Add support for ESOs in the "Check Saved Objects" CI check by gsoldevila · Pull Request #253470 · elastic/kibana

gsoldevila · 2026-02-17T14:40:56Z

Summary

Closes https://github.com/elastic/kibana-team/issues/2867

The Check Saved Objects CI check performs automated upgrade and rollback testing for any updated SO types.
None of the Encrypted Saved Objects had been updated since the check was put in place, up until recently.

To add support for ESOs, the KibanaMigratorTestKit must accept an encryptedSavedObjects service, so that the underlying SOR can be built with the encryption extension.

This PR adds a workaround to support encryption / decryption in the KibanaMigratorTestKit, unblocking #252104.

Made with Cursor

jeramysoucy · 2026-02-18T13:53:13Z

src/platform/packages/private/kbn-migrator-test-kit/src/kibana_migrator_test_kit.ts

+      .map(({ name }) => name),
+    {
+      encryptionExtension: encryptedSavedObjects
+        ? encryptedSavedObjects?.__testCreateExtension(typeRegistry)


Here is where you could pass in overrides for specific types, like the connector token. Something like this:

const savedObjectsRepository = SavedObjectsRepository.createRepository( migrator, typeRegistry, kibanaIndex, client, loggerFactory.get('saved_objects'), // the toolkit's SavedObjectsRepository must allow testing hidden types typeRegistry .getAllTypes() .filter(({ hidden }) => hidden) .map(({ name }) => name), { encryptionExtension: encryptedSavedObjects ? encryptedSavedObjects?.__testCreateExtension(typeRegistry, [ { type: 'connector_token', attributesToEncrypt: new Set(['token']), attributesToIncludeInAAD: new Set([ 'connectorId', 'tokenType', 'expiresAt', 'createdAt', 'updatedAt', ]), }, ]) : undefined, } );

Though, it would probably make sense to store the overrides somewhere for easier access/clarity.

packages/kbn-check-saved-objects-cli/src/commands/tasks/test_rollback.ts

gsoldevila · 2026-02-20T15:04:27Z

packages/kbn-check-saved-objects-cli/src/commands/types.ts

  fix: boolean;
 }
+
+export const encryptionOverrides: EncryptedSavedObjectTypeRegistration[] = [


I'm sure someone will inject something soon! 😆

src/platform/packages/private/kbn-migrator-test-kit/src/kibana_migrator_test_kit.ts

elasticmachine · 2026-02-20T15:07:47Z

Pinging @elastic/kibana-core (Team:Core)

jloleysens

Approving to unblock progress, left a q about a possible simplification

jloleysens · 2026-02-23T10:06:23Z

x-pack/platform/plugins/shared/encrypted_saved_objects/server/plugin.ts

+      __testCreateDangerousExtension: (
+        typeRegistry: ISavedObjectTypeRegistry,
+        typeRegistrationOverrides?: EncryptedSavedObjectTypeRegistration[]
+      ): SavedObjectsEncryptionExtension => {
+        const testService = new EncryptedSavedObjectsService({
+          primaryCrypto: this.primaryCrypto,
+          decryptionOnlyCryptos: this.decryptionOnlyCryptos,
+          logger: this.logger,
+        });
+
+        const registeredTypes = new Set<string>();
+
+        for (const typeRegistration of typeRegistrationOverrides ?? []) {
+          testService.registerType(dangerouslyExposeAttributes(typeRegistration));
+          registeredTypes.add(typeRegistration.type);
+        }
+
+        for (const typeRegistration of this.typeRegistrations) {
+          if (!registeredTypes.has(typeRegistration.type)) {
+            testService.registerType(dangerouslyExposeAttributes(typeRegistration));
+          }
+        }
+
+        return new SavedObjectsEncryptionExtension({
+          baseTypeRegistry: typeRegistry,
+          service: testService,
+          getCurrentUser: async () => undefined,
+        });
+      },


Is it possible for this to be a stateless function exported from x-pack/platform/plugins/shared/encrypted_saved_objects/server?

Then test migrator kit can pass in typeRegistry, typeRegistry overrides and logger. Just not sure about the crypto values... are they easy to mock or create test counterparts for? We could also avoid coreStart._plugins workaround.

It would be possible, but we'd have to move a few things that are currently encapsulated in the ESO plugin class or define them in the test code.

The primary and decryption-only Crypto instances. Without providing this internally in the plugin, the test code would need to create these instances. The decryption-only cryptos would likely just be an empty array. So this could be as simple as passing in an encryption key for the primary crypto from the test code.

The array of registered types derived from the setup phase. Without providing this internally in the plugin, the test code would need to register all applicable ESO types, which could become a pain.

I can push a commit with these changes and ask @azasypkin if hew has a preference.

@azasypkin After discussing with Gerard, given this is a temporary solution, we're going to hold off making further changes. So, this PR is ready for review. Let us know your thoughts on JL's suggestion.

jloleysens · 2026-02-23T10:07:43Z

src/core/packages/root/server-internal/src/server.ts


-    await this.plugins.start(this.coreStart);
+    const { contracts } = await this.plugins.start(this.coreStart);
+    this.coreStart._plugins = contracts;


I think this is OK given this is all internal to Core.

Adds a temporary `_plugins` property to `InternalCoreStart` that exposes the plugin start contracts map. This is intended for internal use only and enables `kbn-check-saved-objects-cli` to access the `encryptedSavedObjects` plugin, which is needed to add ESO support to the saved objects check tooling. Co-authored-by: Cursor <cursoragent@cursor.com>

…ensions

… connector token ESO for testing

Removes commented console log

elasticmachine · 2026-02-24T14:05:30Z

Pinging @elastic/obs-ux-management-team (Team:obs-ux-management)

kdelemme

Mock update looks good to me

azasypkin · 2026-02-24T16:32:59Z

ACK: will review today, sorry for the delay

azasypkin

LGTM, just one non-blocking suggestion to not keep test-only registration state for production use and concentrate everything within the encryption service.

x-pack/platform/plugins/shared/encrypted_saved_objects/server/plugin.ts

…ngerous clone function

elasticmachine · 2026-02-25T12:17:58Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: de9e6a5

Failed CI Steps

Test Failures

[job] [logs] Jest Tests #6 / discover responsive sidebar search bar customization should not render CustomDataViewPicker

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`@kbn/migrator-test-kit`	47	49	+2
`encryptedSavedObjects`	47	49	+2
total			+4

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
`encryptedSavedObjects`	1	2	+1

Unknown metric groups

API count

id	before	after	diff
`@kbn/migrator-test-kit`	47	49	+2
`encryptedSavedObjects`	54	57	+3
total			+5

History

💛 Build #400066 was flaky 1326be5
💔 Build #400051 failed d3d615d
💔 Build #399989 failed c7048e4
💔 Build #399974 failed 28668af
💔 Build #399945 failed 226c754
💔 Build #398573 failed 76df0a4

cc @jeramysoucy

…53470) ## Summary Closes elastic/kibana-team#2867 The `Check Saved Objects` CI check performs automated upgrade and rollback testing for any updated SO types. None of the Encrypted Saved Objects had been updated since the check was put in place, up until recently. To add support for ESOs, the `KibanaMigratorTestKit` must accept an _encryptedSavedObjects_ service, so that the underlying SOR can be built with the encryption extension. This PR adds a workaround to support encryption / decryption in the `KibanaMigratorTestKit`, unblocking elastic#252104. Made with [Cursor](https://cursor.com) --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: “jeramysoucy” <jeramy.soucy@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

gsoldevila added Team:Core Platform Core services: plugins, logging, config, saved objects, http, ES client, i18n, etc t// release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting labels Feb 17, 2026

gsoldevila requested a review from jeramysoucy February 17, 2026 14:41

jeramysoucy reviewed Feb 18, 2026

View reviewed changes

jeramysoucy reviewed Feb 20, 2026

View reviewed changes

packages/kbn-check-saved-objects-cli/src/commands/tasks/test_rollback.ts Outdated Show resolved Hide resolved

jeramysoucy force-pushed the core/expose-plugins-start-contract branch from ef3c7b6 to 1fec797 Compare February 20, 2026 14:23

gsoldevila changed the title ~~Expose _plugins map on internal core start contract~~ Add support for ESOs in the "Check Saved Objects" CI check Feb 20, 2026

gsoldevila commented Feb 20, 2026

View reviewed changes

src/platform/packages/private/kbn-migrator-test-kit/src/kibana_migrator_test_kit.ts Outdated Show resolved Hide resolved

gsoldevila marked this pull request as ready for review February 20, 2026 15:07

gsoldevila requested review from a team as code owners February 20, 2026 15:07

gsoldevila requested a review from azasypkin February 20, 2026 15:07

jeramysoucy self-assigned this Feb 20, 2026

jloleysens approved these changes Feb 23, 2026

View reviewed changes

gsoldevila and others added 9 commits February 24, 2026 13:01

Simplify extraction

2167e9d

Adds ESO domain functionality to support creating test encryption ext…

3914c7d

…ensions

Updates new test function and call sites, adds code to test change to…

fcb557f

… connector token ESO for testing

Adds overrides to types and adds usage in rollback test

f9da1d6

Removes connector token changes used for testing

ce4117d

Update kibana_migrator_test_kit.ts

3545289

Removes commented console log

Changes from node scripts/lint_ts_projects --fix

83b611b

Changes from node scripts/regenerate_moon_projects.js --update

28668af

gsoldevila force-pushed the core/expose-plugins-start-contract branch from 226c754 to 28668af Compare February 24, 2026 12:03

gsoldevila added 2 commits February 24, 2026 13:28

Remove dependency from migrator-test-kit to ESO plugin

c7048e4

Replace remaining call to getKibanaMigratorTestKit; fix mocks

1326be5

gsoldevila force-pushed the core/expose-plugins-start-contract branch from d3d615d to 1326be5 Compare February 24, 2026 14:05

gsoldevila requested a review from a team as a code owner February 24, 2026 14:05

botelastic bot added the Team:obs-ux-management label Feb 24, 2026

kdelemme approved these changes Feb 24, 2026

View reviewed changes

azasypkin approved these changes Feb 24, 2026

View reviewed changes

x-pack/platform/plugins/shared/encrypted_saved_objects/server/plugin.ts Outdated Show resolved Hide resolved

Replaces additional plugin members with private service member and da…

de9e6a5

…ngerous clone function

jeramysoucy enabled auto-merge (squash) February 25, 2026 10:34

jeramysoucy merged commit 3cd82b3 into elastic:main Feb 25, 2026
16 checks passed

kibanamachine added the v9.4.0 label Feb 25, 2026

lorenabalan mentioned this pull request Feb 26, 2026

[ResponseOps][PerUserAuth] Update kbn core code used for CI when oauth_authorization_code FF is enabled #255092

Closed

Conversation

gsoldevila commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

jeramysoucy Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gsoldevila Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elasticmachine commented Feb 20, 2026

Uh oh!

jloleysens left a comment

Choose a reason for hiding this comment

Uh oh!

jloleysens Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

jeramysoucy Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

jeramysoucy Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

jloleysens Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Feb 24, 2026

Uh oh!

kdelemme left a comment

Choose a reason for hiding this comment

Uh oh!

azasypkin commented Feb 24, 2026

Uh oh!

azasypkin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

elasticmachine commented Feb 25, 2026

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Public APIs missing comments

Public APIs missing exports

API count

History

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

gsoldevila commented Feb 17, 2026 •

edited

Loading