Skip to content

Commit 8683954

Browse files
opensearch-trigger-bot[bot]bowenlan-amzn
authored and
github-actions[bot]
committed
Security Workflow (#611) (#619)
* Unify wipe indices logic after tests Signed-off-by: bowenlan-amzn <bowenlan23@gmail.com> * Enhance wipeAllIndices function Signed-off-by: bowenlan-amzn <bowenlan23@gmail.com> * security workflow setup Signed-off-by: bowenlan-amzn <bowenlan23@gmail.com> * add more settings Signed-off-by: bowenlan-amzn <bowenlan23@gmail.com> * Rewrite SecureRestClientBuilder Signed-off-by: bowenlan-amzn <bowenlan23@gmail.com> * For now, use local cluster Signed-off-by: bowenlan-amzn <bowenlan23@gmail.com> Signed-off-by: bowenlan-amzn <bowenlan23@gmail.com> (cherry picked from commit f2a9fa6) Co-authored-by: bowenlan-amzn <bowenlan23@gmail.com> (cherry picked from commit ed54fee)
1 parent ccbde24 commit 8683954

File tree

11 files changed

+343
-42
lines changed

11 files changed

+343
-42
lines changed

‎.github/workflows/docker-security-test-workflow.yml‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
name: Docker Security Test Workflow
2+
on:
3+
pull_request:
4+
branches:
5+
- "*"
6+
push:
7+
branches:
8+
- "*"
9+
10+
jobs:
11+
test:
12+
# This job runs on Linux
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Set Up JDK
16+
uses: actions/setup-java@v1
17+
with:
18+
java-version: 17
19+
- name: Checkout Branch
20+
uses: actions/checkout@v2
21+
- name: Build Index Management
22+
run: ./gradlew assemble -Dbuild.snapshot=false
23+
- name: Pull and Run Docker
24+
run: |
25+
plugin=`basename $(ls build/distributions/*.zip)`
26+
list_of_files=`ls`
27+
list_of_all_files=`ls build/distributions/`
28+
version=`echo $plugin|awk -F- '{print $4}'| cut -d. -f 1-3`
29+
plugin_version=`echo $plugin|awk -F- '{print $4}'| cut -d. -f 1-4`
30+
qualifier=`echo $plugin|awk -F- '{print $4}'| cut -d. -f 1-1`
31+
candidate_version=`echo $plugin|awk -F- '{print $5}'| cut -d. -f 1-1`
32+
if qualifier
33+
then
34+
docker_version=$version-$qualifier
35+
else
36+
docker_version=$version
37+
fi
38+
39+
[[ -z $candidate_version ]] && candidate_version=$qualifier && qualifier=""
40+
41+
echo plugin version plugin_version qualifier candidate_version docker_version
42+
echo "($plugin) ($version) ($plugin_version) ($qualifier) ($candidate_version) ($docker_version)"
43+
echo $ls $list_of_all_files
44+
45+
if docker pull opensearchstaging/opensearch:$docker_version
46+
then
47+
echo "FROM opensearchstaging/opensearch:$docker_version" >> Dockerfile
48+
echo "RUN if [ -d /usr/share/opensearch/plugins/opensearch-index-management ]; then /usr/share/opensearch/bin/opensearch-plugin remove opensearch-index-management; fi" >> Dockerfile
49+
echo "ADD build/distributions/$plugin /tmp/" >> Dockerfile
50+
echo "RUN /usr/share/opensearch/bin/opensearch-plugin install --batch file:/tmp/$plugin" >> Dockerfile
51+
echo "RUN echo 'path.repo: ["/usr/share/opensearch/data/repo"]' >> /usr/share/opensearch/config/opensearch.yml" >> Dockerfile
52+
53+
docker build -t opensearch-index-management:test .
54+
echo "imagePresent=true" >> $GITHUB_ENV
55+
else
56+
echo "imagePresent=false" >> $GITHUB_ENV
57+
fi
58+
- name: Run Docker Image
59+
if: env.imagePresent == 'true'
60+
run: |
61+
cd ..
62+
docker run -p 9200:9200 -d -p 9600:9600 -e "discovery.type=single-node" opensearch-index-management:test
63+
sleep 120
64+
- name: Run Index Management Test for security enabled test cases
65+
if: env.imagePresent == 'true'
66+
run: |
67+
cluster_running=`curl -XGET https://localhost:9200/_cat/plugins -u admin:admin --insecure`
68+
echo $cluster_running
69+
security=`curl -XGET https://localhost:9200/_cat/plugins -u admin:admin --insecure |grep opensearch-security|wc -l`
70+
echo $security
71+
if [ $security -gt 0 ]
72+
then
73+
echo "Security plugin is available"
74+
./gradlew integTest -Dtests.rest.cluster=localhost:9200 -Dtests.cluster=localhost:9200 -Dtests.clustername=docker-cluster -Dsecurity=true -Dhttps=true -Duser=admin -Dpassword=admin
75+
else
76+
echo "Security plugin is NOT available skipping this run as tests without security have already been run"
77+
fi
78+
- name: Upload failed logs
79+
uses: actions/upload-artifact@v2
80+
if: failure()
81+
with:
82+
name: logs
83+
path: build/testclusters/integTest-*/logs/*

‎.github/workflows/security-test-workflow.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: Security test workflow
2+
# This workflow is triggered on pull requests to main
3+
on:
4+
pull_request:
5+
branches:
6+
- "*"
7+
push:
8+
branches:
9+
- "*"
10+
11+
jobs:
12+
test:
13+
# This job runs on Linux
14+
runs-on: ubuntu-latest
15+
steps:
16+
# This step uses the setup-java Github action: https://github.com/actions/setup-java
17+
- name: Set Up JDK
18+
uses: actions/setup-java@v1
19+
with:
20+
java-version: 17
21+
# index-management
22+
- name: Checkout Branch
23+
uses: actions/checkout@v2
24+
- name: Start cluster with security plugin
25+
run: |
26+
./gradlew run -Dsecurity=true &
27+
sleep 120
28+
- name: Run integration tests
29+
run: |
30+
./gradlew integTestRemote -Dsecurity=true -Dhttps=true -Dtests.rest.cluster="localhost:9200" -Dtests.cluster="localhost:9200" -Dtests.clustername="integTest" -Duser=admin -Dpassword=admin
31+
- name: Upload failed logs
32+
uses: actions/upload-artifact@v2
33+
if: failure()
34+
with:
35+
name: logs
36+
path: build/testclusters/integTest-*/logs/*

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ build/
33
out/
44
.idea/*
55
!.idea/copyright
6+
.vscode
67
*.ipr
78
*.iws
89
.DS_Store

0 commit comments

Comments
 (0)