Merge branch 'main' into opentelemetry-config-remove-quotes

.buildkite/ftr_configs.yml

@@ -193,7 +193,6 @@ enabled:
   - x-pack/test/api_integration/config_security_basic.ts
   - x-pack/test/api_integration/config_security_trial.ts
   - x-pack/test/api_integration/apis/aiops/config.ts
-  - x-pack/test/api_integration/apis/asset_manager/config_when_disabled.ts
   - x-pack/test/api_integration/apis/cases/config.ts
   - x-pack/test/api_integration/apis/content_management/config.ts
   - x-pack/test/api_integration/apis/cloud_security_posture/config.ts

.buildkite/pipeline-utils/agent_images.ts

@@ -20,7 +20,7 @@ const DEFAULT_AGENT_IMAGE_CONFIG: AgentImageConfig = {
 const FIPS_AGENT_IMAGE_CONFIG: AgentImageConfig = {
   provider: 'gcp',
   image: 'family/kibana-fips-ubuntu-2004',
-  imageProject: 'elastic-images-qa',
+  imageProject: 'elastic-images-prod',
 };
 
 const GITHUB_PR_LABELS = process.env.GITHUB_PR_LABELS ?? '';

.buildkite/pipelines/es_serverless/verify_es_serverless_image.yml

@@ -5,7 +5,7 @@
 # SKIP_VERIFICATION: if set to 1/true, it will skip running all tests
 # SKIP_CYPRESS: if set to 1/true, it will skip running the cypress tests
 # FTR_EXTRA_ARGS: a string argument, if passed, it will be forwarded verbatim to the FTR run script
-# ES_SERVERLESS_IMAGE: the tag for the docker image to test, in the form of docker.elastic.co/elasticsearch-ci/elasticsearch-serverless:$TAG
+# ES_SERVERLESS_IMAGE: the full image path for the docker image to test
 # BUILDKITE_COMMIT: the commit hash of the kibana branch to test
 
 agents:
@@ -16,16 +16,7 @@ agents:
 
 steps:
   - label: "Annotate runtime parameters"
-    command: |
-      buildkite-agent annotate --context kibana-commit --style info "Kibana build hash: $BUILDKITE_BRANCH / $BUILDKITE_COMMIT"
-      cat << EOF | buildkite-agent annotate --context es-serverless-image --style info
-        ES Serverless image: \`$ES_SERVERLESS_IMAGE\`
-
-        To run this locally:
-        \`\`\`
-        node scripts/es serverless --image $ES_SERVERLESS_IMAGE
-        \`\`\`
-      EOF
+    command: .buildkite/scripts/steps/es_serverless/annotate_runtime_parameters.sh
 
   - group: "(:kibana: x :elastic:) Trigger Kibana Serverless suite"
     if: "build.env('SKIP_VERIFICATION') != '1' && build.env('SKIP_VERIFICATION') != 'true'"

.buildkite/pipelines/fips.yml

@@ -1,32 +1,63 @@
 env:
-  DISABLE_CI_STATS_SHIPPING: "true"
+  DISABLE_CI_STATS_SHIPPING: 'true'
+  KBN_ENABLE_FIPS: 'true'
+  TEST_BROWSER_HEADLESS: 1
+agents:
+  provider: 'gcp'
+  image: 'family/kibana-fips-ubuntu-2004'
+  imageProject: 'elastic-images-prod'
 steps:
+  - command: .buildkite/scripts/lifecycle/pre_build.sh
+    label: Pre-Build
+    key: pre-build
+    timeout_in_minutes: 10
+    agents:
+      machineType: n2-standard-2
+
+  - wait
+
   - command: .buildkite/scripts/steps/build_kibana.sh
     label: Build Kibana Distribution and Plugins
     agents:
-      image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-prod
-      provider: gcp
       machineType: n2-standard-16
       preemptible: true
     key: build
     if: "build.env('KIBANA_BUILD_ID') == null || build.env('KIBANA_BUILD_ID') == ''"
+    depends_on: pre-build
     timeout_in_minutes: 60
     retry:
       automatic:
-        - exit_status: "-1"
+        - exit_status: '-1'
           limit: 3
 
   - wait
 
-  - command: TEST_PACKAGE=fips .buildkite/scripts/steps/package_testing/test.sh
-    label: "Smoke testing for FIPS"
+  - command: .buildkite/scripts/steps/checks/verify_fips_enabled.sh
+    label: 'Verify FIPS Enabled'
+    depends_on: build
+    timeout_in_minutes: 10
+    agents:
+      machineType: n2-standard-2
+      preemptible: true
+
+  - command: .buildkite/scripts/steps/fips/smoke_test.sh
+    label: 'Pick Smoke Test Group Run Order'
+    depends_on: build
+    timeout_in_minutes: 10
+    env:
+      FTR_CONFIGS_SCRIPT: '.buildkite/scripts/steps/test/ftr_configs.sh'
+      FTR_EXTRA_ARGS: '$FTR_EXTRA_ARGS'
+      LIMIT_CONFIG_TYPE: 'functional'
+    retry:
+      automatic:
+        - exit_status: '*'
+          limit: 1
+
+  - wait: ~
+    continue_on_failure: true
+
+  - command: .buildkite/scripts/lifecycle/post_build.sh
+    label: Post-Build
+    timeout_in_minutes: 10
     agents:
-      image: family/kibana-ubuntu-2004
-      imageProject: elastic-images-prod
-      provider: gcp
-      enableNestedVirtualization: true
-      localSsds: 1
-      localSsdInterface: nvme
-      machineType: n2-standard-4
-    timeout_in_minutes: 600
+      machineType: n2-standard-2

.buildkite/pipelines/pull_request/observability_onboarding_cypress.yml

@@ -8,7 +8,6 @@ steps:
       - build
       - quick_checks
     timeout_in_minutes: 120
-    parallelism: 2
     retry:
       automatic:
         - exit_status: '-1'

.buildkite/scripts/pipelines/pull_request/pipeline.ts

@@ -83,7 +83,7 @@ const getPipeline = (filename: string, removeSteps = true) => {
 
     if (
       (await doAnyChangesMatch([
-        /^x-pack\/plugins\/observability_onboarding/,
+        /^x-pack\/plugins\/observability_solution\/observability_onboarding/,
         /^x-pack\/plugins\/fleet/,
       ])) ||
       GITHUB_PR_LABELS.includes('ci:all-cypress-suites')

.buildkite/scripts/steps/checks.sh

@@ -5,7 +5,7 @@ set -euo pipefail
 export DISABLE_BOOTSTRAP_VALIDATION=false
 .buildkite/scripts/bootstrap.sh
 
-if [[ "${FIPS_ENABLED:-}" == "true" ]]; then
+if [[ "${FTR_ENABLE_FIPS_AGENT:-}" == "true" ]]; then
   .buildkite/scripts/steps/checks/verify_fips_enabled.sh
 fi
 .buildkite/scripts/steps/checks/saved_objects_compat_changes.sh

.buildkite/scripts/steps/checks/verify_fips_enabled.sh

@@ -2,7 +2,11 @@
 
 set -euo pipefail
 
-source .buildkite/scripts/common/util.sh
+# This script is part of checks.sh in the PR pipeline but is called directly in the FIPS pipeline, so we need to bootstrap
+if [[ -z "${BASH_SOURCE[1]+x}" || "${BASH_SOURCE[1]}" != *"checks.sh"* ]]; then
+  export DISABLE_BOOTSTRAP_VALIDATION=false
+  .buildkite/scripts/bootstrap.sh
+fi
 
 .buildkite/scripts/download_build_artifacts.sh
 

.buildkite/scripts/steps/es_serverless/annotate_runtime_parameters.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+KIBANA_GITHUB_URL="https://github.com/elastic/kibana"
+ES_SERVERLESS_GITHUB_URL="https://github.com/elastic/elasticsearch-serverless"
+
+if [[ -z "$ES_SERVERLESS_IMAGE" ]]; then
+  echo "ES_SERVERLESS_IMAGE is not set"
+  exit 1
+elif [[ "$ES_SERVERLESS_IMAGE" != *"docker.elastic.co"* ]]; then
+  echo "ES_SERVERLESS_IMAGE should be a docker.elastic.co image"
+  exit 1
+fi
+
+# Pull the target image
+if [[ $ES_SERVERLESS_IMAGE != *":git-"* ]]; then
+  docker pull "$ES_SERVERLESS_IMAGE"
+  ES_SERVERLESS_VERSION=$(docker inspect --format='{{json .Config.Labels}}' "$ES_SERVERLESS_IMAGE" | jq -r '.["org.opencontainers.image.revision"]' | cut -c1-12)
+
+  IMAGE_WITHOUT_TAG=$(echo "$ES_SERVERLESS_IMAGE" | cut -d: -f1)
+  ES_SERVERLESS_IMAGE_FULL="${IMAGE_WITHOUT_TAG}:git-${ES_SERVERLESS_VERSION}"
+else
+  ES_SERVERLESS_IMAGE_FULL=$ES_SERVERLESS_IMAGE
+  ES_SERVERLESS_VERSION=$(echo "$ES_SERVERLESS_IMAGE_FULL" | cut -d: -f2 | cut -d- -f2)
+fi
+
+buildkite-agent annotate --context kibana-commit --style info "Kibana version: $BUILDKITE_BRANCH / [$BUILDKITE_COMMIT]($KIBANA_GITHUB_URL/commit/$BUILDKITE_COMMIT)"
+buildkite-agent annotate --context es-serverless-commit --style info "ES Serverless version: [$ES_SERVERLESS_VERSION]($ES_SERVERLESS_GITHUB_URL/commit/$ES_SERVERLESS_VERSION)"
+
+cat << EOF | buildkite-agent annotate --context es-serverless-image --style info
+  ES Serverless image: \`${ES_SERVERLESS_IMAGE_FULL}\`
+
+  To run this locally:
+  \`\`\`
+  node scripts/es serverless --image $ES_SERVERLESS_IMAGE_FULL
+  \`\`\`
+EOF

.buildkite/scripts/steps/fips/smoke_test.sh

@@ -1,12 +1,10 @@
 #!/usr/bin/env bash
 
-if [ -z "$KIBANA_BUILD_LOCATION" ]; then
-  export KIBANA_BUILD_LOCATION="/usr/share/kibana"
-fi
-
-# a FTR failure will result in the script returning an exit code of 10
-exitCode=0
+set -euo pipefail
 
+# Limit the FTR configs for now to avoid running all the tests. Once we're
+# ready to utilize the full FTR suite in FIPS mode, we can remove this file and
+# call pick_test_group_run_order.sh directly in .buildkite/pipelines/fips.yml.
 configs=(
   "x-pack/test/reporting_functional/reporting_and_security.config.ts"
   "x-pack/test/saved_object_api_integration/security_and_spaces/config_trial.ts"
@@ -19,34 +17,8 @@ configs=(
   "x-pack/test/functional/apps/security/config.ts"
 )
 
-cd /home/vagrant/kibana
-
-for config in "${configs[@]}"; do
-  set +e
-  node /home/vagrant/kibana/scripts/functional_tests \
-    --bail \
-    --kibana-install-dir "$KIBANA_BUILD_LOCATION" \
-    --config="$config"
-  lastCode=$?
-  set -e
-
-  if [ $lastCode -ne 0 ]; then
-    exitCode=10
-    echo "FTR exited with code $lastCode"
-    echo "^^^ +++"
-
-    if [[ "$failedConfigs" ]]; then
-      failedConfigs="${failedConfigs}"$'\n'"- ${config}"
-    else
-      failedConfigs="### Failed FTR Configs"$'\n'"- ${config}"
-    fi
-  fi
-done
-
-if [[ "$failedConfigs" ]]; then
-  echo "$failedConfigs" >/home/vagrant/ftr_failed_configs
-fi
-
-echo "--- FIPS smoke test complete"
+printf -v FTR_CONFIG_PATTERNS '%s,' "${configs[@]}"
+FTR_CONFIG_PATTERNS="${FTR_CONFIG_PATTERNS%,}"
+export FTR_CONFIG_PATTERNS
 
-exit $exitCode
+.buildkite/scripts/steps/test/pick_test_group_run_order.sh

.buildkite/scripts/steps/package_testing/test.sh

@@ -21,25 +21,17 @@ elif [[ "$TEST_PACKAGE" == "rpm" ]]; then
 elif [[ "$TEST_PACKAGE" == "docker" ]]; then
   download_artifact "kibana-$KIBANA_PKG_VERSION*-docker-image.tar.gz" . --build "${KIBANA_BUILD_ID:-$BUILDKITE_BUILD_ID}"
   KIBANA_IP_ADDRESS="192.168.56.7"
-elif [[ "$TEST_PACKAGE" == "fips" ]]; then
-  download_artifact kibana-default.tar.gz . --build "${KIBANA_BUILD_ID:-$BUILDKITE_BUILD_ID}"
-  download_artifact kibana-default-plugins.tar.gz . --build "${KIBANA_BUILD_ID:-$BUILDKITE_BUILD_ID}"
 fi
 cd ..
 
 export VAGRANT_CWD=$PWD/test/package
+vagrant up "$TEST_PACKAGE" --no-provision
 
-if [[ "$TEST_PACKAGE" == "fips" ]]; then
-  vagrant up "$TEST_PACKAGE"
-else
-  vagrant up "$TEST_PACKAGE" --no-provision
-
-  node scripts/es snapshot \
-    -E network.bind_host=127.0.0.1,192.168.56.1 \
-    -E discovery.type=single-node \
-    --license=trial &
-  while ! timeout 1 bash -c "echo > /dev/tcp/localhost/9200"; do sleep 30; done
-fi
+node scripts/es snapshot \
+  -E network.bind_host=127.0.0.1,192.168.56.1 \
+  -E discovery.type=single-node \
+  --license=trial &
+while ! timeout 1 bash -c "echo > /dev/tcp/localhost/9200"; do sleep 30; done
 
 function echoKibanaLogs {
   if [[ "$TEST_PACKAGE" == "deb" ]] || [[ "$TEST_PACKAGE" == "rpm" ]]; then
@@ -55,29 +47,13 @@ function echoKibanaLogs {
 }
 trap "echoKibanaLogs" EXIT
 
-if [[ "$TEST_PACKAGE" == "fips" ]]; then
-  set +e
-  vagrant ssh $TEST_PACKAGE -t -c "/home/vagrant/kibana/.buildkite/scripts/steps/fips/smoke_test.sh"
-  exitCode=$?
-
-  vagrant ssh $TEST_PACKAGE -t -c "cat /home/vagrant/ftr_failed_configs 2>/dev/null" >ftr_failed_configs
-  set -e
-
-  if [ -s ftr_failed_configs ]; then
-    cat ftr_failed_configs | buildkite-agent annotate --style "error"
-  fi
-
-  exit $exitCode
-else
-  vagrant provision "$TEST_PACKAGE"
+vagrant provision "$TEST_PACKAGE"
 
-  export TEST_BROWSER_HEADLESS=1
-  export TEST_KIBANA_URL="http://elastic:changeme@$KIBANA_IP_ADDRESS:5601"
-  export TEST_ES_URL="http://elastic:[email protected]:9200"
+export TEST_BROWSER_HEADLESS=1
+export TEST_KIBANA_URL="http://elastic:changeme@$KIBANA_IP_ADDRESS:5601"
+export TEST_ES_URL="http://elastic:[email protected]:9200"
 
-  echo "--- FTR - Reporting"
+cd x-pack
 
-  cd x-pack
-
-  node scripts/functional_test_runner.js --config test/functional/apps/visualize/config.ts --include-tag=smoke --quiet
-fi
+echo "--- FTR - Reporting"
+node scripts/functional_test_runner.js --config test/functional/apps/visualize/config.ts --include-tag=smoke --quiet