Skip to content

Commit e638c76

Browse files
cliu123cliu123
authored
Introduce BWC tests in security plugin (opensearch-project#1685)
Signed-off-by: cliu123 <lc12251109@gmail.com>
1 parent f275fb9 commit e638c76

18 files changed

+914
-2
lines changed

‎.github/workflows/ci.yml

+7
Original file line numberDiff line numberDiff line change
@@ -61,3 +61,10 @@ jobs:
6161
with:
6262
token: ${{ secrets.CODECOV_TOKEN }}
6363
files: ./build/jacoco/test/jacocoTestReport.xml
64+
65+
- name: Run Security Backwards Compatibility Tests
66+
run: |
67+
echo "Running backwards compatibility tests ..."
68+
cp -r build/ ./bwc-test/
69+
cd bwc-test/
70+
./gradlew bwcTestSuite -Dtests.security.manager=false

‎build.gradle

-2
Original file line numberDiff line numberDiff line change
@@ -272,8 +272,6 @@ project.getConfigurations().all { Configuration configuration ->
272272
}
273273
};
274274

275-
276-
277275
task bundle(dependsOn: jar, type: Zip) {
278276
from configurations.runtimeClasspath - project.configurations.getByName('resolveableCompileOnly')
279277
from project.jar

‎bwc-test/build.gradle

+274
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,274 @@
1+
/*
2+
* SPDX-License-Identifier: Apache-2.0
3+
*
4+
* The OpenSearch Contributors require contributions made to
5+
* this file be licensed under the Apache-2.0 license or a
6+
* compatible open source license.
7+
*
8+
* Modifications Copyright OpenSearch Contributors. See
9+
* GitHub history for details.
10+
*/
11+
12+
/*
13+
* Licensed to Elasticsearch under one or more contributor
14+
* license agreements. See the NOTICE file distributed with
15+
* this work for additional information regarding copyright
16+
* ownership. Elasticsearch licenses this file to you under
17+
* the Apache License, Version 2.0 (the "License"); you may
18+
* not use this file except in compliance with the License.
19+
* You may obtain a copy of the License at
20+
*
21+
* http://www.apache.org/licenses/LICENSE-2.0
22+
*
23+
* Unless required by applicable law or agreed to in writing,
24+
* software distributed under the License is distributed on an
25+
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
26+
* KIND, either express or implied. See the License for the
27+
* specific language governing permissions and limitations
28+
* under the License.
29+
*/
30+
31+
import org.opensearch.gradle.testclusters.StandaloneRestIntegTestTask
32+
import java.util.concurrent.Callable
33+
34+
apply plugin: 'opensearch.build'
35+
apply plugin: 'opensearch.rest-test'
36+
apply plugin: 'java'
37+
38+
apply plugin: 'opensearch.testclusters'
39+
40+
compileTestJava.enabled = false
41+
42+
ext {
43+
projectSubstitutions = [:]
44+
licenseFile = rootProject.file('LICENSE.TXT')
45+
noticeFile = rootProject.file('NOTICE')
46+
}
47+
48+
buildscript {
49+
ext {
50+
opensearch_version = System.getProperty("opensearch.version", "1.3.0-SNAPSHOT")
51+
opensearch_group = "org.opensearch"
52+
}
53+
repositories {
54+
mavenLocal()
55+
maven { url "https://aws.oss.sonatype.org/content/repositories/snapshots" }
56+
mavenCentral()
57+
maven { url "https://plugins.gradle.org/m2/" }
58+
}
59+
60+
dependencies {
61+
classpath "${opensearch_group}.gradle:build-tools:${opensearch_version}"
62+
}
63+
}
64+
65+
repositories {
66+
mavenLocal()
67+
maven { url "https://aws.oss.sonatype.org/content/repositories/snapshots" }
68+
mavenCentral()
69+
maven { url "https://plugins.gradle.org/m2/" }
70+
}
71+
72+
dependencies {
73+
testImplementation "org.opensearch.test:framework:${opensearch_version}"
74+
}
75+
76+
String bwcVersion = "1.0.1.0";
77+
String baseName = "securityBwcCluster"
78+
String bwcFilePath = "src/test/resources/"
79+
String projectVersion = "1.3.0.0"
80+
81+
2.times {i ->
82+
testClusters {
83+
"${baseName}$i" {
84+
testDistribution = "ARCHIVE"
85+
versions = ["1.0.0","1.3.0-SNAPSHOT"]
86+
numberOfNodes = 3
87+
plugin(provider(new Callable<RegularFile>() {
88+
@Override
89+
RegularFile call() throws Exception {
90+
return new RegularFile() {
91+
@Override
92+
File getAsFile() {
93+
return fileTree(bwcFilePath + bwcVersion).getSingleFile()
94+
}
95+
}
96+
}
97+
}))
98+
nodes.each { node ->
99+
def plugins = node.plugins
100+
def firstPlugin = plugins.get(0)
101+
plugins.remove(0)
102+
plugins.add(firstPlugin)
103+
104+
node.extraConfigFile("kirk.pem", file("src/test/resources/security/kirk.pem"))
105+
node.extraConfigFile("kirk-key.pem", file("src/test/resources/security/kirk-key.pem"))
106+
node.extraConfigFile("esnode.pem", file("src/test/resources/security/esnode.pem"))
107+
node.extraConfigFile("esnode-key.pem", file("src/test/resources/security/esnode-key.pem"))
108+
node.extraConfigFile("root-ca.pem", file("src/test/resources/security/root-ca.pem"))
109+
node.setting("plugins.security.disabled", "true")
110+
node.setting("plugins.security.ssl.transport.pemcert_filepath", "esnode.pem")
111+
node.setting("plugins.security.ssl.transport.pemkey_filepath", "esnode-key.pem")
112+
node.setting("plugins.security.ssl.transport.pemtrustedcas_filepath", "root-ca.pem")
113+
node.setting("plugins.security.ssl.transport.enforce_hostname_verification", "false")
114+
node.setting("plugins.security.ssl.http.enabled", "true")
115+
node.setting("plugins.security.ssl.http.pemcert_filepath", "esnode.pem")
116+
node.setting("plugins.security.ssl.http.pemkey_filepath", "esnode-key.pem")
117+
node.setting("plugins.security.ssl.http.pemtrustedcas_filepath", "root-ca.pem")
118+
node.setting("plugins.security.allow_unsafe_democertificates", "true")
119+
node.setting("plugins.security.allow_default_init_securityindex", "true")
120+
node.setting("plugins.security.authcz.admin_dn", "CN=kirk,OU=client,O=client,L=test,C=de")
121+
node.setting("plugins.security.audit.type", "internal_elasticsearch")
122+
node.setting("plugins.security.enable_snapshot_restore_privilege", "true")
123+
node.setting("plugins.security.check_snapshot_restore_write_privileges", "true")
124+
node.setting("plugins.security.restapi.roles_enabled", "[\"all_access\", \"security_rest_api_access\"]")
125+
node.setting("plugins.security.system_indices.enabled", "true")
126+
}
127+
128+
setting 'path.repo', "${buildDir}/cluster/shared/repo/${baseName}"
129+
setting 'http.content_type.required', 'true'
130+
}
131+
}
132+
}
133+
134+
List<Provider<RegularFile>> plugins = [
135+
provider(new Callable<RegularFile>(){
136+
@Override
137+
RegularFile call() throws Exception {
138+
return new RegularFile() {
139+
@Override
140+
File getAsFile() {
141+
return fileTree(bwcFilePath + projectVersion).getSingleFile()
142+
}
143+
}
144+
}
145+
})
146+
]
147+
148+
// Creates a test cluster with 3 nodes of the old version.
149+
2.times {i ->
150+
task "${baseName}#oldVersionClusterTask$i"(type: StandaloneRestIntegTestTask) {
151+
exclude '**/*Test*'
152+
useCluster testClusters."${baseName}$i"
153+
exclude '**/*Test*'
154+
if (System.getProperty("mixedCluster") != null) {
155+
filter {
156+
includeTest("org.opensearch.security.bwc.SecurityBackwardsCompatibilityIT", "testPluginUpgradeInAMixedCluster")
157+
}
158+
}
159+
if (System.getProperty("rollingUpgradeCluster") != null) {
160+
filter {
161+
includeTest("org.opensearch.security.bwc.SecurityBackwardsCompatibilityIT", "testPluginUpgradeInARollingUpgradedCluster")
162+
}
163+
}
164+
if (System.getProperty("fullRestartCluster") != null) {
165+
filter {
166+
includeTest("org.opensearch.security.bwc.SecurityBackwardsCompatibilityIT", "testPluginUpgradeInAnUpgradedCluster")
167+
}
168+
}
169+
systemProperty 'tests.rest.bwcsuite', 'old_cluster'
170+
systemProperty 'tests.rest.bwcsuite_round', 'old'
171+
systemProperty 'tests.plugin_bwc_version', bwcVersion
172+
nonInputProperties.systemProperty('tests.rest.cluster', "${-> testClusters."${baseName}$i".allHttpSocketURI.join(",")}")
173+
nonInputProperties.systemProperty('tests.clustername', "${-> testClusters."${baseName}$i".getName()}")
174+
}
175+
}
176+
177+
// Upgrades one node of the old cluster to new OpenSearch version with upgraded plugin version
178+
// This results in a mixed cluster with 2 nodes on the old version and 1 upgraded node.
179+
// This is also used as a one third upgraded cluster for a rolling upgrade.
180+
task "${baseName}#mixedClusterTask"(type: StandaloneRestIntegTestTask) {
181+
exclude '**/*Test*'
182+
dependsOn "${baseName}#oldVersionClusterTask0"
183+
useCluster testClusters."${baseName}0"
184+
doFirst {
185+
testClusters."${baseName}0".upgradeNodeAndPluginToNextVersion(plugins)
186+
}
187+
if (System.getProperty("mixedCluster") != null) {
188+
filter {
189+
includeTest("org.opensearch.security.bwc.SecurityBackwardsCompatibilityIT", "testPluginUpgradeInAMixedCluster")
190+
}
191+
}
192+
if (System.getProperty("rollingUpgradeCluster") != null) {
193+
filter {
194+
includeTest("org.opensearch.security.bwc.SecurityBackwardsCompatibilityIT", "testPluginUpgradeInARollingUpgradedCluster")
195+
}
196+
}
197+
systemProperty 'tests.rest.bwcsuite', 'mixed_cluster'
198+
systemProperty 'tests.rest.bwcsuite_round', 'first'
199+
systemProperty 'tests.plugin_bwc_version', bwcVersion
200+
nonInputProperties.systemProperty('tests.rest.cluster', "${-> testClusters."${baseName}0".allHttpSocketURI.join(",")}")
201+
nonInputProperties.systemProperty('tests.clustername', "${-> testClusters."${baseName}0".getName()}")
202+
}
203+
204+
// Upgrades the second node to new OpenSearch version with upgraded plugin version after the first node is upgraded.
205+
// This results in a mixed cluster with 1 node on the old version and 2 upgraded nodes.
206+
// This is used for rolling upgrade.
207+
task "${baseName}#twoThirdsUpgradedClusterTask"(type: StandaloneRestIntegTestTask) {
208+
exclude '**/*Test*'
209+
dependsOn "${baseName}#mixedClusterTask"
210+
useCluster testClusters."${baseName}0"
211+
doFirst {
212+
testClusters."${baseName}0".upgradeNodeAndPluginToNextVersion(plugins)
213+
}
214+
if (System.getProperty("rollingUpgradeCluster") != null) {
215+
filter {
216+
includeTest("org.opensearch.security.bwc.SecurityBackwardsCompatibilityIT", "testPluginUpgradeInARollingUpgradedCluster")
217+
}
218+
}
219+
systemProperty 'tests.rest.bwcsuite', 'mixed_cluster'
220+
systemProperty 'tests.rest.bwcsuite_round', 'second'
221+
systemProperty 'tests.plugin_bwc_version', bwcVersion
222+
nonInputProperties.systemProperty('tests.rest.cluster', "${-> testClusters."${baseName}0".allHttpSocketURI.join(",")}")
223+
nonInputProperties.systemProperty('tests.clustername', "${-> testClusters."${baseName}0".getName()}")
224+
}
225+
226+
// Upgrades the third node to new OpenSearch version with upgraded plugin version after the second node is upgraded.
227+
// This results in a fully upgraded cluster.
228+
// This is used for rolling upgrade.
229+
task "${baseName}#rollingUpgradeClusterTask"(type: StandaloneRestIntegTestTask) {
230+
exclude '**/*Test*'
231+
dependsOn "${baseName}#twoThirdsUpgradedClusterTask"
232+
useCluster testClusters."${baseName}0"
233+
doFirst {
234+
testClusters."${baseName}0".upgradeNodeAndPluginToNextVersion(plugins)
235+
}
236+
if (System.getProperty("rollingUpgradeCluster") != null) {
237+
filter {
238+
includeTest("org.opensearch.security.bwc.SecurityBackwardsCompatibilityIT", "testPluginUpgradeInARollingUpgradedCluster")
239+
}
240+
}
241+
systemProperty 'tests.rest.bwcsuite', 'mixed_cluster'
242+
systemProperty 'tests.rest.bwcsuite_round', 'third'
243+
systemProperty 'tests.plugin_bwc_version', bwcVersion
244+
nonInputProperties.systemProperty('tests.rest.cluster', "${-> testClusters."${baseName}0".allHttpSocketURI.join(",")}")
245+
nonInputProperties.systemProperty('tests.clustername', "${-> testClusters."${baseName}0".getName()}")
246+
}
247+
248+
// Upgrades all the nodes of the old cluster to new OpenSearch version with upgraded plugin version
249+
// at the same time resulting in a fully upgraded cluster.
250+
tasks.register("${baseName}#fullRestartClusterTask", StandaloneRestIntegTestTask) {
251+
exclude '**/*Test*'
252+
dependsOn "${baseName}#oldVersionClusterTask1"
253+
useCluster testClusters."${baseName}1"
254+
doFirst {
255+
testClusters."${baseName}1".upgradeAllNodesAndPluginsToNextVersion(plugins)
256+
}
257+
if (System.getProperty("fullRestartCluster") != null) {
258+
filter {
259+
includeTest("org.opensearch.security.bwc.SecurityBackwardsCompatibilityIT", "testPluginUpgradeInAnUpgradedCluster")
260+
}
261+
}
262+
systemProperty 'tests.rest.bwcsuite', 'upgraded_cluster'
263+
systemProperty 'tests.plugin_bwc_version', bwcVersion
264+
nonInputProperties.systemProperty('tests.rest.cluster', "${-> testClusters."${baseName}1".allHttpSocketURI.join(",")}")
265+
nonInputProperties.systemProperty('tests.clustername', "${-> testClusters."${baseName}1".getName()}")
266+
}
267+
268+
// A bwc test suite which runs all the bwc tasks combined.
269+
task bwcTestSuite(type: StandaloneRestIntegTestTask) {
270+
exclude '**/*Test*'
271+
dependsOn tasks.named("${baseName}#mixedClusterTask")
272+
dependsOn tasks.named("${baseName}#rollingUpgradeClusterTask")
273+
dependsOn tasks.named("${baseName}#fullRestartClusterTask")
274+
}

‎bwc-test/gradle/wrapper/gradle-wrapper.jar

58.1 KB
Binary file not shown.

‎bwc-test/gradle/wrapper/gradle-wrapper.properties

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
distributionBase=GRADLE_USER_HOME
2+
distributionPath=wrapper/dists
3+
distributionUrl=https\://services.gradle.org/distributions/gradle-6.9-bin.zip
4+
zipStoreBase=GRADLE_USER_HOME
5+
zipStorePath=wrapper/dists

0 commit comments

Comments
 (0)