In some situations this could lead the checker to being null when it is grab (and statically cached) by the entitlement bridge.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Entitlement instrumentation works by reflectively calling back into the entitlements lib to grab the checker. It must be fully in place before any classes are instrumented. This commit fixes a bug that was introduced by refactoring which caused the checker to not be set until after all classes were instrumented. In some situations this could lead the checker to being null when it is grabbed (and statically cached) by the entitlement bridge.