[Obs AI Assistant] Serverless tests should use cookie based auth instead of api keys for internal routes #192711
Closed
Assignees
Labels
Team:Obs AI Assistant
Observability AI Assistant
Comments
This was referenced Sep 12, 2024
Afaik custom SAML roles won't be supported by Oblt serverless project, so either it is no longer the case or there is no need to cover such test scenario. |
neptunian
added a commit
that referenced
this issue
Sep 30, 2024
Tests for serverless - copies over and modifies all tests from stateful to work in serverless. ~~deployment agnostic tests do not yet support enterprise license for stateful, so are tests don't yet qualify as being deployment agnostic~~. Given how difficult it is to see differences from the stateful tests, I've added PR comments where I've changed something that might be of interest. - changes to `createObservabilityAIAssistantApiClient` to use supertest without basic auth and accept headers for serverless and use roles - removes creating persisted users when tests start and [use roles](https://github.com/elastic/kibana/blob/main/x-pack/test_serverless/README.md#roles-based-testing) within tests. its not possible to create custom users with the serverless test framework at the moment. See #192711 Skipped tests - knowledge base tests #192886 - any test suite that uses the LLM proxy has been skipped on MKI #192751 - all tests that depend on the config.modelId skipped in MKI #192757 TODO: - [x] move over remaining tests - [x] test in MKI environment before merging - [x] create issues for skipped tests - [ ] this will not run on MKI (after merging) unless we ping the appex-qa team to add it to the pipeline. this is due to creating a separate config. ask appex-qa team to add our config. Followup / related issues to be tracked in a newly created issue: - [ ] #192757 - [ ] #192886 - [ ] #192751 - [ ] #192701 - [ ] #192497 - [ ] #192711 - [ ] #192718 - [ ] serverless functional tests - [ ] inquire with ml-ui-team to have the ability to delete system indices which we do after uninstalling tiny elser with .ml indices
neptunian
added a commit
to neptunian/kibana
that referenced
this issue
Oct 1, 2024
Tests for serverless - copies over and modifies all tests from stateful to work in serverless. ~~deployment agnostic tests do not yet support enterprise license for stateful, so are tests don't yet qualify as being deployment agnostic~~. Given how difficult it is to see differences from the stateful tests, I've added PR comments where I've changed something that might be of interest. - changes to `createObservabilityAIAssistantApiClient` to use supertest without basic auth and accept headers for serverless and use roles - removes creating persisted users when tests start and [use roles](https://github.com/elastic/kibana/blob/main/x-pack/test_serverless/README.md#roles-based-testing) within tests. its not possible to create custom users with the serverless test framework at the moment. See elastic#192711 Skipped tests - knowledge base tests elastic#192886 - any test suite that uses the LLM proxy has been skipped on MKI elastic#192751 - all tests that depend on the config.modelId skipped in MKI elastic#192757 TODO: - [x] move over remaining tests - [x] test in MKI environment before merging - [x] create issues for skipped tests - [ ] this will not run on MKI (after merging) unless we ping the appex-qa team to add it to the pipeline. this is due to creating a separate config. ask appex-qa team to add our config. Followup / related issues to be tracked in a newly created issue: - [ ] elastic#192757 - [ ] elastic#192886 - [ ] elastic#192751 - [ ] elastic#192701 - [ ] elastic#192497 - [ ] elastic#192711 - [ ] elastic#192718 - [ ] serverless functional tests - [ ] inquire with ml-ui-team to have the ability to delete system indices which we do after uninstalling tiny elser with .ml indices
neptunian
added a commit
to neptunian/kibana
that referenced
this issue
Oct 1, 2024
Tests for serverless - copies over and modifies all tests from stateful to work in serverless. ~~deployment agnostic tests do not yet support enterprise license for stateful, so are tests don't yet qualify as being deployment agnostic~~. Given how difficult it is to see differences from the stateful tests, I've added PR comments where I've changed something that might be of interest. - changes to `createObservabilityAIAssistantApiClient` to use supertest without basic auth and accept headers for serverless and use roles - removes creating persisted users when tests start and [use roles](https://github.com/elastic/kibana/blob/main/x-pack/test_serverless/README.md#roles-based-testing) within tests. its not possible to create custom users with the serverless test framework at the moment. See elastic#192711 Skipped tests - knowledge base tests elastic#192886 - any test suite that uses the LLM proxy has been skipped on MKI elastic#192751 - all tests that depend on the config.modelId skipped in MKI elastic#192757 TODO: - [x] move over remaining tests - [x] test in MKI environment before merging - [x] create issues for skipped tests - [ ] this will not run on MKI (after merging) unless we ping the appex-qa team to add it to the pipeline. this is due to creating a separate config. ask appex-qa team to add our config. Followup / related issues to be tracked in a newly created issue: - [ ] elastic#192757 - [ ] elastic#192886 - [ ] elastic#192751 - [ ] elastic#192701 - [ ] elastic#192497 - [ ] elastic#192711 - [ ] elastic#192718 - [ ] serverless functional tests - [ ] inquire with ml-ui-team to have the ability to delete system indices which we do after uninstalling tiny elser with .ml indices
23 tasks
neptunian
added a commit
to neptunian/kibana
that referenced
this issue
Oct 1, 2024
Tests for serverless - copies over and modifies all tests from stateful to work in serverless. ~~deployment agnostic tests do not yet support enterprise license for stateful, so are tests don't yet qualify as being deployment agnostic~~. Given how difficult it is to see differences from the stateful tests, I've added PR comments where I've changed something that might be of interest. - changes to `createObservabilityAIAssistantApiClient` to use supertest without basic auth and accept headers for serverless and use roles - removes creating persisted users when tests start and [use roles](https://github.com/elastic/kibana/blob/main/x-pack/test_serverless/README.md#roles-based-testing) within tests. its not possible to create custom users with the serverless test framework at the moment. See elastic#192711 Skipped tests - knowledge base tests elastic#192886 - any test suite that uses the LLM proxy has been skipped on MKI elastic#192751 - all tests that depend on the config.modelId skipped in MKI elastic#192757 TODO: - [x] move over remaining tests - [x] test in MKI environment before merging - [x] create issues for skipped tests - [ ] this will not run on MKI (after merging) unless we ping the appex-qa team to add it to the pipeline. this is due to creating a separate config. ask appex-qa team to add our config. Followup / related issues to be tracked in a newly created issue: - [ ] elastic#192757 - [ ] elastic#192886 - [ ] elastic#192751 - [ ] elastic#192701 - [ ] elastic#192497 - [ ] elastic#192711 - [ ] elastic#192718 - [ ] serverless functional tests - [ ] inquire with ml-ui-team to have the ability to delete system indices which we do after uninstalling tiny elser with .ml indices
23 tasks
neptunian
added a commit
that referenced
this issue
Oct 1, 2024
…194582) Tests for serverless - copies over and modifies all tests from stateful to work in serverless. ~~deployment agnostic tests do not yet support enterprise license for stateful, so are tests don't yet qualify as being deployment agnostic~~. Given how difficult it is to see differences from the stateful tests, I've added PR comments where I've changed something that might be of interest. - changes to `createObservabilityAIAssistantApiClient` to use supertest without basic auth and accept headers for serverless and use roles - removes creating persisted users when tests start and [use roles](https://github.com/elastic/kibana/blob/main/x-pack/test_serverless/README.md#roles-based-testing) within tests. its not possible to create custom users with the serverless test framework at the moment. See #192711 Skipped tests - knowledge base tests #192886 - any test suite that uses the LLM proxy has been skipped on MKI #192751 - all tests that depend on the config.modelId skipped in MKI #192757 TODO: - [x] move over remaining tests - [x] test in MKI environment before merging - [x] create issues for skipped tests - [ ] this will not run on MKI (after merging) unless we ping the appex-qa team to add it to the pipeline. this is due to creating a separate config. ask appex-qa team to add our config. Followup / related issues to be tracked in a newly created issue: - [ ] #192757 - [ ] #192886 - [ ] #192751 - [ ] #192701 - [ ] #192497 - [ ] #192711 - [ ] #192718 - [ ] serverless functional tests - [ ] inquire with ml-ui-team to have the ability to delete system indices which we do after uninstalling tiny elser with .ml indices ## Summary Summarize your PR. If it involves visual changes include a screenshot or gif. ### Checklist Delete any items that are not applicable to this PR. - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] Any UI touched in this PR is usable by keyboard only (learn more about [keyboard accessibility](https://webaim.org/techniques/keyboard/)) - [ ] Any UI touched in this PR does not create any new axe failures (run axe in browser: [FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/), [Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US)) - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This renders correctly on smaller devices using a responsive layout. (You can test this [in your browser](https://www.browserstack.com/guide/responsive-testing-on-local-server)) - [ ] This was checked for [cross-browser compatibility](https://www.elastic.co/support/matrix#matrix_browsers) ### Risk Matrix Delete this section if it is not applicable to this PR. Before closing this PR, invite QA, stakeholders, and other developers to identify risks that should be tested prior to the change/feature release. When forming the risk matrix, consider some of the following examples and how they may potentially impact the change: | Risk | Probability | Severity | Mitigation/Notes | |---------------------------|-------------|----------|-------------------------| | Multiple Spaces—unexpected behavior in non-default Kibana Space. | Low | High | Integration tests will verify that all features are still supported in non-default Kibana Space and when user switches between spaces. | | Multiple nodes—Elasticsearch polling might have race conditions when multiple Kibana nodes are polling for the same tasks. | High | Low | Tasks are idempotent, so executing them multiple times will not result in logical error, but will degrade performance. To test for this case we add plenty of unit tests around this logic and document manual testing procedure. | | Code should gracefully handle cases when feature X or plugin Y are disabled. | Medium | High | Unit tests will verify that any feature flag or plugin combination still results in our service operational. | | [See more potential risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) | ### For maintainers - [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
2 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The current recommendation in serverless tests is to use SAML role based testing. The only way to test roles is to use API keys. However only public routes should use API keys in the header. Internal routes do not use API keys and instead we should be using a cookie to check for authentication. It's currently possible to get a cookie for a built in role (admin, editor, viewer), using
svlManager, however it does not support custom users.From appex-qa team:
With SAML simulation in local env, we create roles when we start the Kibana. We tell Elasticsearch what roles are in places and just grant admin, editor and viewer its own. Plan is to add a possibility to create custom role and locally it will be assigned to the new user (no ETA, but probably within a month) But currently for consistency with MKI (we can't generate new users in Elastic Cloud), we are not able to do so.
Change all our serverless api integration internal routes to use cookie authentication instead of API Key headers which should only be used for public routes. Also look into adding users to the
observabilityAIAssistantAPIClientservice, as we do in stateful, using cookie auth.PR that makes getting the cookie easier for the built in users/roles #192727
The text was updated successfully, but these errors were encountered: