Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding security enabled integration tests #400

Merged
merged 21 commits into from
Jan 12, 2024

Conversation

joshpalis
Copy link
Member

@joshpalis joshpalis commented Jan 11, 2024

Description

This PR aims to add security enabled integration tests to the CI in order to test various cluster permissions based on the opendistro security roles added by opensearch-project/security#3851. The tests themselves are relatively simple, we create two users, one with a flow_framework_full_access role, and one with a flow_framework_read_access role to determine if these users can hit our APIs.

The build.gradle has been modified to automatically configure an integration test cluster with or without the security plugin installed depending on the provided system properties. The following details the commands to run an integration test cluster with or without security :

To run a single-node/multi-node cluster locally with Flow Framework and ML Commons :  
./gradlew run
./gradlew run -DnumNodes=<number of nodes>

To run a single-node/multi-node cluster locally with Flow Framework, ML Commons and Security : 
./gradlew run -Dsecurity.enabled=true
./gradlew run -Dsecurity.enabled=true -DnumNodes=<number of nodes>

To run single-node non-security enabled integration tests :
./gradlew integTest

To run single-node security enabled integration tests : 
./gradlew integTest -Dsecurity.enabled=true

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Joshua Palis <[email protected]>
Copy link

codecov bot commented Jan 11, 2024

Codecov Report

Attention: 16 lines in your changes are missing coverage. Please review.

Comparison is base (f8e822f) 72.14% compared to head (9402f58) 71.95%.

Files Patch % Lines
...ework/transport/CreateWorkflowTransportAction.java 36.36% 6 Missing and 1 partial ⚠️
...h/flowframework/rest/RestCreateWorkflowAction.java 0.00% 5 Missing ⚠️
...lowframework/rest/RestProvisionWorkflowAction.java 0.00% 4 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff              @@
##               main     #400      +/-   ##
============================================
- Coverage     72.14%   71.95%   -0.20%     
  Complexity      613      613              
============================================
  Files            79       79              
  Lines          3070     3081      +11     
  Branches        238      238              
============================================
+ Hits           2215     2217       +2     
- Misses          751      760       +9     
  Partials        104      104              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@joshpalis
Copy link
Member Author

Seems the client used to determine the security plugin is present in the cluster is refusing to connect, which is preventing our security integration tests to run :

Run security=`curl -XGET https://localhost:9[20](https://github.com/opensearch-project/flow-framework/actions/runs/7494086694/job/20401224256?pr=400#step:7:21)0/_cat/plugins?v -u admin:admin --insecure |grep opensearch-security|wc -l`
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (7) Failed to connect to localhost port 9200 after 0 ms: Connection refused
Security plugin is NOT available, skipping integration tests

Signed-off-by: Joshua Palis <[email protected]>
Signed-off-by: Joshua Palis <[email protected]>
Signed-off-by: Joshua Palis <[email protected]>
…red only for security y enabled clusters

Signed-off-by: Joshua Palis <[email protected]>
Signed-off-by: Joshua Palis <[email protected]>
Signed-off-by: Joshua Palis <[email protected]>
Copy link
Member

@owaiskazi19 owaiskazi19 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good overall with few comments

.github/workflows/test_security.yml Outdated Show resolved Hide resolved
build.gradle Show resolved Hide resolved
build.gradle Show resolved Hide resolved
Copy link
Member

@owaiskazi19 owaiskazi19 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me unless you are planning to add more tests in the same PR

…ces to security plugin configuration

Signed-off-by: Joshua Palis <[email protected]>
@joshpalis joshpalis merged commit 74f42ba into opensearch-project:main Jan 12, 2024
24 of 25 checks passed
@opensearch-trigger-bot
Copy link

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/flow-framework/backport-2.x 2.x
# Navigate to the new working tree
pushd ../.worktrees/flow-framework/backport-2.x
# Create a new branch
git switch --create backport/backport-400-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 74f42ba712bfc008ddc21ca18402f4dde541fd1a
# Push it to GitHub
git push --set-upstream origin backport/backport-400-to-2.x
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/flow-framework/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-400-to-2.x.

joshpalis added a commit to joshpalis/opensearch-ai-flow-framework that referenced this pull request Jan 12, 2024
* Adding intiial security integration tests, addin test security workflow

Signed-off-by: Joshua Palis <[email protected]>

* updating set up to v4

Signed-off-by: Joshua Palis <[email protected]>

* Fixing run docker image task

Signed-off-by: Joshua Palis <[email protected]>

* Fixing pull and run docket

Signed-off-by: Joshua Palis <[email protected]>

* Fixing pull and run docket

Signed-off-by: Joshua Palis <[email protected]>

* Testing integ test if security is not available

Signed-off-by: Joshua Palis <[email protected]>

* Removing non-security integ test from workflow

Signed-off-by: Joshua Palis <[email protected]>

* test

Signed-off-by: Joshua Palis <[email protected]>

* test

Signed-off-by: Joshua Palis <[email protected]>

* Removing docker -ps

Signed-off-by: Joshua Palis <[email protected]>

* Pulling in secuirty as a zipArchive dependency, installed and configured only for security y enabled clusters

Signed-off-by: Joshua Palis <[email protected]>

* fixing ci

Signed-off-by: Joshua Palis <[email protected]>

* using v1

Signed-off-by: Joshua Palis <[email protected]>

* Addressing PR comments, using security.emabled system property instead

Signed-off-by: Joshua Palis <[email protected]>

* Adding remaining read access role tests

Signed-off-by: Joshua Palis <[email protected]>

* spotless

Signed-off-by: Joshua Palis <[email protected]>

* Addressing PR comments, adding full access tests, fixing create workflow bug

Signed-off-by: Joshua Palis <[email protected]>

* Added more APIs to full access client test

Signed-off-by: Joshua Palis <[email protected]>

* updating DEVELOPER_GUIDE

Signed-off-by: Joshua Palis <[email protected]>

* Updating developer guide, adding back ML Commons security system indices to security plugin configuration

Signed-off-by: Joshua Palis <[email protected]>

---------

Signed-off-by: Joshua Palis <[email protected]>
joshpalis added a commit that referenced this pull request Jan 13, 2024
Adding security enabled integration tests (#400)

* Adding intiial security integration tests, addin test security workflow



* updating set up to v4



* Fixing run docker image task



* Fixing pull and run docket



* Fixing pull and run docket



* Testing integ test if security is not available



* Removing non-security integ test from workflow



* test



* test



* Removing docker -ps



* Pulling in secuirty as a zipArchive dependency, installed and configured only for security y enabled clusters



* fixing ci



* using v1



* Addressing PR comments, using security.emabled system property instead



* Adding remaining read access role tests



* spotless



* Addressing PR comments, adding full access tests, fixing create workflow bug



* Added more APIs to full access client test



* updating DEVELOPER_GUIDE



* Updating developer guide, adding back ML Commons security system indices to security plugin configuration



---------

Signed-off-by: Joshua Palis <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport 2.x backport PRs to 2.x branch
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants