[CI] ServiceAccountIT classMethod failing #92930
Comments
slobodanadamovic
added
Team:Security
|
Pinging @elastic/es-security (Team:Security) |
|
There seems to be an issue with host name which is passed to The problem is that The in this concrete case the list had 2 addresses:
Note: Using the IPv6 address causes the issue, while using IPv4 doesn't. I've raised a PR which, as a workaround, sets |
slobodanadamovic
added
:Delivery/Build
|
Pinging @elastic/es-delivery (Team:Delivery) |
|
@slobodanadamovic Thanks for looking into it. I invested sometime trying to understand the failure as well. It was puzzling to me because the It turned out to be related to FIPS. As a side effect of moving test cluster setup to JUnit, the client ( I think ideally we do not want the test cluster setup client to run with FIPS since it can potentially create unnecessary maintainence burden. I am not sure how feasible it is to separate them though. This behaviour can probably be argued to be "more correct" since actual rest tests do run in FIPS mode and they are also mostly client code (different client implementations). @mark-vieira If we accept this new behaviour, one possible workaround is to disable hostname verification for the setup client, e.g. something like the following works: diff --git a/test/test-clusters/src/main/java/org/elasticsearch/test/cluster/local/WaitForHttpResource.java b/test/test-clusters/src/main/java/org/elasticsearch/test/cluster/local/WaitForHttpResource.java
index edab2cdf1e7..8ee9169f8c9 100644
--- a/test/test-clusters/src/main/java/org/elasticsearch/test/cluster/local/WaitForHttpResource.java
+++ b/test/test-clusters/src/main/java/org/elasticsearch/test/cluster/local/WaitForHttpResource.java
@@ -140,8 +140,9 @@ public class WaitForHttpResource {
private void configureSslContext(HttpURLConnection connection, SSLContext ssl) {
if (ssl != null) {
- if (connection instanceof HttpsURLConnection) {
- ((HttpsURLConnection) connection).setSSLSocketFactory(ssl.getSocketFactory());
+ if (connection instanceof final HttpsURLConnection httpsURLConnection) {
+ httpsURLConnection.setSSLSocketFactory(ssl.getSocketFactory());
+ httpsURLConnection.setHostnameVerifier((hostname, sslSession) -> true);
} else {
throw new IllegalStateException("SSL trust has been configured, but [" + url + "] is not a 'https' URL");
}Obviously there are other alternatives. I have no strong opinion on how it should be fixed. But it would be better if individual test class does not have to deal with it as suggested by Slobodan. |
This commit adds a workaround for failing `ServiceAccountIT` test by explicitly setting a host name to `localhost` instead of using default `_local_` address. Relates to #92930
|
@slobodanadamovic this is also failing on 8.6 if you want to backport your fix: https://gradle-enterprise.elastic.co/s/vng6xiitobh3c |
|
I actually now see that we aren't properly setting up test clusters using the new framework for FIPS at all. This is an oversight and I'll get that fixed along with a proper fix for this that doesn't require hard-coding |
This commit adds a workaround for failing `ServiceAccountIT` test by explicitly setting a host name to `localhost` instead of using default `_local_` address. Relates to elastic#92930 (cherry picked from commit 96d3fce)
Build scan:
https://gradle-enterprise.elastic.co/s/ugoqwcksbynes/tests/:x-pack:plugin:security:qa:service-account:javaRestTest/org.elasticsearch.xpack.security.authc.service.ServiceAccountIT
Reproduction line:
Applicable branches:
main
Reproduces locally?:
Didn't try
Failure history:
https://gradle-enterprise.elastic.co/scans/tests?tests.container=org.elasticsearch.xpack.security.authc.service.ServiceAccountIT&tests.test=classMethod
Failure excerpt:
Edit: Added reproduction line.
The text was updated successfully, but these errors were encountered: