Skip to content

Bootstrap entitlements for testing #129268

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 65 commits into from
Jul 2, 2025
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
65 commits
Select commit Hold shift + click to select a range
2daa627
Fix ExceptionSerializationTests to use getCodeSource instead of getRe…
prdoyle Jun 11, 2025
87b58f6
FIx logging tests to use org.elasticsearch.index instead of root logger.
prdoyle Jun 11, 2025
3248fd2
Fix entitlement error message by stashing the module name in ModuleEn…
prdoyle Jun 12, 2025
afaaf3d
Ignore server locations whose representative class isn't loaded
prdoyle Jun 6, 2025
c363a24
Partial initial implementation
prdoyle Jun 17, 2025
ee60773
System properties: testOnlyClasspath and enableForTests
prdoyle Jun 17, 2025
ad955a5
Trivially allow some packages
prdoyle Jun 17, 2025
3dd3962
DEBUG: use TreeMap in TestScopeResolver for readability
prdoyle Jun 17, 2025
caa6a70
Special case bouncycastle for security plugin
prdoyle Jun 17, 2025
08b16bb
Add CONFIG to TestPathLookup
prdoyle Jun 17, 2025
c3b6388
Add the classpath to the source path list for every plugin
prdoyle Jun 17, 2025
687b904
Add @WithoutEntitlements to tests that run ES nodes
prdoyle Jun 17, 2025
c8f1af6
Set es.entitlement.enableForTests for all libs
prdoyle Jun 17, 2025
38c3f9c
Use @WithoutEntitlements on ingest plugin tests
prdoyle Jun 17, 2025
f5a7c86
Substitute ALL-UNNAMED for module name in non-modular plugins
prdoyle Jun 17, 2025
93878f9
Add missing entitlements found by unit tests
prdoyle Jun 17, 2025
bda4331
Comment in TestScopeResolver
prdoyle Jun 17, 2025
852eb83
Properly compute bridge jar location for patch-module
prdoyle Jun 17, 2025
d039ba4
Call out nonServerLibs
prdoyle Jun 18, 2025
c53e10a
Don't build two TestPathLookups
prdoyle Jun 18, 2025
6c1b7fd
More comments for meta-tests
prdoyle Jun 18, 2025
8776617
Remove redundant dependencies for bridgeJarConfig.
prdoyle Jun 18, 2025
3737d0a
Merge branch 'main' into bootstrap-entitlements-for-testing
prdoyle Jun 18, 2025
d9517f7
Add bridge+agent dependencies only if those exist.
prdoyle Jun 18, 2025
2381c88
[CI] Auto commit changes from spotless
elasticsearchmachine Jun 18, 2025
26baece
Pass testOnlyPath in environment instead of command line.
prdoyle Jun 18, 2025
a846c50
[CI] Auto commit changes from spotless
elasticsearchmachine Jun 18, 2025
e9093d3
Split testOnlyPathString at File.pathSeparator
prdoyle Jun 18, 2025
b2bbf94
Use doFirst to delay setting testOnlyPath env var
prdoyle Jun 18, 2025
3c760da
Trivially allow jimfs (??)
prdoyle Jun 18, 2025
65a7678
Merge branch 'main' into bootstrap-entitlements-for-testing
prdoyle Jun 19, 2025
5ef8233
Don't enforce entitlements on internalClusterTest for now
prdoyle Jun 19, 2025
0b4273a
Merge branch 'main' into bootstrap-entitlements-for-testing
ldematte Jun 20, 2025
4c9acbb
Replace forbidden APIs
prdoyle Jun 20, 2025
a2fcb3a
Match testOnlyClasspath using URI instead of String.
prdoyle Jun 20, 2025
4b36d55
[CI] Auto commit changes from spotless
elasticsearchmachine Jun 20, 2025
48fe7cc
Merge branch 'main' into bootstrap-entitlements-for-testing
prdoyle Jun 20, 2025
a2d8eb8
More forbidden APIs
prdoyle Jun 20, 2025
eea9cca
Merge branch 'main' into bootstrap-entitlements-for-testing
prdoyle Jun 20, 2025
846c8b7
Merge branch 'main' into bootstrap-entitlements-for-testing
prdoyle Jun 20, 2025
a9c83cc
Disable configuration cache for LegacyYamlRestTestPluginFuncTest
prdoyle Jun 24, 2025
3dffea1
Merge remote-tracking branch 'upstream/main' into bootstrap-entitleme…
prdoyle Jun 24, 2025
ec76635
Strip carriage-return characters in expected output for ReleaseNotesG…
prdoyle Jun 24, 2025
a5579b6
Merge branch 'main' into bootstrap-entitlements-for-testing
prdoyle Jun 24, 2025
4338605
Merge branch 'main' into bootstrap-entitlements-for-testing
prdoyle Jun 24, 2025
bc6b6c8
Move configureEntitlements to ElasticsearchTestBasePlugin as-is
prdoyle Jun 24, 2025
8c62d00
Use matching instead of if
prdoyle Jun 24, 2025
c7ff726
Remove requireNonNull
prdoyle Jun 24, 2025
b5a1672
Remove default configuration
prdoyle Jun 24, 2025
4e1a3b6
Set inputs instead of dependencies
prdoyle Jun 24, 2025
82d61e4
Use test.systemProperty
prdoyle Jun 24, 2025
b5d3088
Merge remote-tracking branch 'upstream/main' into bootstrap-entitleme…
prdoyle Jun 24, 2025
67ddd9c
Merge branch 'main' into bootstrap-entitlements-for-testing
prdoyle Jun 25, 2025
f880bbc
Respond to PR comments
prdoyle Jun 26, 2025
015ad9f
Disable entitlement enforcement for ScopedSettingsTests.
prdoyle Jun 26, 2025
4f0bc69
Merge remote-tracking branch 'upstream/main' into bootstrap-entitleme…
prdoyle Jun 26, 2025
4be45a2
Address PR comments
prdoyle Jun 30, 2025
40e89d1
Moritz's configureJavaBaseModuleOptions
prdoyle Jun 30, 2025
034a502
Merge branch 'main' into bootstrap-entitlements-for-testing
prdoyle Jun 30, 2025
35f9408
Allow for entitlements not yet enforced in serverless
prdoyle Jun 30, 2025
5607af8
fix entitlementBridge config after rename
mosche Jul 1, 2025
adc928b
drop empty file collections
mosche Jul 1, 2025
43a81c3
Merge branch 'main' into bootstrap-entitlements-for-testing
mosche Jul 1, 2025
1a2e50c
Merge remote-tracking branch 'upstream/main' into bootstrap-entitleme…
prdoyle Jul 2, 2025
3c191c2
Remove workaround in LegacyYamlRestTestPluginFuncTest
prdoyle Jul 2, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Fix entitlement error message by stashing the module name in ModuleEn…
…titlements.

Taking the actual module name from the class doesn't work in tests,
where those classes are loaded from the classpath and so their module
info is misleading.
  • Loading branch information
prdoyle committed Jun 17, 2025
commit 3248fd2ee57ea30888c822761cebf57040b2ad2d
Original file line number Diff line number Diff line change
Expand Up @@ -135,7 +135,7 @@ private void neverEntitled(Class<?> callerClass, Supplier<String> operationDescr
Strings.format(
"component [%s], module [%s], class [%s], operation [%s]",
entitlements.componentName(),
PolicyCheckerImpl.getModuleName(requestingClass),
entitlements.moduleName(),
requestingClass,
operationDescription.get()
),
Expand Down Expand Up @@ -247,7 +247,7 @@ public void checkFileRead(Class<?> callerClass, Path path, boolean followLinks)
Strings.format(
"component [%s], module [%s], class [%s], entitlement [file], operation [read], path [%s]",
entitlements.componentName(),
PolicyCheckerImpl.getModuleName(requestingClass),
entitlements.moduleName(),
requestingClass,
realPath == null ? path : Strings.format("%s -> %s", path, realPath)
),
Expand Down Expand Up @@ -279,7 +279,7 @@ public void checkFileWrite(Class<?> callerClass, Path path) {
Strings.format(
"component [%s], module [%s], class [%s], entitlement [file], operation [write], path [%s]",
entitlements.componentName(),
PolicyCheckerImpl.getModuleName(requestingClass),
entitlements.moduleName(),
requestingClass,
path
),
Expand Down Expand Up @@ -383,7 +383,7 @@ public void checkWriteProperty(Class<?> callerClass, String property) {
() -> Strings.format(
"Entitled: component [%s], module [%s], class [%s], entitlement [write_system_properties], property [%s]",
entitlements.componentName(),
PolicyCheckerImpl.getModuleName(requestingClass),
entitlements.moduleName(),
requestingClass,
property
)
Expand All @@ -394,7 +394,7 @@ public void checkWriteProperty(Class<?> callerClass, String property) {
Strings.format(
"component [%s], module [%s], class [%s], entitlement [write_system_properties], property [%s]",
entitlements.componentName(),
PolicyCheckerImpl.getModuleName(requestingClass),
entitlements.moduleName(),
requestingClass,
property
),
Expand Down Expand Up @@ -447,7 +447,7 @@ private void checkFlagEntitlement(
Strings.format(
"component [%s], module [%s], class [%s], entitlement [%s]",
classEntitlements.componentName(),
PolicyCheckerImpl.getModuleName(requestingClass),
classEntitlements.moduleName(),
requestingClass,
PolicyParser.buildEntitlementNameFromClass(entitlementClass)
),
Expand All @@ -460,7 +460,7 @@ private void checkFlagEntitlement(
() -> Strings.format(
"Entitled: component [%s], module [%s], class [%s], entitlement [%s]",
classEntitlements.componentName(),
PolicyCheckerImpl.getModuleName(requestingClass),
classEntitlements.moduleName(),
requestingClass,
PolicyParser.buildEntitlementNameFromClass(entitlementClass)
)
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -120,6 +120,7 @@ public enum ComponentKind {
*/
record ModuleEntitlements(
String componentName,
String moduleName,
Map<Class<? extends Entitlement>, List<Entitlement>> entitlementsByType,
FileAccessTree fileAccess,
Logger logger
Expand Down Expand Up @@ -148,7 +149,13 @@ private FileAccessTree getDefaultFileAccess(Collection<Path> componentPaths) {

// pkg private for testing
ModuleEntitlements defaultEntitlements(String componentName, Collection<Path> componentPaths, String moduleName) {
return new ModuleEntitlements(componentName, Map.of(), getDefaultFileAccess(componentPaths), getLogger(componentName, moduleName));
return new ModuleEntitlements(
componentName,
moduleName,
Map.of(),
getDefaultFileAccess(componentPaths),
getLogger(componentName, moduleName)
);
}

// pkg private for testing
Expand All @@ -166,6 +173,7 @@ ModuleEntitlements policyEntitlements(
}
return new ModuleEntitlements(
componentName,
moduleName,
entitlements.stream().collect(groupingBy(Entitlement::getClass)),
FileAccessTree.of(componentName, moduleName, filesEntitlement, pathLookup, componentPaths, exclusivePaths),
getLogger(componentName, moduleName)
Expand Down