Skip to content

Commit 1a7560d

Browse files
willyborankinwillyborankin
committed
Fix cluster default initialization #1
Signed-off-by: Andrey Pleskach <ples@aiven.io>
1 parent 6f79d09 commit 1a7560d

20 files changed

+1790
-95
lines changed

‎build.gradle‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -617,7 +617,8 @@ dependencies {
617617
testImplementation 'org.apache.camel:camel-xmlsecurity:3.22.1'
618618

619619
//OpenSAML
620-
implementation 'net.shibboleth.utilities:java-support:8.4.0'
620+
implementation "net.shibboleth.utilities:java-support:8.4.0"
621+
runtimeOnly "io.dropwizard.metrics:metrics-core:4.2.15"
621622
implementation "com.onelogin:java-saml:${one_login_java_saml}"
622623
implementation "com.onelogin:java-saml-core:${one_login_java_saml}"
623624
implementation "org.opensaml:opensaml-core:${open_saml_version}"
@@ -643,7 +644,6 @@ dependencies {
643644
runtimeOnly 'com.google.j2objc:j2objc-annotations:2.8'
644645
compileOnly 'com.google.code.findbugs:jsr305:3.0.2'
645646
runtimeOnly 'org.lz4:lz4-java:1.8.0'
646-
runtimeOnly 'io.dropwizard.metrics:metrics-core:4.2.25'
647647
runtimeOnly 'org.slf4j:slf4j-api:1.7.36'
648648
runtimeOnly "org.apache.logging.log4j:log4j-slf4j-impl:${versions.log4j}"
649649
runtimeOnly 'org.xerial.snappy:snappy-java:1.1.10.5'
@@ -704,12 +704,12 @@ dependencies {
704704
exclude(group:'org.springframework', module: 'spring-jcl' )
705705
}
706706
testRuntimeOnly 'org.scala-lang:scala-library:2.13.13'
707-
testRuntimeOnly 'com.yammer.metrics:metrics-core:2.2.0'
708707
testRuntimeOnly 'com.typesafe.scala-logging:scala-logging_3:3.9.5'
709708
testRuntimeOnly('org.apache.zookeeper:zookeeper:3.9.2') {
710709
exclude(group:'ch.qos.logback', module: 'logback-classic' )
711710
exclude(group:'ch.qos.logback', module: 'logback-core' )
712711
}
712+
testRuntimeOnly 'com.yammer.metrics:metrics-core:2.2.0'
713713
testRuntimeOnly "org.apache.kafka:kafka-metadata:${kafka_version}"
714714
testRuntimeOnly "org.apache.kafka:kafka-storage:${kafka_version}"
715715

‎src/integrationTest/java/org/opensearch/security/DefaultConfigurationTests.java‎ renamed to ‎src/integrationTest/java/org/opensearch/security/AbstractDefaultConfigurationTests.java‎

Lines changed: 53 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
/*
2-
* Copyright OpenSearch Contributors
3-
* SPDX-License-Identifier: Apache-2.0
4-
*
5-
* The OpenSearch Contributors require contributions made to
6-
* this file be licensed under the Apache-2.0 license or a
7-
* compatible open source license.
8-
*
9-
*/
2+
* Copyright OpenSearch Contributors
3+
* SPDX-License-Identifier: Apache-2.0
4+
*
5+
* The OpenSearch Contributors require contributions made to
6+
* this file be licensed under the Apache-2.0 license or a
7+
* compatible open source license.
8+
*
9+
*/
1010
package org.opensearch.security;
1111

1212
import java.io.IOException;
@@ -19,47 +19,39 @@
1919
import com.carrotsearch.randomizedtesting.annotations.ThreadLeakScope;
2020
import com.fasterxml.jackson.databind.JsonNode;
2121
import org.apache.commons.io.FileUtils;
22+
import org.apache.http.HttpStatus;
2223
import org.awaitility.Awaitility;
2324
import org.junit.AfterClass;
24-
import org.junit.ClassRule;
2525
import org.junit.Test;
2626
import org.junit.runner.RunWith;
2727

28-
import org.opensearch.test.framework.TestSecurityConfig.User;
29-
import org.opensearch.test.framework.cluster.ClusterManager;
28+
import org.opensearch.security.state.SecurityMetadata;
29+
import org.opensearch.test.framework.TestSecurityConfig;
3030
import org.opensearch.test.framework.cluster.LocalCluster;
3131
import org.opensearch.test.framework.cluster.TestRestClient;
32-
import org.opensearch.test.framework.cluster.TestRestClient.HttpResponse;
3332

3433
import static org.hamcrest.MatcherAssert.assertThat;
3534
import static org.hamcrest.Matchers.aMapWithSize;
3635
import static org.hamcrest.Matchers.allOf;
3736
import static org.hamcrest.Matchers.equalTo;
3837
import static org.hamcrest.Matchers.hasKey;
3938
import static org.hamcrest.Matchers.not;
39+
import static org.junit.Assert.assertNotNull;
40+
import static org.junit.Assert.assertTrue;
4041

4142
@RunWith(com.carrotsearch.randomizedtesting.RandomizedRunner.class)
4243
@ThreadLeakScope(ThreadLeakScope.Scope.NONE)
43-
public class DefaultConfigurationTests {
44-
45-
private final static Path configurationFolder = ConfigurationFiles.createConfigurationDirectory();
46-
private static final User ADMIN_USER = new User("admin");
47-
private static final User NEW_USER = new User("new-user");
48-
private static final User LIMITED_USER = new User("limited-user");
49-
50-
@ClassRule
51-
public static LocalCluster cluster = new LocalCluster.Builder().clusterManager(ClusterManager.SINGLENODE)
52-
.nodeSettings(
53-
Map.of(
54-
"plugins.security.allow_default_init_securityindex",
55-
true,
56-
"plugins.security.restapi.roles_enabled",
57-
List.of("user_admin__all_access")
58-
)
59-
)
60-
.defaultConfigurationInitDirectory(configurationFolder.toString())
61-
.loadConfigurationIntoIndex(false)
62-
.build();
44+
public abstract class AbstractDefaultConfigurationTests {
45+
public final static Path configurationFolder = ConfigurationFiles.createConfigurationDirectory();
46+
private static final TestSecurityConfig.User ADMIN_USER = new TestSecurityConfig.User("admin");
47+
private static final TestSecurityConfig.User NEW_USER = new TestSecurityConfig.User("new-user");
48+
private static final TestSecurityConfig.User LIMITED_USER = new TestSecurityConfig.User("limited-user");
49+
50+
private final LocalCluster cluster;
51+
52+
protected AbstractDefaultConfigurationTests(LocalCluster cluster) {
53+
this.cluster = cluster;
54+
}
6355

6456
@AfterClass
6557
public static void cleanConfigurationDirectory() throws IOException {
@@ -73,18 +65,43 @@ public void shouldLoadDefaultConfiguration() {
7365
}
7466
try (TestRestClient client = cluster.getRestClient(ADMIN_USER)) {
7567
client.confirmCorrectCredentials(ADMIN_USER.getName());
76-
HttpResponse response = client.get("_plugins/_security/api/internalusers");
77-
response.assertStatusCode(200);
68+
TestRestClient.HttpResponse response = client.get("_plugins/_security/api/internalusers");
69+
response.assertStatusCode(HttpStatus.SC_OK);
7870
Map<String, Object> users = response.getBodyAs(Map.class);
7971
assertThat(
72+
response.getBody(),
8073
users,
8174
allOf(aMapWithSize(3), hasKey(ADMIN_USER.getName()), hasKey(NEW_USER.getName()), hasKey(LIMITED_USER.getName()))
8275
);
8376
}
8477
}
8578

79+
void assertClusterState(final TestRestClient client) {
80+
if (cluster.node().settings().getAsBoolean("plugins.security.allow_default_init_securityindex.use_cluster_state", false)) {
81+
final TestRestClient.HttpResponse response = client.get("_cluster/state");
82+
response.assertStatusCode(HttpStatus.SC_OK);
83+
final var clusterState = response.getBodyAs(Map.class);
84+
assertTrue(response.getBody(), clusterState.containsKey(SecurityMetadata.TYPE));
85+
@SuppressWarnings("unchecked")
86+
final var securityClusterState = (Map<String, Object>) clusterState.get(SecurityMetadata.TYPE);
87+
@SuppressWarnings("unchecked")
88+
final var securityConfiguration = (Map<String, Object>) ((Map<?, ?>) clusterState.get(SecurityMetadata.TYPE)).get(
89+
"configuration"
90+
);
91+
assertTrue(response.getBody(), securityClusterState.containsKey("created"));
92+
assertNotNull(response.getBody(), securityClusterState.get("created"));
93+
94+
for (final var k : securityConfiguration.keySet()) {
95+
@SuppressWarnings("unchecked")
96+
final var sc = (Map<String, Object>) securityConfiguration.get(k);
97+
assertTrue(response.getBody(), sc.containsKey("hash"));
98+
assertTrue(response.getBody(), sc.containsKey("last_modified"));
99+
}
100+
}
101+
}
102+
86103
@Test
87-
public void securityRolesUgrade() throws Exception {
104+
public void securityRolesUpgrade() throws Exception {
88105
try (var client = cluster.getRestClient(ADMIN_USER)) {
89106
// Setup: Make sure the config is ready before starting modifications
90107
Awaitility.await().alias("Load default configuration").until(() -> client.getAuthInfo().getStatusCode(), equalTo(200));
@@ -159,4 +176,5 @@ private Set<String> extractFieldNames(final JsonNode json) {
159176
json.fieldNames().forEachRemaining(set::add);
160177
return set;
161178
}
179+
162180
}

‎src/integrationTest/java/org/opensearch/security/DefaultConfigurationMultiNodeClusterTests.java‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
/*
2+
* Copyright OpenSearch Contributors
3+
* SPDX-License-Identifier: Apache-2.0
4+
*
5+
* The OpenSearch Contributors require contributions made to
6+
* this file be licensed under the Apache-2.0 license or a
7+
* compatible open source license.
8+
*
9+
*/
10+
package org.opensearch.security;
11+
12+
import java.util.List;
13+
import java.util.Map;
14+
15+
import org.junit.ClassRule;
16+
17+
import org.opensearch.test.framework.cluster.ClusterManager;
18+
import org.opensearch.test.framework.cluster.LocalCluster;
19+
20+
public class DefaultConfigurationMultiNodeClusterTests extends AbstractDefaultConfigurationTests {
21+
22+
@ClassRule
23+
public static LocalCluster cluster = new LocalCluster.Builder().clusterManager(ClusterManager.THREE_CLUSTER_MANAGERS)
24+
.nodeSettings(
25+
Map.of(
26+
"plugins.security.allow_default_init_securityindex",
27+
true,
28+
"plugins.security.restapi.roles_enabled",
29+
List.of("user_admin__all_access")
30+
)
31+
)
32+
.defaultConfigurationInitDirectory(configurationFolder.toString())
33+
.loadConfigurationIntoIndex(false)
34+
.build();
35+
36+
public DefaultConfigurationMultiNodeClusterTests() {
37+
super(cluster);
38+
}
39+
}

‎src/integrationTest/java/org/opensearch/security/DefaultConfigurationMultiNodeClusterUseClusterStateTests.java‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
/*
2+
* Copyright OpenSearch Contributors
3+
* SPDX-License-Identifier: Apache-2.0
4+
*
5+
* The OpenSearch Contributors require contributions made to
6+
* this file be licensed under the Apache-2.0 license or a
7+
* compatible open source license.
8+
*
9+
*/
10+
package org.opensearch.security;
11+
12+
import java.util.List;
13+
import java.util.Map;
14+
15+
import org.junit.ClassRule;
16+
17+
import org.opensearch.test.framework.cluster.ClusterManager;
18+
import org.opensearch.test.framework.cluster.LocalCluster;
19+
20+
public class DefaultConfigurationMultiNodeClusterUseClusterStateTests extends AbstractDefaultConfigurationTests {
21+
22+
@ClassRule
23+
public static LocalCluster cluster = new LocalCluster.Builder().clusterManager(ClusterManager.THREE_CLUSTER_MANAGERS)
24+
.nodeSettings(
25+
Map.of(
26+
"plugins.security.allow_default_init_securityindex",
27+
true,
28+
"plugins.security.allow_default_init_securityindex.use_cluster_state",
29+
true,
30+
"plugins.security.restapi.roles_enabled",
31+
List.of("user_admin__all_access")
32+
)
33+
)
34+
.defaultConfigurationInitDirectory(configurationFolder.toString())
35+
.loadConfigurationIntoIndex(false)
36+
.build();
37+
38+
public DefaultConfigurationMultiNodeClusterUseClusterStateTests() {
39+
super(cluster);
40+
}
41+
42+
}

‎src/integrationTest/java/org/opensearch/security/DefaultConfigurationSingleNodeClusterTests.java‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
/*
2+
* Copyright OpenSearch Contributors
3+
* SPDX-License-Identifier: Apache-2.0
4+
*
5+
* The OpenSearch Contributors require contributions made to
6+
* this file be licensed under the Apache-2.0 license or a
7+
* compatible open source license.
8+
*
9+
*/
10+
package org.opensearch.security;
11+
12+
import java.util.List;
13+
import java.util.Map;
14+
15+
import com.carrotsearch.randomizedtesting.annotations.ThreadLeakScope;
16+
import org.junit.ClassRule;
17+
import org.junit.runner.RunWith;
18+
19+
import org.opensearch.test.framework.cluster.ClusterManager;
20+
import org.opensearch.test.framework.cluster.LocalCluster;
21+
22+
@RunWith(com.carrotsearch.randomizedtesting.RandomizedRunner.class)
23+
@ThreadLeakScope(ThreadLeakScope.Scope.NONE)
24+
public class DefaultConfigurationSingleNodeClusterTests extends AbstractDefaultConfigurationTests {
25+
26+
@ClassRule
27+
public static LocalCluster cluster = new LocalCluster.Builder().clusterManager(ClusterManager.SINGLENODE)
28+
.nodeSettings(
29+
Map.of(
30+
"plugins.security.allow_default_init_securityindex",
31+
true,
32+
"plugins.security.restapi.roles_enabled",
33+
List.of("user_admin__all_access")
34+
)
35+
)
36+
.defaultConfigurationInitDirectory(configurationFolder.toString())
37+
.loadConfigurationIntoIndex(false)
38+
.build();
39+
40+
public DefaultConfigurationSingleNodeClusterTests() {
41+
super(cluster);
42+
}
43+
44+
}

‎src/integrationTest/java/org/opensearch/security/DefaultConfigurationSingleNodeClusterUseClusterStateTests.java‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
/*
2+
* Copyright OpenSearch Contributors
3+
* SPDX-License-Identifier: Apache-2.0
4+
*
5+
* The OpenSearch Contributors require contributions made to
6+
* this file be licensed under the Apache-2.0 license or a
7+
* compatible open source license.
8+
*
9+
*/
10+
package org.opensearch.security;
11+
12+
import java.util.List;
13+
import java.util.Map;
14+
15+
import org.junit.ClassRule;
16+
17+
import org.opensearch.test.framework.cluster.ClusterManager;
18+
import org.opensearch.test.framework.cluster.LocalCluster;
19+
20+
public class DefaultConfigurationSingleNodeClusterUseClusterStateTests extends AbstractDefaultConfigurationTests {
21+
22+
@ClassRule
23+
public static LocalCluster cluster = new LocalCluster.Builder().clusterManager(ClusterManager.SINGLENODE)
24+
.nodeSettings(
25+
Map.of(
26+
"plugins.security.allow_default_init_securityindex",
27+
true,
28+
"plugins.security.allow_default_init_securityindex.use_cluster_state",
29+
true,
30+
"plugins.security.restapi.roles_enabled",
31+
List.of("user_admin__all_access")
32+
)
33+
)
34+
.defaultConfigurationInitDirectory(configurationFolder.toString())
35+
.loadConfigurationIntoIndex(false)
36+
.build();
37+
38+
public DefaultConfigurationSingleNodeClusterUseClusterStateTests() {
39+
super(cluster);
40+
}
41+
42+
}

‎src/integrationTest/java/org/opensearch/security/SecurityConfigurationBootstrapTests.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,7 @@ public void shouldStillLoadSecurityConfigDuringBootstrapAndActiveConfigUpdateReq
124124
.put("action_groups.yml", CType.ACTIONGROUPS)
125125
.put("config.yml", CType.CONFIG)
126126
.put("roles.yml", CType.ROLES)
127+
.put("roles_mapping.yml", CType.ROLESMAPPING)
127128
.put("tenants.yml", CType.TENANTS)
128129
.build();
129130

@@ -146,7 +147,7 @@ public void shouldStillLoadSecurityConfigDuringBootstrapAndActiveConfigUpdateReq
146147
// After the configuration has been loaded, the rest clients should be able to connect successfully
147148
cluster.triggerConfigurationReloadForCTypes(
148149
internalNodeClient,
149-
List.of(CType.ACTIONGROUPS, CType.CONFIG, CType.ROLES, CType.TENANTS),
150+
List.of(CType.ACTIONGROUPS, CType.CONFIG, CType.ROLES, CType.ROLESMAPPING, CType.TENANTS),
150151
true
151152
);
152153
try (final TestRestClient freshClient = cluster.getRestClient(USER_ADMIN)) {

0 commit comments

Comments
 (0)