Enable custom roles and spaces in serverless projects by jeramysoucy · Pull Request #195584 · elastic/kibana

jeramysoucy · 2024-10-09T12:27:36Z

Closes #194933
Closes #192282

Summary

This PR updates the serverless project yml files to

enable custom roles for Elasticsearch and Security projects
enable multiple spaces (max 100) for all serverless project types

Tests

Additionally, this PR adjust the serverless test suites. Originally, testing of roles and spaces endpoints was achieved from the feature flag test config. Now that these features are enabled by default, the tests have been migrated to the standard serverless test configs.

Affected tests:

x-pack/test_serverless/api_integration/test_suites/common/management/spaces.ts
x-pack/test_serverless/api_integration/test_suites/common/platform_security/authorization.ts
x-pack/test_serverless/functional/test_suites/common/platform_security/navigation/management_nav_cards.ts
x-pack/test_serverless/functional/test_suites/common/platform_security/roles.ts
x-pack/test_serverless/functional/test_suites/common/spaces/spaces_management.ts
x-pack/test_serverless/functional/test_suites/common/spaces/spaces_selection.ts
Feature flag configs/indices
Project specific configs/indices
Base serverless config

…aces in serverless, adjusts tests

…fix'

jeramysoucy · 2024-10-10T10:07:31Z

x-pack/test_serverless/api_integration/test_suites/observability/config.feature_flags.ts

    '--xpack.infra.enabled=true',
-    '--xpack.security.roleManagementEnabled=true', // enables custom roles
-    `--xpack.spaces.maxSpaces=100`, // enables spaces UI capabilities
+    '--xpack.security.roleManagementEnabled=true', // needed to check composite feautures in /observability/platform_security/authorization.ts


@azasypkin Should we expose the api/security/privileges endpoint in serverless even if role management is off? Currently, we do not.

Hmm, I’d say no, we shouldn’t. But would you mind giving me a bit of context? Do I understand correctly that we’ll still keep role/privilege-related tests for O11y, but only via the “feature_flags” config (unlike other project types for which we can finally move to base/normal configs)?

Thanks, I just wanted to confirm.

would you mind giving me a bit of context? Do I understand correctly that we’ll still keep role/privilege-related tests for O11y, but only via the “feature_flags” config (unlike other project types for which we can finally move to base/normal configs)?

Pretty much, yes. Specifics: there is a test to confirm the "composite features" functionality here:

kibana/x-pack/test_serverless/api_integration/test_suites/observability/platform_security/authorization.ts

Line 24 in 745fb62

it('composite features', async () => {

This test calls the api/security/privileges endpoint to validate how the oblt features have been configured for serverless, but this endpoint is only available when we enable role management so it needs to remain in the feature flag config until either oblt enabled custom roles, or we decide to register this route for other reasons.

but this endpoint is only available when we enable role management so it needs to remain in the feature flag config until either oblt enabled custom roles

Ah, got it, thanks, it makes sense to me 👍

…fix'

config/serverless.es.yml

azasypkin · 2024-10-10T14:08:46Z

x-pack/test_serverless/api_integration/test_suites/observability/config.feature_flags.ts

    '--xpack.infra.enabled=true',
-    '--xpack.security.roleManagementEnabled=true', // enables custom roles
-    `--xpack.spaces.maxSpaces=100`, // enables spaces UI capabilities
+    '--xpack.security.roleManagementEnabled=true', // needed to check composite feautures in /observability/platform_security/authorization.ts


Hmm, I’d say no, we shouldn’t. But would you mind giving me a bit of context? Do I understand correctly that we’ll still keep role/privilege-related tests for O11y, but only via the “feature_flags” config (unlike other project types for which we can finally move to base/normal configs)?

…fig to standard config for es and sec project types

jloleysens

Nice work @jeramysoucy !

eokoneyo

Shared UX changes LGTM

dmlemeshko

appex-qa changes LGTM

dmlemeshko · 2024-10-15T12:32:46Z

x-pack/test_serverless/shared/config.base.ts

+        // normally below is injected by control plane
+        `--xpack.cloud.serverless.project_id=fakeprojectid`,
+        `--xpack.cloud.base_url=https://fake-cloud.elastic.co`,
+        `--xpack.cloud.projects_url=/projects/`,
+        `--xpack.cloud.profile_url=/user/settings/`,
+        `--xpack.cloud.billing_url=/billing/overview/`,
+        `--xpack.cloud.deployments_url=/deployments`,
+        `--xpack.cloud.organization_url=/account/`,
+        `--xpack.cloud.users_and_roles_url=/account/members/`,


Thanks a lot for addressing it!

yngrdyn

Test changes LGTM

azasypkin · 2024-10-17T09:38:47Z

ACK: will review today

azasypkin

Great job! I left a few nits and one question regarding running custom roles tests for O11y once the team is ready to develop and test them.

config/serverless.yml

x-pack/test_serverless/shared/config.base.ts

x-pack/test_serverless/api_integration/test_suites/common/management/spaces.ts

x-pack/test_serverless/api_integration/test_suites/common/platform_security/authorization.ts

azasypkin · 2024-10-17T16:26:58Z

x-pack/test_serverless/functional/test_suites/observability/config.feature_flags.ts

  // include settings from project controller
  // https://github.com/elastic/project-controller/blob/main/internal/project/observability/config/elasticsearch.yml
-  esServerArgs: ['xpack.ml.dfa.enabled=false', 'xpack.security.authc.native_roles.enabled=true'],
+  esServerArgs: ['xpack.ml.dfa.enabled=false'],


question: When the O11y solution is ready to start working on custom roles functionality and would like to run tests related to roles regularly - locally, on CI, and in MKI - but aren’t ready to enable roles in production yet, what would be our recommendation? Will they need to remove "skip" flags and add the necessary overrides in GitOps to enable custom roles functionality in QA only to ensure we can run MKI tests?

Good question. I guess we have a couple of options:

Retain the feature flag tests for OBLT to use (however, I don't think these get run on MKI)

Adjust skip flags and FTR config, enable in QA/Staging, keep disabled in prod

Maybe @pheyos has a better suggestion?

I think we only rarely want to enable feature flags broadly in a whole env for testing and custom roles for Observability does not really qualify for an exception there IMO. Here's what I think they should do once they're ready to test:

get feature flag tests in - doesn't run on MKI but shows that things are functional

create one or more test projects in MKI and override the setting for these projects in order to test end-to-end

run the feature flag tests against this project

If that's all looking good:

make sure no existing tests are breaking if custom roles are enabled

step by step enabled the feature in QA, Staging and Production

then move the feature flag tests to regular tests

Thanks, Robert! @azasypkin Do you think we should we split out the roles tests and set the feature flag test back up for OBLT now? Not sure what their timeframe is for enabling custom role; it sounds like it is not in their roadmap - I'll forward you an email I got from Chris DiStasio.

Thanks, @jeramysoucy. TL;DR: let’s keep what you have here.

Since there are no immediate signs that O11y is planning to introduce custom roles anytime soon (though I believe this might change quickly with GA), I don’t think we need to make the testing setup more complex than it needs to be. Once the O11y team is ready, we’ll propose what Robert outlined above and provide any necessary assistance if needed.

jeramysoucy · 2024-10-21T09:53:56Z

Thanks @azasypkin! I addressed all feedback in 74639ce

…t --include-path /api/status --include-path /api/alerting/rule/ --include-path /api/alerting/rules --include-path /api/actions --include-path /api/security/role --include-path /api/spaces --include-path /api/fleet --update'

…taging'

elasticmachine · 2024-10-21T16:26:02Z

💚 Build Succeeded

Buildkite Build
Commit: 504802b

Metrics [docs]

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`serverless`	14.1KB	14.1KB	+1.0B

History

💔 Build #244264 failed e9462c3
💔 Build #244224 failed e663a71
💚 Build #242602 succeeded 3fbbf40
💛 Build #242501 was flaky f3e47b4
💔 Build #242003 failed 3d77eaa
💔 Build #241972 failed 3dc49a4

cc @jeramysoucy

…#198827) ## Summary [#195584](#195584) inadvertently removed the cleanup of created roles during testing. This PR restores the missing call to clean up any created roles.

Enables custom roles for search and sec projects, enabled multiple sp…

76e99dc

…aces in serverless, adjusts tests

jeramysoucy changed the title ~~Enables custom roles and spaces in serverless projects~~ Enable custom roles and spaces in serverless projects Oct 9, 2024

jeramysoucy added the Team:Security Platform Security: Auth, Users, Roles, Spaces, Audit Logging, etc t// label Oct 9, 2024

jeramysoucy self-assigned this Oct 9, 2024

jeramysoucy added v9.0.0 v8.16.0 release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting labels Oct 9, 2024

jeramysoucy and others added 4 commits October 9, 2024 14:30

Merge branch 'main' into enable-roles-space-serverless

998c76f

[CI] Auto-commit changed files from 'node scripts/lint_ts_projects --…

b7286c2

…fix'

Fixes imports, unused var

e12a3d8

Fixes OBLT feature flag config - Kibana role management needed

7236e7a

jeramysoucy commented Oct 10, 2024

View reviewed changes

[CI] Auto-commit changed files from 'node scripts/lint_ts_projects --…

e33d371

…fix'

azasypkin reviewed Oct 10, 2024

View reviewed changes

jeramysoucy added 6 commits October 10, 2024 16:39

Updates serverless functional tests

4e9cb4f

Move custom roles to default config, disable in oblt

1d132b1

Moves solution specific privilege-related tests from feature flag con…

4e6bfa9

…fig to standard config for es and sec project types

Reorganizes authorization tests

cd0d8e4

Merge branch 'main' into enable-roles-space-serverless

1994ad6

Merge branch 'main' into enable-roles-space-serverless

2bb0766

jeramysoucy mentioned this pull request Oct 11, 2024

[FTR] support custom native roles in serverless tests #194677

Merged

Restores missing feature flag kibana config setting

5cee6b2

jeramysoucy marked this pull request as ready for review October 11, 2024 13:17

jeramysoucy requested review from a team as code owners October 11, 2024 13:17

Merge branch 'main' into enable-roles-space-serverless

3dc49a4

jloleysens approved these changes Oct 14, 2024

View reviewed changes

jeramysoucy added 3 commits October 14, 2024 11:10

Fixes accidental deletion

3d77eaa

Updates the url in card nav for user and role management

83e3bbc

Merge branch 'main' into enable-roles-space-serverless

f3e47b4

ElenaStoeva approved these changes Oct 15, 2024

View reviewed changes

eokoneyo approved these changes Oct 15, 2024

View reviewed changes

Merge branch 'main' into enable-roles-space-serverless

3fbbf40

dmlemeshko approved these changes Oct 15, 2024

View reviewed changes

yngrdyn approved these changes Oct 15, 2024

View reviewed changes

sphilipse approved these changes Oct 16, 2024

View reviewed changes

azasypkin self-requested a review October 17, 2024 09:38

azasypkin approved these changes Oct 17, 2024

View reviewed changes

semd approved these changes Oct 18, 2024

View reviewed changes

Fixes typos, comments, and default config

74639ce

jeramysoucy and others added 5 commits October 21, 2024 11:57

Merge branch 'main' into enable-roles-space-serverless

6a375a2

[CI] Auto-commit changed files from 'make api-docs && make api-docs-s…

e663a71

…taging'

Fixes bad merge on oblt feature flag config

e9462c3

Updates config unit test

504802b

jeramysoucy enabled auto-merge (squash) October 21, 2024 16:17

jeramysoucy merged commit c73bfd2 into elastic:main Oct 21, 2024

jeramysoucy mentioned this pull request Nov 4, 2024

Adds cleanup to serverless platform security authorization test suite #198827

Merged

sabarasaba mentioned this pull request Nov 12, 2024

Adjust serverless tests that got skipped after roles and spaces changes #190621

Closed

Conversation

jeramysoucy commented Oct 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Tests

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jloleysens left a comment

Choose a reason for hiding this comment

Uh oh!

eokoneyo left a comment

Choose a reason for hiding this comment

Uh oh!

dmlemeshko left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yngrdyn left a comment

Choose a reason for hiding this comment

Uh oh!

azasypkin commented Oct 17, 2024

Uh oh!

azasypkin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pheyos Oct 21, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jeramysoucy Oct 21, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jeramysoucy commented Oct 21, 2024

Uh oh!

elasticmachine commented Oct 21, 2024

💚 Build Succeeded

Metrics [docs]

Page load bundle

History

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

jeramysoucy commented Oct 9, 2024 •

edited

Loading

pheyos Oct 21, 2024 •

edited

Loading

jeramysoucy Oct 21, 2024 •

edited

Loading