This commit adds waits for two Netty threads that run in the background
and require explicit calls to await inactivity in them. This shows up
as an issue in security tests since we always use netty and do not have
these waits so these threads can trip the thread leak detector.
relates elastic/x-pack-elasticsearch#4367
Original commit: elastic/x-pack-elasticsearch@76d84553ba
The `create` privilege can be misleading based on a user's
interpretation of the meaning of the privilege. The create privilege
grants the user access to the index api and the put mapping api. The
index api allows for a document to be created but it also allows for
an existing document to be overwritten (assuming the CREATE operation
type is not used). However, the name `create` implies the ability to
only create a document and not be able to modify an existing document,
which may not be clear to users unfamiliar with the index API.
This commit adds a small note under the privilege in the documentation
that should add some clarity to the operations allowed by this
privilege.
Original commit: elastic/x-pack-elasticsearch@24596c41b0
* Remove copy-pasted code
An examination of the x-pack source code revealed copy-pasted code
in ActiveDirectoryGroupsResolver in the binarySidToStringSid
method. I have replaced this with an apache2 implementation from
the apache directory studio project. Furthermore, I have added
a test that leverages a real binary/string SID pair retrieved
from an active directory domain controller. The apache2-based
implementation is exempt for the license checker.
Original commit: elastic/x-pack-elasticsearch@81a7471261
The bulk thread pool was renamed to the write thread pool. This commit
adds support for this in X-Pack. Specifically, a change is needed in
monitoring to reflect the name change (and support the possibility that
the user has the display name for the write thread pool as "bulk").
Original commit: elastic/x-pack-elasticsearch@c3c4b99be5
The index thread pool is gone, so the index thread pool stats do not any
longer need to be whitelisted in the monitoring stats.
Original commit: elastic/x-pack-elasticsearch@83f7742805
When calculating the current load on each ML node during the
node allocation process we should be ignoring failed jobs.
This is because failed jobs do not have a corresponding native
process, so do not consume memory or CPU resources.
relates elastic/x-pack-elasticsearch#4381
Original commit: elastic/x-pack-elasticsearch@1cb0ca973e
These tests test actually watcher 6.x features and are not needed in the
master branch anymore, as there is no way that watcher is running on the
master node only in Elaticsearch 7.x.
Original commit: elastic/x-pack-elasticsearch@ac5b933994
Rolling up indices that contain multiple schemas requires extra
considerations for the user, and in some cases, some limitations. This
commit tries to enumerate the issues so the user is aware.
Original commit: elastic/x-pack-elasticsearch@bf96eeab4e
Instead of allowing the `_xpack/monitoring/_bulk` to remain on the same
thread, it should execute on a separate thread to avoid blocking the
http worker thread whenever the exporters get stuck waiting on the
monitoring cluster.
Original commit: elastic/x-pack-elasticsearch@25ce9a4df0
Updates documentation describing the parameters for optionally signing the
SAML medatata document that the saml-metadata command creates.
Original commit: elastic/x-pack-elasticsearch@0e8146541a
Previously "certutil" would generate a zip file if there were multiple
certificates.
However, this means that if the user specified "-multiple" or "-in"
then the output format will vary based on whether they entered
multiple instance names (-multiple) or whether the input file
contained multiple instance records (-in).
It is better if the output format is predictable based on the command
line options, so this change forces zip output whenever any of the
following command line options are supplied:
-pem
-keep-ca-key
-multiple
-in
Original commit: elastic/x-pack-elasticsearch@344baa5f17
The handling of the "--pass" option has complex rules due to the
different requirements of different output formats, and the way
joptsimple handles specs with optional arguments.
A standard unix shell will parse
certutil --pass=""
as being identical to
certutil --pass=
and joptsimple treats that as being "no argument", i.e. the same as
certutil --pass
The only way to pass a blank password is
certutil --pass ""
(though this is shell dependent)
Original commit: elastic/x-pack-elasticsearch@bc09d0f298
OpenSAML requires that the context classloader be set to the
classloader that contains the opensaml jar files in order to
initialise itself. However, sometimesrthis seems to cause the
classloading for slf4j/log4j to take place while that context
classloader is set, which fails.
This change forces slf4j/log4j to be initialised prior to setting
the context classloader.
Original commit: elastic/x-pack-elasticsearch@85ed8eb488
This ignores data collection when the cluster is not ready, in addition to
the existing check that ignores when the cluster state's version is
unknown.
Original commit: elastic/x-pack-elasticsearch@54257d7e6f
Rollup was using a historical `rollup` doc type, when we should be using
`_doc` so that it is forward-compatible with the removal in 8.0
Original commit: elastic/x-pack-elasticsearch@4b3188e6c8
This is required so the Logstash Centralized Configuration Management UI in Kibana may make the GET / request to Elasticsearch and retrieve the cluster UUID. It then uses this cluster UUID to make a call to a Kibana Monitoring API to retrieve a list of pipelines from Monitoring. In order for the Kibana Monitoring API request to succeed, the logged-in user needs to have the built-in monitoring_user role anyway, so we give this role the cluster:monitor/main privilege.
Original commit: elastic/x-pack-elasticsearch@bf6ad5c1df
This changes the behaviour of AbstractWatcherIntegrationTestCase and its
startWatcher/stopWatcher methods. Instead of checking for the target
state and just starting or stopping if it does not match, the methods
now wait for certain states to be reached before starting or stopping.
This will fix test failures where a failure is started instead of
stopped or vice versa.
Original commit: elastic/x-pack-elasticsearch@f0b0954803
Fix bug in checking whether the expression properties has been
modified or not.
Change test to move from SIN to SQRT (as the former seem to return
different values (extra digit) across JDK versions - 8 vs 10)
Fixelastic/x-pack-elasticsearch#4335
Original commit: elastic/x-pack-elasticsearch@8f672c455d
In the ClusterPrivilegeTests class, the code was resetting the node
after each test and failures were seen in CI that were HTTP 401 when
a 403 was expected. This commit removes the resetting of the node
between tests as this was not necessary.
Additionally, there is an issue in the SecuritySingleNodeTestCase where
the rest client was not torn down afterstopping a node and starting a
new node. This means the client used in other tests would not be
connected to the right cluster. This change resolves this by tearing
down the rest client after the old node is torn down.
relates elastic/x-pack-elasticsearch#4383
Original commit: elastic/x-pack-elasticsearch@2f81a4b2e2
Currently there is a hardcoded check against 10000, which
is the default value of the max_result_window setting. This
is a relic of the past. Removing this hardcoded validation
means we respect the setting so that a user may alter it
when appropriate.
relates elastic/x-pack-elasticsearch#3672
Original commit: elastic/x-pack-elasticsearch@9c9c5bab89
- Changes in build SAML SP metadata to support multiple
encryption keys.
- Changes in Saml metadata command to support the use of
protected keystores.
- Changes to export and set proper usage type in key
descriptors of SP saml metadata XML.
- Changes in SAML realm to create chaining key info
credential resolver backed by Collection of encryption
keys as per SP configuration.
- Unit tests and test enhancements
relates elastic/x-pack-elasticsearch#3980,elastic/x-pack-elasticsearch#4293
Original commit: elastic/x-pack-elasticsearch@e02ebcc9e6
Some build tasks require older JDKs. For example, the BWC build tasks
for older versions of Elasticsearch require older JDKs. It is onerous to
require these be configured when merely compiling Elasticsearch, the
requirement that they be strictly set to appropriate values should only
be enforced if these tasks are going to be executed. To address this, we
lazy configure these tasks.
Original commit: elastic/x-pack-elasticsearch@804a11c243
This commit sets the BWC builds to use the version of the JDK that is
appropriate for the indvidual version of Elasticsearch under test.
Original commit: elastic/x-pack-elasticsearch@967a497a20
SYS TYPE returns an integer instead of a boolean (the bug was caused
by reading the ODBC spec which refers to the wire representation instead
of the JDBC one which uses primitives)
Original commit: elastic/x-pack-elasticsearch@f9fe64ab0d
Improve grammar to allow use of ? as an alternative to STRING
through-out all commands
Add various parsing tests checking the ? usage for SYS commands
Original commit: elastic/x-pack-elasticsearch@d0d1feeb4c
The IndexPrivilegeTests have been notoriously slow for years.
@polyfractal identified the primary issue, which is that these tests
were running against an internal cluster with 1 or 2 data nodes and had
the number of replicas set to 1 for indices by default and the methods
in the test would perform a wait for green. This wait for green would
take the full thirty seconds when there was a single data node as the
index could never reach green health due to an unassigned replica. This
could have been caught earlier by asserting the request did not timeout
but this assertion was not present.
This change does a few things to address the issues above. The first is
that these tests now extend SecuritySingleNodeTestCase, which is a new
class that extends ESSingleNodeTestCase and contains the necessary
logic for the setup and teardown of security; much of which is based
off of SecurityIntegTestCase. This means that these tests always run
against a single node cluster and have a much simpler setup. The
default index template for these tests applies settings so that indices
are created with a single shard and no replicas.
Assertions have been added to ensure the health checks with a wait for
green status have not timed out. A handcoded wait for snapshots to
finish has been replaced with an assertBusy call. Finally, the BadApple
annotation has been removed from the test.
Relates elastic/x-pack-elasticsearch#324
Original commit: elastic/x-pack-elasticsearch@572919273d
This changes JDBC so it can be released. It bundles the
`sql-shared-client` and `sql-proto` jars into the jar for the jdbc client.
It also Generates a pom for the jdbc driver when you run `gradle assemble`
on it. This will allow us to release the jdbc driver.
It also adds a zip distribution of the jdbc driver with all of its
dependencies bundled in the zip. It'd be nice to bundle all of the jdbc
driver's dependencies in the jar but we can't quite do that yet. So, for
now, to help folks using BI tools use the JDBC driver, we build a zip.
Original commit: elastic/x-pack-elasticsearch@9c668231d4
Rewrote the GROUP BY to use composite aggregation instead of terms
(and everything that comes with it) but instead rely on composite aggregation
This not only works better but simplifies the code complexity since
composite is a straight, two-level tree:
1. root/group-by/composite-keys
2. (metric) aggregations
This removes a lot of complexity from all stages that involve creating,
assembling and especially parsing the results.
By moving to composite agg, the aggregation/GROUP BY are now pageable
so the consumer/listener had to be extended to include a dedicated
cursor and specific (bucket) extractors inline with the scroll requests.
While at it, also improved the support for implicit GROUP BY by
formalizing it (previously it supported only counts and no other
agg).
In addition:
Fixed a JDBC bug that caused incorrect timeout to be passed
Improved the returned RowSet a bit and add better naming
Pick up @Nullable move from core
Make sure to specify the TimeZone for DateTimeHistogram extraction
Add missing javadoc
To avoid delegating NamedWriteableRegistry (NWR) and to keep the scope
clean, SQL writeables now handle their own serialization, keeping the
boundary between the Elasticsearch's NWR in place.
Pass NamedWriteableRegistry only when looking at the next page
To keep in line with the existing patter and simplify the code
bureaucracy, the deserialization happens directly.
Since the SearchSourceBuilder deserialization happens explicitly (and
it's otherwise opaque), the declarative invocation isn't necessary
anymore.
Add a bit more randomization in tests
Original commit: elastic/x-pack-elasticsearch@f5af046386
Jay Modi
Russ Cam
tomcallahan
Jason Tedor
Ryan Ernst
Lisa Cawley
David Roberts
Alexander Reelsen
Zachary Tong
Adrien Grand
Chris Earle
Ioannis Kakavas
Tim Vernum
Zachary Tong
Shaunak Kashyap
Costin Leau
jaymode
javanna
Dimitris Athanasiou
Yogesh Gaikwad
Costin Leau
Nik Everett