[Failure Store] Test API keys and skip_unavailable with RCS1 #125782

slobodanadamovic · 2025-03-27T15:03:11Z

Adjust existing RCS1 tests to randomize using API keys for authorization
and skip_unavailable setting.

Followup on #125252

…nt-using-selectors-for-ccs-ccr

Adjust existing RCS1 tests to randomize using API keys for authorization and `skip_unavailable` setting.

…ccs-with-api-keys # Conflicts: # x-pack/plugin/security/qa/multi-cluster/src/javaRestTest/java/org/elasticsearch/xpack/remotecluster/AbstractRemoteClusterSecurityFailureStoreRestIT.java # x-pack/plugin/security/qa/multi-cluster/src/javaRestTest/java/org/elasticsearch/xpack/remotecluster/RemoteClusterSecurityRCS1FailureStoreRestIT.java

slobodanadamovic · 2025-03-28T08:26:15Z

.../java/org/elasticsearch/xpack/remotecluster/RemoteClusterSecurityRCS1FailureStoreRestIT.java

    public void testRCS1CrossClusterSearch() throws Exception {
        final boolean rcs1Security = true;
        final boolean isProxyMode = randomBoolean();
-        final boolean skipUnavailable = false; // we want to get actual failures and not skip and get empty results
+        final boolean skipUnavailable = randomBoolean();


Addressing this suggestion: https://github.com/elastic/elasticsearch/pull/125252/files#r2010058827

The result does come empty, but it also contains failure reason per remote cluster. Which is what I'm asserting on.

slobodanadamovic · 2025-03-28T08:50:47Z

.../java/org/elasticsearch/xpack/remotecluster/RemoteClusterSecurityRCS1FailureStoreRestIT.java

-        assertOK(client().performRequest(indexDocRequest));
-    }
-
-    private static void setupUserAndRoleOnQueryCluster() throws IOException {


These changes are mostly refactorings in order to reuse the role definitions when creating API keys.

slobodanadamovic · 2025-03-28T08:56:22Z

.../java/org/elasticsearch/xpack/remotecluster/RemoteClusterSecurityRCS1FailureStoreRestIT.java

+              "names": ["local_index"],
+              "privileges": ["read"]
+            },
+            {


The roles on query cluster now include index privileges which were previously only defined on fulfilling cluster. This is needed, because API keys are created on query cluster for each user. Without this, API keys would be useless as they would not have any privilege to access, because their roles are limited-by owning user's privileges.

elasticsearchmachine · 2025-03-28T09:24:19Z

Pinging @elastic/es-security (Team:Security)

n1v0lg

LGTM

…#125782) Adjust existing RCS1 tests to randomize using API keys for authorization and `skip_unavailable` setting. Followup on elastic#125252

elasticsearchmachine · 2025-04-09T18:30:16Z

💚 Backport successful

Status	Branch	Result
✅	8.x

#126555) Adjust existing RCS1 tests to randomize using API keys for authorization and `skip_unavailable` setting. Followup on #125252

slobodanadamovic and others added 30 commits March 19, 2025 06:49

Prevent usage of :: selectors for remote cluster requests

2bc0e99

fail only if ::failures selector is used

fc2271c

cleanup and extend existing rest IT

ba976a9

Merge branch 'main' into sa-prevent-using-selectors-for-ccs-ccr

f6c96e2

test ccs with rcs1

5bc46b5

nit

e92ffde

remove remote_indices - not relevant for RCS1 test case

29de669

test CCS with RCS2

eaf9a01

Merge branch 'main' of github.com:elastic/elasticsearch into sa-preve…

41da2e6

…nt-using-selectors-for-ccs-ccr

cleanup tests, handle edge cases with ccs_minimize_roundtrips

4e366ed

Merge branch 'main' of github.com:elastic/elasticsearch into sa-preve…

542aa54

…nt-using-selectors-for-ccs-ccr

more test users

816d919

fix assertion

7dc89d4

test direct access to backing failure index for other users

26e8ae3

fix assertion

9c3d0d7

fix another assertion

e8a4b96

Merge branch 'main' of github.com:elastic/elasticsearch into sa-preve…

6c8eee8

…nt-using-selectors-for-ccs-ccr

bring back selector validation inline

6d5293f

refactor to reuse selector validation

fd1a0e5

Merge branch 'main' of github.com:elastic/elasticsearch into sa-preve…

c88a35f

…nt-using-selectors-for-ccs-ccr

more tests

1bd03a6

more tests 2

0dd4053

more test coverage

f085835

Merge branch 'main' of github.com:elastic/elasticsearch into sa-preve…

446f8b6

…nt-using-selectors-for-ccs-ccr

[CI] Auto commit changes from spotless

62664ac

prevent using ::data selector as well

0fe3ec5

Merge branch 'main' into sa-prevent-using-selectors-for-ccs-ccr

ae8cc1a

consolidate error messages and exceptions thrown

4baa39a

fix failing test

5811200

Merge branch 'main' into sa-prevent-using-selectors-for-ccs-ccr

bc0a5b5

slobodanadamovic and others added 5 commits March 27, 2025 08:57

fix failing test ::data is not allowed

7d1dd3e

Merge branch 'main' of github.com:elastic/elasticsearch into sa-preve…

5056909

…nt-using-selectors-for-ccs-ccr

Merge branch 'main' into sa-prevent-using-selectors-for-ccs-ccr

321d5c7

Merge branch 'main' into sa-prevent-using-selectors-for-ccs-ccr

148567d

[Failure Store] Test API keys and skip_unavailable with RCS1

7bf9a8f

Adjust existing RCS1 tests to randomize using API keys for authorization and `skip_unavailable` setting.

slobodanadamovic added >test Issues or PRs that are addressing/adding tests :Security/Security Security issues without another label Team:Security Meta label for security team auto-backport Automatically create backport pull requests when merged v8.19.0 v9.1.0 labels Mar 27, 2025

slobodanadamovic self-assigned this Mar 27, 2025

slobodanadamovic commented Mar 28, 2025

View reviewed changes

slobodanadamovic requested review from Copilot and n1v0lg and removed request for Copilot March 28, 2025 09:23

slobodanadamovic marked this pull request as ready for review March 28, 2025 09:23

This comment was marked as off-topic.

Sign in to view

slobodanadamovic added 2 commits April 2, 2025 11:16

Merge branch 'main' into sa-test-ccs-with-api-keys

e78ff77

Merge branch 'main' into sa-test-ccs-with-api-keys

283582c

n1v0lg approved these changes Apr 9, 2025

View reviewed changes

slobodanadamovic merged commit d12eb8d into elastic:main Apr 9, 2025
22 checks passed

slobodanadamovic mentioned this pull request Apr 9, 2025

[8.x] [Failure Store] Test API keys and skip_unavailable with RCS1 (#125782) #126555

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Failure Store] Test API keys and skip_unavailable with RCS1 #125782

[Failure Store] Test API keys and skip_unavailable with RCS1 #125782

slobodanadamovic commented Mar 27, 2025 •

edited

Loading

slobodanadamovic Mar 28, 2025

slobodanadamovic Mar 28, 2025

slobodanadamovic Mar 28, 2025 •

edited

Loading

This comment was marked as off-topic.

elasticsearchmachine commented Mar 28, 2025

n1v0lg left a comment

elasticsearchmachine commented Apr 9, 2025

[Failure Store] Test API keys and skip_unavailable with RCS1 #125782

[Failure Store] Test API keys and skip_unavailable with RCS1 #125782

Conversation

slobodanadamovic commented Mar 27, 2025 • edited Loading

slobodanadamovic Mar 28, 2025

Choose a reason for hiding this comment

slobodanadamovic Mar 28, 2025

Choose a reason for hiding this comment

slobodanadamovic Mar 28, 2025 • edited Loading

Choose a reason for hiding this comment

This comment was marked as off-topic.

elasticsearchmachine commented Mar 28, 2025

n1v0lg left a comment

Choose a reason for hiding this comment

elasticsearchmachine commented Apr 9, 2025

💚 Backport successful

slobodanadamovic commented Mar 27, 2025 •

edited

Loading

slobodanadamovic Mar 28, 2025 •

edited

Loading