Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[8.16](backport #5889) Add integration tests using a proxy with mTLS for control plane with Elastic Defend installed #5942

Merged
merged 3 commits into from
Nov 14, 2024

Conversation

mergify[bot]
Copy link
Contributor

@mergify mergify bot commented Nov 5, 2024

What does this PR do?

Add integration tests for the Elastic Agent running Elastic Defend with a mTLS proxy
See #5716 for tje covered test cases

Why is it important?

To have automated tests covering mTLS and Elastic Defend

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • [ ] I have made corresponding changes to the documentation
  • [ ] I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • [ ] I have added an entry in ./changelog/fragments using the [changelog tool](https://github.com/elastic/elastic-agent#changelog)
  • I have added an integration test or an E2E test

Disruptive User Impact

  • N/A

How to test this PR locally

In short, manually reproduce the tests described on #5716.

The long version:

  • run 3 proxies:

    • mTLScli -> a proxy with mTLS to be passed as cli arguments
    • mTLSpolicy -> a proxy with mTLS configured through the policy
    • oneWayTLSpolicy -> a proxy with simple/one way TLS which defines its CA in the policy
    • all the certificates must be RSA because of an Elastic Defend restriction
  • set up the proxies:

    • add a test to testing/integration/endpoint_security_test.go to configure and run the needed proxies:
func TestDebugTestProxies(t *testing.T) {
	prepareProxies(t, &url.URL{Host: "a.wrong.fleet.host"}, "the.real.fleet.host")

	t.Logf("CTRL + C to exit")
	<-make(chan struct{})
}
  • run the test with:
go test -v -timeout 0 -tags integration -run TestDebugTestProxies ./testing/integration/

=== RUN   TestDebugTestProxies
    endpoint_security_test.go:1333: [mtlsCLI] certificates saved on: /tmp/TestDebugTestProxies-mtlsCLI2475114678
    endpoint_security_test.go:1333: [mtlsPolicy] certificates saved on: /tmp/TestDebugTestProxies-mtlsPolicy1317235685
    endpoint_security_test.go:1333: [oneWayTLSPolicy] certificates saved on: /tmp/TestDebugTestProxies-oneWayTLSPolicy327431283

Related issues

Questions to ask yourself

  • How are we going to support this in production?
  • How are we going to measure its adoption?
  • How are we going to debug this?
  • What are the metrics I should take care of?
  • ...

This is an automatic backport of pull request #5889 done by [Mergify](https://mergify.com).

@mergify mergify bot requested a review from a team as a code owner November 5, 2024 16:35
@mergify mergify bot added backport conflicts There is a conflict in the backported pull request labels Nov 5, 2024
@mergify mergify bot requested review from pkoutsovasilis and michel-laterman and removed request for a team November 5, 2024 16:35
Copy link
Contributor Author

mergify bot commented Nov 5, 2024

Cherry-pick of a338543 has failed:

On branch mergify/bp/8.16/pr-5889
Your branch is up to date with 'origin/8.16'.

You are currently cherry-picking commit a3385439b5.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   pkg/testing/define/define.go
	modified:   pkg/testing/fixture.go
	modified:   pkg/testing/fixture_install.go
	modified:   pkg/testing/tools/tools.go
	modified:   testing/integration/endpoint_security_test.go
	modified:   testing/integration/endpoint_test_tools.go

Unmerged paths:
  (use "git add/rm <file>..." as appropriate to mark resolution)
	deleted by us:   testing/proxytest/https.go
	both modified:   testing/proxytest/proxytest.go

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

@pierrehilbert pierrehilbert requested review from AndersonQ and removed request for pkoutsovasilis and michel-laterman November 5, 2024 17:08
@pierrehilbert pierrehilbert added the Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team label Nov 5, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

@AndersonQ AndersonQ changed the title [8.16](backport #5889) Add integration tests using a proxy with mTLS for control plane with Elastic Defend installed [DO NOT MERGE - wait 8.16 release][8.16](backport #5889) Add integration tests using a proxy with mTLS for control plane with Elastic Defend installed Nov 6, 2024
@AndersonQ AndersonQ marked this pull request as draft November 7, 2024 16:21
Copy link
Contributor Author

mergify bot commented Nov 11, 2024

This pull request has not been merged yet. Could you please review and merge it @AndersonQ? 🙏

@AndersonQ AndersonQ changed the title [DO NOT MERGE - wait 8.16 release][8.16](backport #5889) Add integration tests using a proxy with mTLS for control plane with Elastic Defend installed [8.16](backport #5889) Add integration tests using a proxy with mTLS for control plane with Elastic Defend installed Nov 14, 2024
Copy link
Contributor Author

mergify bot commented Nov 14, 2024

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b mergify/bp/8.16/pr-5889 upstream/mergify/bp/8.16/pr-5889
git merge upstream/8.16
git push upstream mergify/bp/8.16/pr-5889

…Elastic Defend installed (#5889)

(cherry picked from commit a338543)

# Conflicts:
#	testing/proxytest/https.go
#	testing/proxytest/proxytest.go
@AndersonQ AndersonQ force-pushed the mergify/bp/8.16/pr-5889 branch from eb56c09 to e027cd8 Compare November 14, 2024 11:24
@AndersonQ AndersonQ marked this pull request as ready for review November 14, 2024 13:10
Copy link

@AndersonQ AndersonQ merged commit 4926e3a into 8.16 Nov 14, 2024
14 checks passed
@AndersonQ AndersonQ deleted the mergify/bp/8.16/pr-5889 branch November 14, 2024 15:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport conflicts There is a conflict in the backported pull request Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants