Get certs from security plugin instead of having them locally checked in

build.gradle

@@ -85,6 +85,7 @@ buildscript {
 }
 
 plugins {
+    id "de.undercouch.download" version "5.3.0"
     id "com.netflix.nebula.ospackage" version "11.5.0"
     id "com.dorongold.task-tree" version "2.1.1"
 }
@@ -189,6 +190,18 @@ tasks.named('forbiddenApisTest').configure {
 
 ext {
     projectSubstitutions = [:]
+
+    ['esnode.pem', 'esnode-key.pem', 'kirk.pem', 'kirk-key.pem', 'root-ca.pem', 'sample.pem', 'test-kirk.jks'].forEach { file ->
+        File local = getLayout().getBuildDirectory().file(file).get().getAsFile()
+        download.run {
+            src "https://raw.githubusercontent.com/opensearch-project/security/refs/heads/main/bwc-test/src/test/resources/security/" + file
+            dest local
+            overwrite false
+        }
+        processResources {
+            from(local)
+        }
+    }
 }
 
 allprojects {
@@ -342,11 +355,11 @@ afterEvaluate {
         plugins.add(firstPlugin)
 
         if (securityEnabled) {
-            node.extraConfigFile("kirk.pem", file("src/test/resources/security/kirk.pem"))
-            node.extraConfigFile("kirk-key.pem", file("src/test/resources/security/kirk-key.pem"))
-            node.extraConfigFile("esnode.pem", file("src/test/resources/security/esnode.pem"))
-            node.extraConfigFile("esnode-key.pem", file("src/test/resources/security/esnode-key.pem"))
-            node.extraConfigFile("root-ca.pem", file("src/test/resources/security/root-ca.pem"))
+            node.extraConfigFile("kirk.pem", file("build/resources/main/kirk.pem"))
+            node.extraConfigFile("kirk-key.pem", file("build/resources/main/kirk-key.pem"))
+            node.extraConfigFile("esnode.pem", file("build/resources/main/esnode.pem"))
+            node.extraConfigFile("esnode-key.pem", file("build/resources/main/esnode-key.pem"))
+            node.extraConfigFile("root-ca.pem", file("build/resources/main/root-ca.pem"))
             node.setting("plugins.security.ssl.transport.pemcert_filepath", "esnode.pem")
             node.setting("plugins.security.ssl.transport.pemkey_filepath", "esnode-key.pem")
             node.setting("plugins.security.ssl.transport.pemtrustedcas_filepath", "root-ca.pem")

src/test/kotlin/org/opensearch/indexmanagement/ODFERestTestCase.kt

@@ -55,7 +55,7 @@ abstract class ODFERestTestCase : OpenSearchRestTestCase() {
             return when (keystore != null) {
                 true -> {
                     // create adminDN (super-admin) client
-                    val uri = javaClass.classLoader.getResource("security/sample.pem")?.toURI()
+                    val uri = javaClass.classLoader.getResource("sample.pem")?.toURI()
                     val configPath = PathUtils.get(uri).parent.toAbsolutePath()
                     SecureRestClientBuilder(settings, configPath, hosts).setSocketTimeout(60000)
                         .setConnectionRequestTimeout(180000).build()