Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[X-Pack] Beats centralized management: security role + licensing #30520

Merged
merged 22 commits into from
Jul 10, 2018
Merged

[X-Pack] Beats centralized management: security role + licensing #30520

Changes from 1 commit
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
573cc62
Adding Beats x-pack plugin + index templates
ycombinator May 10, 2018
ffe1ff5
Adding built-in roles for Beats central management
ycombinator May 10, 2018
cb874b7
Fixing typo
ycombinator May 10, 2018
ee45e03
Refactoring: extract common code into method
ycombinator May 11, 2018
c2618b7
More refactoring for more code reuse
ycombinator May 11, 2018
b7254ee
Use a single index for Beats management
ycombinator May 14, 2018
d7af55b
Rename "fragment" to "block"
ycombinator May 14, 2018
5364b16
Adding configuration block type
ycombinator May 14, 2018
61eb9c6
Expand kibana_system role to include Beats management index privileges
ycombinator May 14, 2018
678d8b7
Fixing syntax
ycombinator May 14, 2018
50a4d62
Adding test
ycombinator May 14, 2018
8e517c3
Adding asserting for reserved role
ycombinator May 14, 2018
7834c41
Fixing privileges
ycombinator May 14, 2018
9cbd059
Updating template
ycombinator May 14, 2018
a908b97
Removing beats plugin
ycombinator May 15, 2018
c1163c6
Fixing tests
ycombinator May 17, 2018
625b80b
Fixing role variable name
ycombinator May 18, 2018
2e29cdb
Fixing assertions
ycombinator May 18, 2018
d0f05d6
Switching to preferred syntax for boolean false checks
ycombinator Jul 9, 2018
154d305
Making class final
ycombinator Jul 9, 2018
39d08ad
Making variables final
ycombinator Jul 9, 2018
d79e73d
Updating Basic license message to be more accurate
ycombinator Jul 10, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Fixing tests
  • Loading branch information
@ycombinator
ycombinator committed Jul 9, 2018
commit c1163c6002fae3b1a2825a25ffabacd6d7f17639
58 changes: 12 additions & 46 deletions .../test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -493,38 +493,6 @@ public void testLogstashSystemRole() {
is(false));
}

public void testBeatsAgentRole() {
RoleDescriptor roleDescriptor = new ReservedRolesStore().roleDescriptor("beats_agent");
assertNotNull(roleDescriptor);
assertThat(roleDescriptor.getMetadata(), hasEntry("_reserved", true));

Role beatsAgentRole = Role.builder(roleDescriptor, null).build();
assertThat(beatsAgentRole.cluster().check(ClusterHealthAction.NAME), is(false));
assertThat(beatsAgentRole.cluster().check(ClusterStateAction.NAME), is(false));
assertThat(beatsAgentRole.cluster().check(ClusterStatsAction.NAME), is(false));
assertThat(beatsAgentRole.cluster().check(PutIndexTemplateAction.NAME), is(false));
assertThat(beatsAgentRole.cluster().check(ClusterRerouteAction.NAME), is(false));
assertThat(beatsAgentRole.cluster().check(ClusterUpdateSettingsAction.NAME), is(false));
assertThat(beatsAgentRole.cluster().check(MonitoringBulkAction.NAME), is(false));

assertThat(beatsAgentRole.runAs().check(randomAlphaOfLengthBetween(1, 30)), is(false));

assertThat(beatsAgentRole.indices().allowedIndicesMatcher("indices:foo").test(randomAlphaOfLengthBetween(8, 24)),
is(false));

String index = ".management-beats-agents";
assertThat(beatsAgentRole.indices().allowedIndicesMatcher("indices:foo").test(index), is(true));
assertThat(beatsAgentRole.indices().allowedIndicesMatcher("indices:bar").test(index), is(true));
assertThat(beatsAgentRole.indices().allowedIndicesMatcher(DeleteIndexAction.NAME).test(index), is(false));
assertThat(beatsAgentRole.indices().allowedIndicesMatcher(CreateIndexAction.NAME).test(index), is(true));
assertThat(beatsAgentRole.indices().allowedIndicesMatcher(IndexAction.NAME).test(index), is(true));
assertThat(beatsAgentRole.indices().allowedIndicesMatcher(DeleteAction.NAME).test(index), is(false));
assertThat(beatsAgentRole.indices().allowedIndicesMatcher(UpdateSettingsAction.NAME).test(index), is(true));
assertThat(beatsAgentRole.indices().allowedIndicesMatcher(SearchAction.NAME).test(index), is(true));
assertThat(beatsAgentRole.indices().allowedIndicesMatcher(MultiSearchAction.NAME).test(index), is(true));
assertThat(beatsAgentRole.indices().allowedIndicesMatcher(GetAction.NAME).test(index), is(true));
}

public void testBeatsAdminRole() {
RoleDescriptor roleDescriptor = new ReservedRolesStore().roleDescriptor("beats_admin");
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you make this variable final

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 39d08ad.

assertNotNull(roleDescriptor);
Expand All @@ -544,20 +512,18 @@ public void testBeatsAdminRole() {
assertThat(beatsAdminRole.indices().allowedIndicesMatcher("indices:foo").test(randomAlphaOfLengthBetween(8, 24)),
is(false));

String index = ".management-beats-*";
Arrays.asList(".management-beats-admin", ".management-beats-agents").forEach((index) -> {
logger.info("index name [{}]", index);
assertThat(beatsAdminRole.indices().allowedIndicesMatcher("indices:foo").test(index), is(true));
assertThat(beatsAdminRole.indices().allowedIndicesMatcher("indices:bar").test(index), is(true));
assertThat(beatsAdminRole.indices().allowedIndicesMatcher(DeleteIndexAction.NAME).test(index), is(true));
assertThat(beatsAdminRole.indices().allowedIndicesMatcher(CreateIndexAction.NAME).test(index), is(true));
assertThat(beatsAdminRole.indices().allowedIndicesMatcher(IndexAction.NAME).test(index), is(true));
assertThat(beatsAdminRole.indices().allowedIndicesMatcher(DeleteAction.NAME).test(index), is(true));
assertThat(beatsAdminRole.indices().allowedIndicesMatcher(UpdateSettingsAction.NAME).test(index), is(true));
assertThat(beatsAdminRole.indices().allowedIndicesMatcher(SearchAction.NAME).test(index), is(true));
assertThat(beatsAdminRole.indices().allowedIndicesMatcher(MultiSearchAction.NAME).test(index), is(true));
assertThat(beatsAdminRole.indices().allowedIndicesMatcher(GetAction.NAME).test(index), is(true));
}
String index = ".management-beats";
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you make this variable final

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 39d08ad.

logger.info("index name [{}]", index);
assertThat(beatsAdminRole.indices().allowedIndicesMatcher("indices:foo").test(index), is(true));
assertThat(beatsAdminRole.indices().allowedIndicesMatcher("indices:bar").test(index), is(true));
assertThat(beatsAdminRole.indices().allowedIndicesMatcher(DeleteIndexAction.NAME).test(index), is(true));
assertThat(beatsAdminRole.indices().allowedIndicesMatcher(CreateIndexAction.NAME).test(index), is(true));
assertThat(beatsAdminRole.indices().allowedIndicesMatcher(IndexAction.NAME).test(index), is(true));
assertThat(beatsAdminRole.indices().allowedIndicesMatcher(DeleteAction.NAME).test(index), is(true));
assertThat(beatsAdminRole.indices().allowedIndicesMatcher(UpdateSettingsAction.NAME).test(index), is(true));
assertThat(beatsAdminRole.indices().allowedIndicesMatcher(SearchAction.NAME).test(index), is(true));
assertThat(beatsAdminRole.indices().allowedIndicesMatcher(MultiSearchAction.NAME).test(index), is(true));
assertThat(beatsAdminRole.indices().allowedIndicesMatcher(GetAction.NAME).test(index), is(true));
}

public void testBeatsSystemRole() {
Expand Down