|
| 1 | +/* |
| 2 | + * This file is part of ReadonlyREST. |
| 3 | + * |
| 4 | + * ReadonlyREST is free software: you can redistribute it and/or modify |
| 5 | + * it under the terms of the GNU General Public License as published by |
| 6 | + * the Free Software Foundation, either version 3 of the License, or |
| 7 | + * (at your option) any later version. |
| 8 | + * |
| 9 | + * ReadonlyREST is distributed in the hope that it will be useful, |
| 10 | + * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 11 | + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 12 | + * GNU General Public License for more details. |
| 13 | + * |
| 14 | + * You should have received a copy of the GNU General Public License |
| 15 | + * along with ReadonlyREST. If not, see http://www.gnu.org/licenses/ |
| 16 | + */ |
| 17 | +package tech.beshu.ror.tools |
| 18 | + |
| 19 | +import cats.data.NonEmptyList |
| 20 | +import com.github.dockerjava.api.DockerClient |
| 21 | +import monix.eval.Task |
| 22 | +import monix.execution.Scheduler |
| 23 | +import monix.execution.atomic.AtomicInt |
| 24 | +import org.scalatest.matchers.must.Matchers.include |
| 25 | +import org.scalatest.matchers.should.Matchers.{should, shouldNot} |
| 26 | +import org.scalatest.wordspec.AnyWordSpec |
| 27 | +import org.testcontainers.DockerClientFactory |
| 28 | +import tech.beshu.ror.integration.utils.ESVersionSupportForAnyWordSpecLike |
| 29 | +import tech.beshu.ror.utils.containers.* |
| 30 | +import tech.beshu.ror.utils.containers.EsContainerCreator.EsNodeSettings |
| 31 | +import tech.beshu.ror.utils.containers.images.Elasticsearch.EsInstallationType |
| 32 | +import tech.beshu.ror.utils.containers.images.ReadonlyRestWithEnabledXpackSecurityPlugin |
| 33 | +import tech.beshu.ror.utils.containers.logs.DockerLogsToStringConsumer |
| 34 | +import tech.beshu.ror.utils.elasticsearch.BaseManager.JSON |
| 35 | +import tech.beshu.ror.utils.elasticsearch.SearchManager |
| 36 | +import tech.beshu.ror.utils.httpclient.RestClient |
| 37 | +import tech.beshu.ror.utils.misc.EsModulePatterns |
| 38 | + |
| 39 | +import scala.concurrent.duration.* |
| 40 | +import scala.language.postfixOps |
| 41 | +import scala.util.Try |
| 42 | + |
| 43 | +// There is a change introduced in Elasticsearch since versions 9.0.1 and 8.18.1 (older ES versions are not affected) |
| 44 | +// The change: https://github.com/elastic/elasticsearch/pull/126852 ("With this PR we restrict the paths we allow access to, forbidding plugins to specify/request entitlements for reading or writing to specific protected directories.") |
| 45 | +// In our use case it causes problems with apt-based installations of ES and patching: |
| 46 | +// - ROR cannot check (on startup) whether the ES is patched |
| 47 | +// - that is because after the aforementioned change in ES, the ROR plugin cannot access the /usr/share/elasticsearch directory |
| 48 | +// - we bypass this problem (ROR plugin cannot check the patch status, so it just allows to continue starting ES, with warning in logs) |
| 49 | +// This test suite verifies, that both official ES image and apt-based ES installation with ROR can start. Logs are also asserted to detect the warning. |
| 50 | +class PatchingOfAptBasedEsInstallationSuite extends AnyWordSpec with ESVersionSupportForAnyWordSpecLike { |
| 51 | + |
| 52 | + import PatchingOfAptBasedEsInstallationSuite.* |
| 53 | + |
| 54 | + implicit val scheduler: Scheduler = Scheduler.computation(10) |
| 55 | + |
| 56 | + private val validRorConfigFile = "/basic/readonlyrest.yml" |
| 57 | + |
| 58 | + "ES" when { |
| 59 | + "using official ES image" should { |
| 60 | + "successfully load ROR plugin and start (patch verification without warning)" in { |
| 61 | + val dockerLogs = withTestEsContainerManager(EsInstallationType.EsDockerImage) { esContainer => |
| 62 | + testRorStartup(usingManager = esContainer) |
| 63 | + } |
| 64 | + dockerLogs should include("ReadonlyREST is waiting for full Elasticsearch init") |
| 65 | + dockerLogs should include("Elasticsearch fully initiated. ReadonlyREST can continue ...") |
| 66 | + dockerLogs should include("Loading Elasticsearch settings from file: /usr/share/elasticsearch/config/elasticsearch.yml") |
| 67 | + dockerLogs shouldNot include("Cannot verify if the ES was patched") |
| 68 | + dockerLogs should include("ReadonlyREST was loaded") |
| 69 | + } |
| 70 | + } |
| 71 | + "installed on Ubuntu using apt" should { |
| 72 | + // ES 6.x is not available as apt package, so we do not test it |
| 73 | + "ES {7.x, 8.0.x - 8.17.x} successfully load ROR plugin and start (without warning about not being able to verify patch)" excludeES(allEs6x, allEs9x, allEs818x) in { |
| 74 | + val dockerLogs = withTestEsContainerManager(EsInstallationType.UbuntuDockerImageWithEsFromApt) { esContainer => |
| 75 | + testRorStartup(usingManager = esContainer) |
| 76 | + } |
| 77 | + dockerLogs should include("ReadonlyREST is waiting for full Elasticsearch init") |
| 78 | + dockerLogs should include("Elasticsearch fully initiated. ReadonlyREST can continue ...") |
| 79 | + dockerLogs should include("Loading Elasticsearch settings from file: /etc/elasticsearch/elasticsearch.yml") |
| 80 | + dockerLogs shouldNot include("Cannot verify if the ES was patched") |
| 81 | + dockerLogs should include("ReadonlyREST was loaded") |
| 82 | + } |
| 83 | + "ES {8.18.x, 9.x} successfully load ROR plugin and start (with warning about not being able to verify patch)" excludeES(allEs6x, allEs7x, allEs8xBelowEs818x) in { |
| 84 | + val dockerLogs = withTestEsContainerManager(EsInstallationType.UbuntuDockerImageWithEsFromApt) { esContainer => |
| 85 | + testRorStartup(usingManager = esContainer) |
| 86 | + } |
| 87 | + dockerLogs should include("ReadonlyREST is waiting for full Elasticsearch init") |
| 88 | + dockerLogs should include("Elasticsearch fully initiated. ReadonlyREST can continue ...") |
| 89 | + dockerLogs should include("Loading Elasticsearch settings from file: /etc/elasticsearch/elasticsearch.yml") |
| 90 | + dockerLogs should include("Cannot verify if the ES was patched. component [readonlyrest], module [ALL-UNNAMED], class [class tech.beshu.ror.tools.core.utils.EsDirectory$], entitlement [file], operation [read], path [/usr/share/elasticsearch]") |
| 91 | + dockerLogs should include("ReadonlyREST was loaded") |
| 92 | + } |
| 93 | + } |
| 94 | + } |
| 95 | + |
| 96 | + private def withTestEsContainerManager(esInstallationType: EsInstallationType) |
| 97 | + (testCode: TestEsContainerManager => Task[Unit]): String = { |
| 98 | + val esContainer = new TestEsContainerManager(validRorConfigFile, esInstallationType) |
| 99 | + try { |
| 100 | + (for { |
| 101 | + _ <- esContainer.start() |
| 102 | + _ <- testCode(esContainer) |
| 103 | + } yield ()).runSyncUnsafe(5 minutes) |
| 104 | + esContainer.getLogs |
| 105 | + } finally { |
| 106 | + esContainer.stop().runSyncUnsafe() |
| 107 | + } |
| 108 | + } |
| 109 | + |
| 110 | + private def testRorStartup(usingManager: TestEsContainerManager): Task[Unit] = { |
| 111 | + for { |
| 112 | + restClient <- usingManager.createRestClient |
| 113 | + searchTestResults <- searchTest(restClient) |
| 114 | + result <- handleResult(searchTestResults) |
| 115 | + } yield result |
| 116 | + } |
| 117 | + |
| 118 | + private def searchTest(client: RestClient): Task[TestResponse] = Task.delay { |
| 119 | + val manager = new SearchManager(client, esVersionUsed) |
| 120 | + val response = manager.searchAll("*") |
| 121 | + TestResponse(response.responseCode, response.responseJson) |
| 122 | + } |
| 123 | + |
| 124 | + private def handleResult(result: TestResponse): Task[Unit] = { |
| 125 | + val hasEsRespondedWithSuccess = result.responseCode == 200 |
| 126 | + if (hasEsRespondedWithSuccess) { |
| 127 | + Task.unit |
| 128 | + } else { |
| 129 | + Task.raiseError(new IllegalStateException(s"Test failed. Expected success response but was: [$result]")) |
| 130 | + } |
| 131 | + } |
| 132 | +} |
| 133 | + |
| 134 | +private object PatchingOfAptBasedEsInstallationSuite extends EsModulePatterns { |
| 135 | + final case class TestResponse(responseCode: Int, responseJson: JSON) |
| 136 | + |
| 137 | + private val uniqueClusterId: AtomicInt = AtomicInt(1) |
| 138 | + |
| 139 | + final class TestEsContainerManager(rorConfigFile: String, esInstallationType: EsInstallationType) extends EsContainerCreator { |
| 140 | + |
| 141 | + private val dockerClient: DockerClient = DockerClientFactory.instance().client() |
| 142 | + |
| 143 | + private val dockerLogsCollector = new DockerLogsToStringConsumer |
| 144 | + |
| 145 | + private val esContainer = createEsContainer |
| 146 | + |
| 147 | + def start(): Task[Unit] = Task.delay(esContainer.start()) |
| 148 | + |
| 149 | + def stop(): Task[Unit] = for { |
| 150 | + _ <- Task.delay(esContainer.stop()) |
| 151 | + _ <- Task.delay(dockerClient.removeImageCmd(esContainer.imageFromDockerfile.get()).withForce(true).exec()) |
| 152 | + } yield () |
| 153 | + |
| 154 | + def getLogs: String = dockerLogsCollector.getLogs |
| 155 | + |
| 156 | + def createRestClient: Task[RestClient] = { |
| 157 | + Task.tailRecM(()) { _ => |
| 158 | + Task.delay(createAdminClient) |
| 159 | + } |
| 160 | + } |
| 161 | + |
| 162 | + private def createAdminClient = { |
| 163 | + Try(esContainer.adminClient) |
| 164 | + .toEither |
| 165 | + .left.map(_ => ()) |
| 166 | + } |
| 167 | + |
| 168 | + private def createEsContainer: EsContainer = { |
| 169 | + val clusterName = s"ROR_${uniqueClusterId.getAndIncrement()}" |
| 170 | + val nodeName = s"${clusterName}_1" |
| 171 | + create( |
| 172 | + nodeSettings = EsNodeSettings( |
| 173 | + nodeName = nodeName, |
| 174 | + clusterName = clusterName, |
| 175 | + securityType = SecurityType.RorWithXpackSecurity( |
| 176 | + ReadonlyRestWithEnabledXpackSecurityPlugin.Config.Attributes.default.copy( |
| 177 | + rorConfigFileName = rorConfigFile |
| 178 | + ) |
| 179 | + ), |
| 180 | + containerSpecification = ContainerSpecification.empty, |
| 181 | + esVersion = EsVersion.DeclaredInProject |
| 182 | + ), |
| 183 | + allNodeNames = NonEmptyList.of(nodeName), |
| 184 | + nodeDataInitializer = NoOpElasticsearchNodeDataInitializer, |
| 185 | + startedClusterDependencies = StartedClusterDependencies(List.empty), |
| 186 | + esInstallationType = esInstallationType, |
| 187 | + additionalLogConsumer = Some(dockerLogsCollector) |
| 188 | + ) |
| 189 | + } |
| 190 | + } |
| 191 | +} |
0 commit comments