From a38ed6eb3c5df3c08f796d57ab751831ea035c02 Mon Sep 17 00:00:00 2001 From: Simeon Widdis Date: Wed, 14 Oct 2026 09:53:45 -0700 Subject: [PATCH 1/3] add a runWithSecurity task for gradle Signed-off-by: Simeon Widdis --- plugin/build.gradle | 72 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 72 insertions(+) diff --git a/plugin/build.gradle b/plugin/build.gradle index d0c825424be..e87cf79f571 100644 --- a/plugin/build.gradle +++ b/plugin/build.gradle @@ -364,3 +364,75 @@ testClusters.integTest { run { useCluster testClusters.integTest } + +def getSecurityPlugin() { + provider(new Callable() { + @Override + RegularFile call() throws Exception { + return new RegularFile() { + @Override + File getAsFile() { return project.file("$projectDir/bin/opensearch-security-snapshot.zip") } + } + } + }) +} + +testClusters.register('runWithSecurity') { + plugin(getJobSchedulerPlugin()) + plugin(project.tasks.bundlePlugin.archiveFile) + testDistribution = "ARCHIVE" + + // Same datasources keystore as the plain dev cluster. + keystore 'plugins.query.federation.datasources.config', new File("$projectDir/src/test/resources/", 'datasources.json') + + if (System.getProperty("debugJVM") != null) { + jvmArgs '-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005' + } + + // security plugin + demo certs + ['esnode.pem', 'esnode-key.pem', 'root-ca.pem'].forEach { certFile -> + extraConfigFile certFile, file("$projectDir/bin/${certFile}") + } + + // Demo security settings (copied from integ-test/build.gradle configureSecurityPlugin). + [ + 'plugins.security.ssl.transport.pemcert_filepath' : 'esnode.pem', + 'plugins.security.ssl.transport.pemkey_filepath' : 'esnode-key.pem', + 'plugins.security.ssl.transport.pemtrustedcas_filepath' : 'root-ca.pem', + 'plugins.security.ssl.transport.enforce_hostname_verification': 'false', + 'plugins.security.ssl.http.enabled' : 'false', + 'plugins.security.ssl.http.pemcert_filepath' : 'esnode.pem', + 'plugins.security.ssl.http.pemkey_filepath' : 'esnode-key.pem', + 'plugins.security.ssl.http.pemtrustedcas_filepath' : 'root-ca.pem', + 'plugins.security.allow_unsafe_democertificates' : 'true', + 'plugins.security.allow_default_init_securityindex' : 'true', + 'plugins.security.authcz.admin_dn' : 'CN=kirk,OU=client,O=client,L=test,C=de', + 'plugins.security.audit.type' : 'internal_opensearch', + 'plugins.security.enable_snapshot_restore_privilege' : 'true', + 'plugins.security.check_snapshot_restore_write_privileges' : 'true', + 'plugins.security.restapi.roles_enabled' : '["all_access", "security_rest_api_access"]', + 'plugins.security.system_indices.enabled' : 'true' + ].forEach { name, value -> + setting name, value + } + + // Create the admin/admin superuser on the node. + getNodes().forEach { node -> + var creds = node.getCredentials() + if (creds.isEmpty()) { + creds.add(Map.of('useradd', 'admin', '-p', 'admin')) + } else { + creds.get(0).putAll(Map.of('useradd', 'admin', '-p', 'admin')) + } + } + + plugin(getSecurityPlugin()) +} + +tasks.register('runWithSecurity', org.opensearch.gradle.testclusters.RunTask) { + useCluster testClusters.runWithSecurity + dependsOn ':opensearch-sql-plugin:bundlePlugin' + description = 'Run a local dev cluster with the opensearch-security (FGAC) plugin installed.' + group = 'verification' +} + From 09c0fd933f2dd351d778ae917bf0da3bcefa56f8 Mon Sep 17 00:00:00 2001 From: Simeon Widdis Date: Wed, 14 Oct 2026 11:28:14 -0700 Subject: [PATCH 2/3] simplify Signed-off-by: Simeon Widdis --- integ-test/build.gradle | 26 +++++++++++++++ plugin/build.gradle | 71 ----------------------------------------- 2 files changed, 26 insertions(+), 71 deletions(-) diff --git a/integ-test/build.gradle b/integ-test/build.gradle index 8bf61e5ae11..9b6438aa9cd 100644 --- a/integ-test/build.gradle +++ b/integ-test/build.gradle @@ -535,6 +535,14 @@ testClusters { // Only /_cluster/health is registered; pin the allow-list to it for RestCommandSecurityIT. setting 'plugins.ppl.rest.allowed_endpoints', '/_cluster/health' } + // Long-lived local dev cluster with the security (FGAC) plugin, for `runWithSecurity`. + // Mirrors integTest's plugin set; security itself is added by configureSecurityPlugin() + // on the RunTask below (same download + certs + demo settings + admin:admin as the ITs). + runWithSecurity { + testDistribution = 'archive' + plugin(getJobSchedulerPlugin()) + plugin ":opensearch-sql-plugin" + } remoteIntegTestWithSecurity { testDistribution = 'archive' plugin(getJobSchedulerPlugin()) @@ -863,6 +871,24 @@ task integTestWithSecurity(type: RestIntegTestTask) { } } +// Long-lived local dev cluster WITH the security (FGAC) plugin, analogous to the +// plugin project's `run` task but secured. Reuses the exact integ-test machinery: +// configureSecurityPlugin() downloads the security snapshot + demo certs, applies the +// demo SSL/security settings, and creates the admin:admin superuser -- the same path +// integTestWithSecurity uses, so there is no second copy of the download/config logic. +// Serves plain HTTP on :9200 (plugins.security.ssl.http.enabled=false) and runs no tests. +task runWithSecurity(type: org.opensearch.gradle.testclusters.RunTask) { + useCluster testClusters.runWithSecurity + dependsOn ':opensearch-sql-plugin:bundlePlugin' + description = 'Run a local dev cluster with the opensearch-security (FGAC) plugin installed.' + group = 'verification' +} +// Apply the security plugin + certs + demo settings + admin:admin at configuration +// time, exactly as configureSecurityPlugin(testClusters.analyticsEngineSecurityIT) +// does elsewhere. isSecurityTask() gates the download on a 'Security'-named task, so +// this only fetches when runWithSecurity is actually invoked. +configureSecurityPlugin(testClusters.runWithSecurity) + yamlRestTest { systemProperty 'tests.security.manager', 'false' } diff --git a/plugin/build.gradle b/plugin/build.gradle index e87cf79f571..b9791612d9c 100644 --- a/plugin/build.gradle +++ b/plugin/build.gradle @@ -365,74 +365,3 @@ run { useCluster testClusters.integTest } -def getSecurityPlugin() { - provider(new Callable() { - @Override - RegularFile call() throws Exception { - return new RegularFile() { - @Override - File getAsFile() { return project.file("$projectDir/bin/opensearch-security-snapshot.zip") } - } - } - }) -} - -testClusters.register('runWithSecurity') { - plugin(getJobSchedulerPlugin()) - plugin(project.tasks.bundlePlugin.archiveFile) - testDistribution = "ARCHIVE" - - // Same datasources keystore as the plain dev cluster. - keystore 'plugins.query.federation.datasources.config', new File("$projectDir/src/test/resources/", 'datasources.json') - - if (System.getProperty("debugJVM") != null) { - jvmArgs '-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005' - } - - // security plugin + demo certs - ['esnode.pem', 'esnode-key.pem', 'root-ca.pem'].forEach { certFile -> - extraConfigFile certFile, file("$projectDir/bin/${certFile}") - } - - // Demo security settings (copied from integ-test/build.gradle configureSecurityPlugin). - [ - 'plugins.security.ssl.transport.pemcert_filepath' : 'esnode.pem', - 'plugins.security.ssl.transport.pemkey_filepath' : 'esnode-key.pem', - 'plugins.security.ssl.transport.pemtrustedcas_filepath' : 'root-ca.pem', - 'plugins.security.ssl.transport.enforce_hostname_verification': 'false', - 'plugins.security.ssl.http.enabled' : 'false', - 'plugins.security.ssl.http.pemcert_filepath' : 'esnode.pem', - 'plugins.security.ssl.http.pemkey_filepath' : 'esnode-key.pem', - 'plugins.security.ssl.http.pemtrustedcas_filepath' : 'root-ca.pem', - 'plugins.security.allow_unsafe_democertificates' : 'true', - 'plugins.security.allow_default_init_securityindex' : 'true', - 'plugins.security.authcz.admin_dn' : 'CN=kirk,OU=client,O=client,L=test,C=de', - 'plugins.security.audit.type' : 'internal_opensearch', - 'plugins.security.enable_snapshot_restore_privilege' : 'true', - 'plugins.security.check_snapshot_restore_write_privileges' : 'true', - 'plugins.security.restapi.roles_enabled' : '["all_access", "security_rest_api_access"]', - 'plugins.security.system_indices.enabled' : 'true' - ].forEach { name, value -> - setting name, value - } - - // Create the admin/admin superuser on the node. - getNodes().forEach { node -> - var creds = node.getCredentials() - if (creds.isEmpty()) { - creds.add(Map.of('useradd', 'admin', '-p', 'admin')) - } else { - creds.get(0).putAll(Map.of('useradd', 'admin', '-p', 'admin')) - } - } - - plugin(getSecurityPlugin()) -} - -tasks.register('runWithSecurity', org.opensearch.gradle.testclusters.RunTask) { - useCluster testClusters.runWithSecurity - dependsOn ':opensearch-sql-plugin:bundlePlugin' - description = 'Run a local dev cluster with the opensearch-security (FGAC) plugin installed.' - group = 'verification' -} - From 53b629042d69ce32e68f9e370ad98587d08d31f1 Mon Sep 17 00:00:00 2001 From: Simeon Widdis Date: Wed, 14 Oct 2026 11:30:45 -0700 Subject: [PATCH 3/3] prune comments Signed-off-by: Simeon Widdis --- integ-test/build.gradle | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) diff --git a/integ-test/build.gradle b/integ-test/build.gradle index 9b6438aa9cd..64c04909390 100644 --- a/integ-test/build.gradle +++ b/integ-test/build.gradle @@ -536,8 +536,6 @@ testClusters { setting 'plugins.ppl.rest.allowed_endpoints', '/_cluster/health' } // Long-lived local dev cluster with the security (FGAC) plugin, for `runWithSecurity`. - // Mirrors integTest's plugin set; security itself is added by configureSecurityPlugin() - // on the RunTask below (same download + certs + demo settings + admin:admin as the ITs). runWithSecurity { testDistribution = 'archive' plugin(getJobSchedulerPlugin()) @@ -871,22 +869,13 @@ task integTestWithSecurity(type: RestIntegTestTask) { } } -// Long-lived local dev cluster WITH the security (FGAC) plugin, analogous to the -// plugin project's `run` task but secured. Reuses the exact integ-test machinery: -// configureSecurityPlugin() downloads the security snapshot + demo certs, applies the -// demo SSL/security settings, and creates the admin:admin superuser -- the same path -// integTestWithSecurity uses, so there is no second copy of the download/config logic. -// Serves plain HTTP on :9200 (plugins.security.ssl.http.enabled=false) and runs no tests. +// analogous to the plugin project's `run` task but with a demo config for testing roles. task runWithSecurity(type: org.opensearch.gradle.testclusters.RunTask) { useCluster testClusters.runWithSecurity dependsOn ':opensearch-sql-plugin:bundlePlugin' description = 'Run a local dev cluster with the opensearch-security (FGAC) plugin installed.' group = 'verification' } -// Apply the security plugin + certs + demo settings + admin:admin at configuration -// time, exactly as configureSecurityPlugin(testClusters.analyticsEngineSecurityIT) -// does elsewhere. isSecurityTask() gates the download on a 'Security'-named task, so -// this only fetches when runWithSecurity is actually invoked. configureSecurityPlugin(testClusters.runWithSecurity) yamlRestTest {