Skip to content

Commit 0737060

Browse files
DarshitChanpuraDarshitChanpura
authored
[Resource Access Control] [Part1] Introduces SPI for resource access control (#5185)
Signed-off-by: Darshit Chanpura <dchanp@amazon.com>
1 parent bfc0f4a commit 0737060

File tree

23 files changed

+1959
-164
lines changed

23 files changed

+1959
-164
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 205 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -37,9 +37,35 @@ jobs:
3737
run: |
3838
echo "separateTestsNames=$(./gradlew listTasksAsJSON -q --console=plain | tail -n 1)" >> $GITHUB_OUTPUT
3939
40+
publish-components-to-maven-local:
41+
runs-on: ubuntu-latest
42+
steps:
43+
- name: Set up JDK for build and test
44+
uses: actions/setup-java@v4
45+
with:
46+
distribution: temurin # Temurin is a distribution of adoptium
47+
java-version: 21
48+
49+
- name: Checkout security
50+
uses: actions/checkout@v4
51+
52+
- name: Publish components to Maven Local
53+
run: |
54+
./gradlew clean \
55+
:opensearch-resource-sharing-spi:publishToMavenLocal \
56+
-Dbuild.snapshot=false
57+
58+
- name: Cache artifacts for dependent jobs
59+
uses: actions/cache@v4.2.2
60+
with:
61+
path: ~/.m2/repository/org/opensearch/
62+
key: maven-local-${{ github.run_id }}
63+
restore-keys: |
64+
maven-local-
65+
4066
test-windows:
4167
name: test
42-
needs: generate-test-list
68+
needs: [generate-test-list, publish-components-to-maven-local]
4369
strategy:
4470
fail-fast: false
4571
matrix:
@@ -101,6 +127,14 @@ jobs:
101127
- name: Checkout security
102128
uses: actions/checkout@v4
103129

130+
- name: Restore Maven Local Cache
131+
uses: actions/cache@v4.2.2
132+
with:
133+
path: ~/.m2/repository/org/opensearch/
134+
key: maven-local-${{ github.run_id }}
135+
restore-keys: |
136+
maven-local-
137+
104138
- name: Build and Test
105139
uses: gradle/gradle-build-action@v3
106140
with:
@@ -116,7 +150,7 @@ jobs:
116150
./build/reports/
117151
118152
report-coverage:
119-
needs: ["test-windows", "test-linux", "integration-tests-windows", "integration-tests-linux"]
153+
needs: ["test-windows", "test-linux", "integration-tests-windows", "integration-tests-linux", "spi-tests-linux", "spi-tests-windows"]
120154
runs-on: ubuntu-latest
121155
steps:
122156
- uses: actions/checkout@v4
@@ -139,7 +173,6 @@ jobs:
139173
fail_ci_if_error: true
140174
verbose: true
141175
142-
143176
integration-tests-windows:
144177
name: integration-tests
145178
strategy:
@@ -159,12 +192,20 @@ jobs:
159192
- name: Checkout security
160193
uses: actions/checkout@v4
161194

162-
- name: Build and Test
195+
- name: Restore Maven Local Cache
196+
uses: actions/cache@v4.2.2
197+
with:
198+
path: ~/.m2/repository/org/opensearch/
199+
key: maven-local-${{ github.run_id }}
200+
restore-keys: |
201+
maven-local-
202+
203+
- name: Run Integration Tests
163204
uses: gradle/gradle-build-action@v3
164205
with:
165206
cache-disabled: true
166207
arguments: |
167-
integrationTest -Dbuild.snapshot=false
208+
:integrationTest -Dbuild.snapshot=false
168209
169210
- uses: actions/upload-artifact@v4
170211
if: always()
@@ -192,6 +233,7 @@ jobs:
192233
steps:
193234
- name: Run start commands
194235
run: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-start-command }}
236+
195237
- name: Set up JDK for build and test
196238
uses: actions/setup-java@v4
197239
with:
@@ -215,9 +257,103 @@ jobs:
215257
path: |
216258
./build/reports/
217259
260+
spi-tests-linux:
261+
name: spi-tests
262+
needs: ["Get-CI-Image-Tag", publish-components-to-maven-local]
263+
strategy:
264+
fail-fast: false
265+
matrix:
266+
jdk: [21]
267+
platform: [ubuntu-latest]
268+
runs-on: ${{ matrix.platform }}
269+
container:
270+
# using the same image which is used by opensearch-build to build the OpenSearch Distribution
271+
# this image tag is subject to change as more dependencies and updates will arrive over time
272+
image: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-version-linux }}
273+
# need to switch to root so that github actions can install runner binary on container without permission issues.
274+
options: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-start-options }}
275+
276+
steps:
277+
- name: Run start commands
278+
run: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-start-command }}
279+
280+
- name: Set up JDK for build and test
281+
uses: actions/setup-java@v4
282+
with:
283+
distribution: temurin # Temurin is a distribution of adoptium
284+
java-version: ${{ matrix.jdk }}
285+
286+
- name: Checkout security
287+
uses: actions/checkout@v4
288+
289+
- name: Restore Maven Local Cache
290+
uses: actions/cache@v4.2.2
291+
with:
292+
path: ~/.m2/repository/org/opensearch/
293+
key: maven-local-${{ github.run_id }}
294+
restore-keys: |
295+
maven-local-
296+
297+
- name: Run SPI Tests
298+
uses: gradle/gradle-build-action@v3
299+
with:
300+
cache-disabled: true
301+
arguments: |
302+
:opensearch-resource-sharing-spi:test -Dbuild.snapshot=false
303+
304+
- uses: actions/upload-artifact@v4
305+
if: always()
306+
with:
307+
name: spi-${{ matrix.platform }}-JDK${{ matrix.jdk }}-reports
308+
path: |
309+
./build/reports/
310+
311+
spi-tests-windows:
312+
name: spi-tests
313+
needs: publish-components-to-maven-local
314+
strategy:
315+
fail-fast: false
316+
matrix:
317+
jdk: [21]
318+
platform: [windows-latest]
319+
runs-on: ${{ matrix.platform }}
320+
321+
steps:
322+
- name: Set up JDK for build and test
323+
uses: actions/setup-java@v4
324+
with:
325+
distribution: temurin # Temurin is a distribution of adoptium
326+
java-version: ${{ matrix.jdk }}
327+
328+
- name: Checkout security
329+
uses: actions/checkout@v4
330+
331+
- name: Restore Maven Local Cache
332+
uses: actions/cache@v4.2.2
333+
with:
334+
path: ~/.m2/repository/org/opensearch/
335+
key: maven-local-${{ github.run_id }}
336+
restore-keys: |
337+
maven-local-
338+
339+
- name: Run SPI Tests
340+
uses: gradle/gradle-build-action@v3
341+
with:
342+
cache-disabled: true
343+
arguments: |
344+
:opensearch-resource-sharing-spi:test -Dbuild.snapshot=false
345+
346+
- uses: actions/upload-artifact@v4
347+
if: always()
348+
with:
349+
name: spi-${{ matrix.platform }}-JDK${{ matrix.jdk }}-reports
350+
path: |
351+
./build/reports/
352+
218353
resource-tests:
219354
env:
220355
CI_ENVIRONMENT: resource-test
356+
needs: publish-components-to-maven-local
221357
strategy:
222358
fail-fast: false
223359
matrix:
@@ -235,12 +371,20 @@ jobs:
235371
- name: Checkout security
236372
uses: actions/checkout@v4
237373

238-
- name: Build and Test
374+
- name: Restore Maven Local Cache
375+
uses: actions/cache@v4.2.2
376+
with:
377+
path: ~/.m2/repository/org/opensearch/
378+
key: maven-local-${{ github.run_id }}
379+
restore-keys: |
380+
maven-local-
381+
382+
- name: Run Resource Tests
239383
uses: gradle/gradle-build-action@v3
240384
with:
241385
cache-disabled: true
242386
arguments: |
243-
integrationTest -Dbuild.snapshot=false --tests org.opensearch.security.ResourceFocusedTests
387+
:integrationTest -Dbuild.snapshot=false --tests org.opensearch.security.ResourceFocusedTests
244388
245389
backward-compatibility-build:
246390
runs-on: ubuntu-latest
@@ -303,40 +447,62 @@ jobs:
303447
build-artifact-names:
304448
runs-on: ubuntu-latest
305449
steps:
306-
- uses: actions/checkout@v4
450+
- name: Setup Environment
451+
uses: actions/checkout@v4
307452

308-
- uses: actions/setup-java@v4
453+
- name: Configure Java
454+
uses: actions/setup-java@v4
309455
with:
310-
distribution: temurin # Temurin is a distribution of adoptium
456+
distribution: temurin
311457
java-version: 21
312458

313-
- run: |
314-
security_plugin_version=$(./gradlew properties -q | grep -E '^version:' | awk '{print $2}')
315-
security_plugin_version_no_snapshot=$(echo $security_plugin_version | sed 's/-SNAPSHOT//g')
316-
security_plugin_version_only_number=$(echo $security_plugin_version_no_snapshot | cut -d- -f1)
317-
test_qualifier=alpha2
318-
319-
echo "SECURITY_PLUGIN_VERSION=$security_plugin_version" >> $GITHUB_ENV
320-
echo "SECURITY_PLUGIN_VERSION_NO_SNAPSHOT=$security_plugin_version_no_snapshot" >> $GITHUB_ENV
321-
echo "SECURITY_PLUGIN_VERSION_ONLY_NUMBER=$security_plugin_version_only_number" >> $GITHUB_ENV
322-
echo "TEST_QUALIFIER=$test_qualifier" >> $GITHUB_ENV
323-
324-
- run: |
325-
echo ${{ env.SECURITY_PLUGIN_VERSION }}
326-
echo ${{ env.SECURITY_PLUGIN_VERSION_NO_SNAPSHOT }}
327-
echo ${{ env.SECURITY_PLUGIN_VERSION_ONLY_NUMBER }}
328-
echo ${{ env.TEST_QUALIFIER }}
329-
330-
- run: ./gradlew clean assemble && test -s ./build/distributions/opensearch-security-${{ env.SECURITY_PLUGIN_VERSION }}.zip
331-
332-
- run: ./gradlew clean assemble -Dbuild.snapshot=false && test -s ./build/distributions/opensearch-security-${{ env.SECURITY_PLUGIN_VERSION_NO_SNAPSHOT }}.zip
333-
334-
- run: ./gradlew clean assemble -Dbuild.snapshot=false -Dbuild.version_qualifier=${{ env.TEST_QUALIFIER }} && test -s ./build/distributions/opensearch-security-${{ env.SECURITY_PLUGIN_VERSION_ONLY_NUMBER }}-${{ env.TEST_QUALIFIER }}.zip
335-
336-
- run: ./gradlew clean assemble -Dbuild.version_qualifier=${{ env.TEST_QUALIFIER }} && test -s ./build/distributions/opensearch-security-${{ env.SECURITY_PLUGIN_VERSION_ONLY_NUMBER }}-${{ env.TEST_QUALIFIER }}-SNAPSHOT.zip
337-
338-
- run: ./gradlew clean publishPluginZipPublicationToZipStagingRepository && test -s ./build/distributions/opensearch-security-${{ env.SECURITY_PLUGIN_VERSION }}.zip && test -s ./build/distributions/opensearch-security-${{ env.SECURITY_PLUGIN_VERSION }}.pom
339-
340-
- name: List files in the build directory if there was an error
341-
run: ls -al ./build/distributions/
459+
- name: Build and Test Artifacts
460+
run: |
461+
# Set version variables
462+
security_plugin_version=$(./gradlew properties -q | grep -E '^version:' | awk '{print $2}')
463+
security_plugin_version_no_snapshot=$(echo $security_plugin_version | sed 's/-SNAPSHOT//g')
464+
security_plugin_version_only_number=$(echo $security_plugin_version_no_snapshot | cut -d- -f1)
465+
test_qualifier=alpha2
466+
467+
# Debug print versions
468+
echo "Versions:"
469+
echo $security_plugin_version
470+
echo $security_plugin_version_no_snapshot
471+
echo $security_plugin_version_only_number
472+
echo $test_qualifier
473+
474+
# Publish SPI
475+
./gradlew clean :opensearch-resource-sharing-spi:publishToMavenLocal && test -s ./spi/build/libs/opensearch-resource-sharing-spi-$security_plugin_version.jar
476+
./gradlew clean :opensearch-resource-sharing-spi:publishToMavenLocal -Dbuild.snapshot=false && test -s ./spi/build/libs/opensearch-resource-sharing-spi-$security_plugin_version_no_snapshot.jar
477+
./gradlew clean :opensearch-resource-sharing-spi:publishToMavenLocal -Dbuild.snapshot=false -Dbuild.version_qualifier=$test_qualifier && test -s ./spi/build/libs/opensearch-resource-sharing-spi-$security_plugin_version_only_number-$test_qualifier.jar
478+
./gradlew clean :opensearch-resource-sharing-spi:publishToMavenLocal -Dbuild.version_qualifier=$test_qualifier && test -s ./spi/build/libs/opensearch-resource-sharing-spi-$security_plugin_version_only_number-$test_qualifier-SNAPSHOT.jar
479+
480+
481+
# Build artifacts
482+
./gradlew clean assemble && \
483+
test -s ./build/distributions/opensearch-security-$security_plugin_version.zip && \
484+
test -s ./spi/build/libs/opensearch-resource-sharing-spi-$security_plugin_version.jar
485+
486+
./gradlew clean assemble -Dbuild.snapshot=false && \
487+
test -s ./build/distributions/opensearch-security-$security_plugin_version_no_snapshot.zip && \
488+
test -s ./spi/build/libs/opensearch-resource-sharing-spi-$security_plugin_version_no_snapshot.jar
489+
490+
./gradlew clean assemble -Dbuild.snapshot=false -Dbuild.version_qualifier=$test_qualifier && \
491+
test -s ./build/distributions/opensearch-security-$security_plugin_version_only_number-$test_qualifier.zip && \
492+
test -s ./spi/build/libs/opensearch-resource-sharing-spi-$security_plugin_version_only_number-$test_qualifier.jar
493+
494+
./gradlew clean assemble -Dbuild.version_qualifier=$test_qualifier && \
495+
test -s ./build/distributions/opensearch-security-$security_plugin_version_only_number-$test_qualifier-SNAPSHOT.zip && \
496+
test -s ./spi/build/libs/opensearch-resource-sharing-spi-$security_plugin_version_only_number-$test_qualifier-SNAPSHOT.jar
497+
498+
./gradlew clean publishPluginZipPublicationToZipStagingRepository && \
499+
test -s ./build/distributions/opensearch-security-$security_plugin_version.zip && \
500+
test -s ./build/distributions/opensearch-security-$security_plugin_version.pom && \
501+
test -s ./spi/build/libs/opensearch-resource-sharing-spi-$security_plugin_version.jar
502+
503+
./gradlew clean publishShadowPublicationToMavenLocal && \
504+
test -s ./spi/build/libs/opensearch-resource-sharing-spi-$security_plugin_version.jar
505+
506+
- name: List files in build directory on failure
342507
if: failure()
508+
run: ls -al ./*/build/libs/ ./build/distributions/

‎.github/workflows/maven-publish.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,4 +32,4 @@ jobs:
3232
export SONATYPE_PASSWORD=$(aws secretsmanager get-secret-value --secret-id maven-snapshots-password --query SecretString --output text)
3333
echo "::add-mask::$SONATYPE_USERNAME"
3434
echo "::add-mask::$SONATYPE_PASSWORD"
35-
./gradlew publishPluginZipPublicationToSnapshotsRepository
35+
./gradlew --no-daemon publishPluginZipPublicationToSnapshotsRepository publishShadowPublicationToSnapshotsRepository

‎.gitignore‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,3 @@ out/
4343
build/
4444
gradle-build/
4545
.gradle/
46-
47-
# nodejs
48-
node_modules/
49-
package-lock.json

0 commit comments

Comments
 (0)