github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 01:38:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

[Cloud Security] fix setupTechnology GCP credential type swapping (#210668)

Browse source
This commit is contained in:
seanrathier 2025-02-13 14:06:37 -05:00 • committed by GitHub
parent ca81958c29
commit 4fe72b62b1
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
11 changed files with 65 additions and 68 deletions
Download patch file Download diff file Expand all files Collapse all files

3
x-pack/solutions/security/plugins/cloud_security_posture/public/components/fleet_extensions/policy_template_form.tsx
View file

@ -63,7 +63,6 @@ import {
import { usePackagePolicyList } from '../../common/api/use_package_policy_list';
import {
GCP_CREDENTIALS_TYPE,
GCP_SETUP_ACCESS,
gcpField,
getInputVarsFields,
} from './gcp_credentials_form/gcp_credential_form';
@ -727,7 +726,7 @@ export const CspPolicyTemplateForm = memo<PackagePolicyReplaceDefineStepExtensio
'gcp.credentials.type': {
value: isAgentless
? GCP_CREDENTIALS_TYPE.CREDENTIALS_JSON
: GCP_SETUP_ACCESS.CLOUD_SHELL,
: GCP_CREDENTIALS_TYPE.CREDENTIALS_NONE,
type: 'text',
},
},

4
x-pack/test/cloud_security_posture_functional/config.agentless.ts
View file

@ -7,7 +7,7 @@
import type { FtrConfigProviderContext } from '@kbn/test';
import { CA_CERT_PATH, KBN_CERT_PATH, KBN_KEY_PATH } from '@kbn/dev-utils';
import { CLOUD_CREDENTIALS_PACKAGE_VERSION } from '@kbn/cloud-security-posture-plugin/common/constants';
import { AGENTLESS_SECURITY_POSTURE_PACKAGE_VERSION } from './constants';
import { pageObjects } from './page_objects';
export default async function ({ readConfigFile }: FtrConfigProviderContext) {
@ -32,7 +32,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
`--xpack.fleet.agentless.api.tls.ca=${CA_CERT_PATH}`,
`--xpack.cloud.id=something-anything`,
`--xpack.fleet.packages.0.name=cloud_security_posture`,
`--xpack.fleet.packages.0.version=${CLOUD_CREDENTIALS_PACKAGE_VERSION}`,
`--xpack.fleet.packages.0.version=${AGENTLESS_SECURITY_POSTURE_PACKAGE_VERSION}`,
],
},
// load tests in the index file

2
x-pack/test/cloud_security_posture_functional/constants/test_subject_ids.ts
View file

@ -66,8 +66,6 @@ export const testSubjectIds = {
'cloudSecurityGraphGraphInvestigationInvestigateInTimeline',
ALERT_TABLE_ROW_CSS_SELECTOR: '[data-test-subj="alertsTable"] .euiDataGridRow',
SETUP_TECHNOLOGY_SELECTOR: 'setup-technology-selector',
SETUP_TECHNOLOGY_SELECTOR_ACCORDION_TEST_SUBJ: 'setup-technology-selector-accordion',
SETUP_TECHNOLOGY_SELECTOR_AGENTLESS_OPTION: 'setup-technology-agentless-option',
DIRECT_ACCESS_KEYS: 'direct_access_keys',
SETUP_TECHNOLOGY_SELECTOR_AGENTLESS_RADIO: 'setup-technology-agentless-radio',
SETUP_TECHNOLOGY_SELECTOR_AGENT_BASED_RADIO: 'setup-technology-agent-based-radio',

19
x-pack/test/cloud_security_posture_functional/page_objects/add_cis_integration_form_page.ts
View file

@ -289,12 +289,16 @@ export function AddCisIntegrationFormPageProvider({
await radio.click();
};
const getSetupTechnologyRadio = async (setupTechnology: 'agentless' | 'agent-based') => {
const radioGroup = await testSubjects.find(testSubjectIds.SETUP_TECHNOLOGY_SELECTOR);
return await radioGroup.findByCssSelector(`input[value='${setupTechnology}']`);
};
const showSetupTechnologyComponent = async () => {
return await testSubjects.exists(testSubjectIds.SETUP_TECHNOLOGY_SELECTOR);
};
const selectAwsCredentials = async (credentialType: 'direct' | 'temporary') => {
await clickOptionButton(AWS_CREDENTIAL_SELECTOR);
await selectValue(
AWS_CREDENTIAL_SELECTOR,
credentialType === 'direct' ? 'direct_access_keys' : 'temporary_keys'
@ -415,7 +419,7 @@ export function AddCisIntegrationFormPageProvider({
await clickOptionButton(testSubjectIds.CIS_AWS_OPTION_TEST_ID);
await clickOptionButton(testSubjectIds.SETUP_TECHNOLOGY_SELECTOR_AGENTLESS_RADIO);
await selectSetupTechnology('agentless');
await selectValue(testSubjectIds.AWS_CREDENTIAL_SELECTOR, 'direct_access_keys');
await fillInTextField(testSubjectIds.DIRECT_ACCESS_KEY_ID_TEST_ID, directAccessKeyId);
await fillInTextField(testSubjectIds.DIRECT_ACCESS_SECRET_KEY_TEST_ID, directAccessSecretKey);
@ -427,7 +431,7 @@ export function AddCisIntegrationFormPageProvider({
await clickOptionButton(testSubjectIds.CIS_GCP_OPTION_TEST_ID);
await clickOptionButton(testSubjectIds.GCP_SINGLE_ACCOUNT_TEST_ID);
await clickOptionButton(testSubjectIds.SETUP_TECHNOLOGY_SELECTOR_AGENTLESS_RADIO);
await selectSetupTechnology('agentless');
await fillInTextField(testSubjectIds.PRJ_ID_TEST_ID, projectId);
await fillInTextField(testSubjectIds.CREDENTIALS_JSON_TEST_ID, credentialJson);
};
@ -452,6 +456,8 @@ export function AddCisIntegrationFormPageProvider({
await navigateToAddIntegrationCspmPage();
await PageObjects.header.waitUntilLoadingHasFinished();
await inputIntegrationName(`cloud_security_posture-${new Date().toISOString()}`);
await fillOutForm(cloudProvider);
// Click Save Button to create the Integration then navigate to Integration Policies Tab Page
@ -469,6 +475,12 @@ export function AddCisIntegrationFormPageProvider({
// Fill out form to edit an agentless integration
await fillInTextField(testSubjectId, value);
// TechDebt: This is a workaround to ensure the form is saved
// const agentlessRadio = await getSetupTechnologyRadio('agentless');
// const agentBasedRadio = await getSetupTechnologyRadio('agent-based');
// expect(await agentlessRadio.isEnabled()).to.be(true);
// expect(agentBasedRadio.isEnabled()).to.be(true);
// Clicking Save Button updates and navigates to Integration Policies Tab Page
await clickSaveIntegrationButton();
await PageObjects.header.waitUntilLoadingHasFinished();
@ -559,6 +571,7 @@ export function AddCisIntegrationFormPageProvider({
clickOptionButton,
selectAwsCredentials,
selectSetupTechnology,
getSetupTechnologyRadio,
clickSaveButton,
clickSaveIntegrationButton,
clickAccordianButton,

4
x-pack/test_serverless/functional/test_suites/security/config.cloud_security_posture.agentless.ts
View file

@ -5,8 +5,8 @@
* 2.0.
*/
import { CLOUD_CREDENTIALS_PACKAGE_VERSION } from '@kbn/cloud-security-posture-plugin/common/constants';
import { CA_CERT_PATH, KBN_CERT_PATH, KBN_KEY_PATH } from '@kbn/dev-utils';
import { AGENTLESS_SECURITY_POSTURE_PACKAGE_VERSION } from './constants';
import { createTestConfig } from '../../config.base';
// TODO: Remove the agentless default config once Serverless API is merged and default policy is deleted
@ -19,7 +19,7 @@ export default createTestConfig({
`--xpack.cloud.serverless.project_id=some_fake_project_id`,
`--xpack.fleet.packages.0.name=cloud_security_posture`,
`--xpack.fleet.packages.0.version=${CLOUD_CREDENTIALS_PACKAGE_VERSION}`,
`--xpack.fleet.packages.0.version=${AGENTLESS_SECURITY_POSTURE_PACKAGE_VERSION}`,
`--xpack.fleet.agentless.enabled=true`,
`--xpack.fleet.agents.fleet_server.hosts=["https://ftr.kibana:8220"]`,
`--xpack.fleet.internal.fleetServerStandalone=true`,

1
x-pack/test_serverless/functional/test_suites/security/constants.ts
View file

@ -6,3 +6,4 @@
*/
export const SECURITY_ES_ARCHIVES_DIR = 'x-pack/test/security_solution_cypress/es_archives';
export const AGENTLESS_SECURITY_POSTURE_PACKAGE_VERSION = '1.13.0-preview02';

40
x-pack/test_serverless/functional/test_suites/security/ftr/cloud_security_posture/agentless/cis_integration_aws.ts
View file

@ -4,9 +4,9 @@
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import { CLOUD_CREDENTIALS_PACKAGE_VERSION } from '@kbn/cloud-security-posture-plugin/common/constants';
import expect from '@kbn/expect';
import * as http from 'http';
import { AGENTLESS_SECURITY_POSTURE_PACKAGE_VERSION } from '../../../constants';
import type { FtrProviderContext } from '../../../../../ftr_provider_context';
import { setupMockServer } from './mock_agentless_api';
export default function ({ getPageObjects, getService }: FtrProviderContext) {
@ -39,7 +39,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
after(async () => {
await supertest
.delete(
`/api/fleet/epm/packages/cloud_security_posture/${CLOUD_CREDENTIALS_PACKAGE_VERSION}`
`/api/fleet/epm/packages/cloud_security_posture/${AGENTLESS_SECURITY_POSTURE_PACKAGE_VERSION}`
)
.set('kbn-xsrf', 'xxxx')
.send({ force: true })
@ -48,18 +48,22 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
});
describe('Serverless - Agentless CIS_AWS Single Account Launch Cloud formation', () => {
it(`should show CIS_AWS Launch Cloud formation button when credentials selector is direct access keys and package version is ${CLOUD_CREDENTIALS_PACKAGE_VERSION}`, async () => {
it(`should show CIS_AWS Launch Cloud formation button when credentials selector is direct access keys and package version is ${AGENTLESS_SECURITY_POSTURE_PACKAGE_VERSION}`, async () => {
await cisIntegration.navigateToAddIntegrationCspmWithVersionPage(
CLOUD_CREDENTIALS_PACKAGE_VERSION
AGENTLESS_SECURITY_POSTURE_PACKAGE_VERSION
);
await pageObjects.header.waitUntilLoadingHasFinished();
await cisIntegration.clickOptionButton(testSubjectIds.CIS_AWS_OPTION_TEST_ID);
await cisIntegration.clickOptionButton(testSubjectIds.AWS_SINGLE_ACCOUNT_TEST_ID);
await cisIntegration.selectSetupTechnology('agentless');
await cisIntegration.selectAwsCredentials('direct');
await cisIntegration.inputIntegrationName(
`cloud_security_posture-${new Date().toISOString()}`
);
await pageObjects.header.waitUntilLoadingHasFinished();
await cisIntegration.selectSetupTechnology('agentless');
await cisIntegration.selectAwsCredentials('direct');
expect(
(await cisIntegrationAws.showLaunchCloudFormationAgentlessButton()) !== undefined
@ -68,27 +72,22 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
});
describe('Serverless - Agentless CIS_AWS ORG Account Launch Cloud formation', () => {
// tech debt: this test is failing because the credentials select is not working as expected
// https://github.com/orgs/elastic/projects/705/views/92?sliceBy%5Bvalue%5D=Agentless+-+API+-+ESS&pane=issue&itemId=73261952
it.skip(`should show CIS_AWS Launch Cloud formation button when credentials selector is direct access keys and package version is ${CLOUD_CREDENTIALS_PACKAGE_VERSION}`, async () => {
it(`should show CIS_AWS Launch Cloud formation button when credentials selector is direct access keys and package version is ${AGENTLESS_SECURITY_POSTURE_PACKAGE_VERSION}`, async () => {
await cisIntegration.navigateToAddIntegrationCspmWithVersionPage(
CLOUD_CREDENTIALS_PACKAGE_VERSION
AGENTLESS_SECURITY_POSTURE_PACKAGE_VERSION
);
await pageObjects.header.waitUntilLoadingHasFinished();
await cisIntegration.clickOptionButton(testSubjectIds.CIS_AWS_OPTION_TEST_ID);
await cisIntegration.selectSetupTechnology('agentless');
await cisIntegration.selectAwsCredentials('direct');
await pageObjects.header.waitUntilLoadingHasFinished();
expect(await cisIntegrationAws.showLaunchCloudFormationAgentlessButton()).to.be(true);
});
});
// TODO: Migrate test after Serverless default agentless policy is deleted.
describe.skip('Serverless - Agentless CIS_AWS edit flow', () => {
describe('Serverless - Agentless CIS_AWS edit flow', () => {
it(`user should save and edit agentless integration policy`, async () => {
const newDirectAccessKeyId = `newDirectAccessKey`;
@ -109,15 +108,6 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
)
).to.be(newDirectAccessKeyId);
expect(await cisIntegrationAws.showLaunchCloudFormationAgentlessButton()).to.be(true);
expect(await cisIntegration.getElementText(testSubjectIds.SETUP_TECHNOLOGY_SELECTOR)).to.be(
'Agentless\nBETA'
);
expect(
await cisIntegration.getFieldAttributeValue(
testSubjectIds.SETUP_TECHNOLOGY_SELECTOR,
'disabled'
)
).to.be('true');
});
});
// FLAKY: https://github.com/elastic/kibana/issues/191017

26
x-pack/test_serverless/functional/test_suites/security/ftr/cloud_security_posture/agentless/cis_integration_gcp.ts
View file

@ -6,8 +6,8 @@
*/
import expect from '@kbn/expect';
import { CLOUD_CREDENTIALS_PACKAGE_VERSION } from '@kbn/cloud-security-posture-plugin/common/constants';
import * as http from 'http';
import { AGENTLESS_SECURITY_POSTURE_PACKAGE_VERSION } from '../../../constants';
import type { FtrProviderContext } from '../../../../../ftr_provider_context';
import { setupMockServer } from './mock_agentless_api';
export default function ({ getPageObjects, getService }: FtrProviderContext) {
@ -36,7 +36,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
after(async () => {
await supertest
.delete(
`/api/fleet/epm/packages/cloud_security_posture/${CLOUD_CREDENTIALS_PACKAGE_VERSION}`
`/api/fleet/epm/packages/cloud_security_posture/${AGENTLESS_SECURITY_POSTURE_PACKAGE_VERSION}`
)
.set('kbn-xsrf', 'xxxx')
.send({ force: true })
@ -44,10 +44,10 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
mockApiServer.close();
});
describe.skip('Agentless CIS_GCP Single Account Launch Cloud shell', () => {
it(`should show CIS_GCP Launch Cloud Shell button when package version is ${CLOUD_CREDENTIALS_PACKAGE_VERSION}`, async () => {
describe('Agentless CIS_GCP Single Account Launch Cloud shell', () => {
it(`should show CIS_GCP Launch Cloud Shell button when package version is ${AGENTLESS_SECURITY_POSTURE_PACKAGE_VERSION}`, async () => {
await cisIntegration.navigateToAddIntegrationCspmWithVersionPage(
CLOUD_CREDENTIALS_PACKAGE_VERSION
AGENTLESS_SECURITY_POSTURE_PACKAGE_VERSION
);
await cisIntegration.clickOptionButton(testSubjectIds.CIS_GCP_OPTION_TEST_ID);
@ -61,10 +61,10 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
});
});
describe.skip('Agentless CIS_GCP ORG Account Launch Cloud Shell', () => {
it(`should show CIS_GCP Launch Cloud Shell button when package version is ${CLOUD_CREDENTIALS_PACKAGE_VERSION}`, async () => {
describe('Agentless CIS_GCP ORG Account Launch Cloud Shell', () => {
it(`should show CIS_GCP Launch Cloud Shell button when package version is ${AGENTLESS_SECURITY_POSTURE_PACKAGE_VERSION}`, async () => {
await cisIntegration.navigateToAddIntegrationCspmWithVersionPage(
CLOUD_CREDENTIALS_PACKAGE_VERSION
AGENTLESS_SECURITY_POSTURE_PACKAGE_VERSION
);
await cisIntegration.clickOptionButton(testSubjectIds.CIS_GCP_OPTION_TEST_ID);
@ -97,16 +97,6 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
'value'
)
).to.be(newCredentialsJSON);
expect(await cisIntegrationGcp.showLaunchCloudShellAgentlessButton()).to.be(true);
expect(await cisIntegration.getElementText(testSubjectIds.SETUP_TECHNOLOGY_SELECTOR)).to.be(
'Agentless\nBETA'
);
expect(
await cisIntegration.getFieldAttributeValue(
testSubjectIds.SETUP_TECHNOLOGY_SELECTOR,
'disabled'
)
).to.be('true');
});
});
});

24
x-pack/test_serverless/functional/test_suites/security/ftr/cloud_security_posture/agentless/create_agent.ts
View file

@ -5,9 +5,9 @@
* 2.0.
*/
import { CLOUD_CREDENTIALS_PACKAGE_VERSION } from '@kbn/cloud-security-posture-plugin/common/constants';
import * as http from 'http';
import expect from '@kbn/expect';
import { AGENTLESS_SECURITY_POSTURE_PACKAGE_VERSION } from '../../../constants';
import { setupMockServer } from './mock_agentless_api';
import type { FtrProviderContext } from '../../../../../ftr_provider_context';
export default function ({ getPageObjects, getService }: FtrProviderContext) {
@ -21,8 +21,10 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
]);
const CIS_AWS_OPTION_TEST_ID = 'cisAwsTestId';
const AWS_SINGLE_ACCOUNT_TEST_ID = 'awsSingleTestId';
const AWS_MANUAL_TEST_ID = 'aws-manual-setup-option';
const DIRECT_ACCESS_KEY_ID_TEST_ID = 'awsDirectAccessKeyId';
const DIRECT_ACCESS_SECRET_KEY_TEST_ID = 'passwordInput-secret-access-key';
describe('Agentless API Serverless', function () {
this.tags(['skipMKI', 'cloud_security_posture_agentless']);
@ -42,7 +44,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
it(`should create agentless-agent`, async () => {
const integrationPolicyName = `cloud_security_posture-${new Date().toISOString()}`;
await cisIntegration.navigateToAddIntegrationCspmWithVersionPage(
CLOUD_CREDENTIALS_PACKAGE_VERSION
AGENTLESS_SECURITY_POSTURE_PACKAGE_VERSION
);
await cisIntegration.clickOptionButton(CIS_AWS_OPTION_TEST_ID);
@ -50,8 +52,9 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
await cisIntegration.inputIntegrationName(integrationPolicyName);
await cisIntegration.selectSetupTechnology('agentless');
await cisIntegration.selectAwsCredentials('direct');
await cisIntegration.fillInTextField(DIRECT_ACCESS_KEY_ID_TEST_ID, 'test');
await cisIntegration.fillInTextField(DIRECT_ACCESS_SECRET_KEY_TEST_ID, 'test');
await pageObjects.header.waitUntilLoadingHasFinished();
@ -74,13 +77,24 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
const integrationPolicyName = `cloud_security_posture-${new Date().toISOString()}`;
await cisIntegration.navigateToAddIntegrationCspmWithVersionPage(
CLOUD_CREDENTIALS_PACKAGE_VERSION
AGENTLESS_SECURITY_POSTURE_PACKAGE_VERSION
);
await pageObjects.header.waitUntilLoadingHasFinished();
await cisIntegration.clickOptionButton(CIS_AWS_OPTION_TEST_ID);
await cisIntegration.clickOptionButton(AWS_SINGLE_ACCOUNT_TEST_ID);
await pageObjects.header.waitUntilLoadingHasFinished();
await cisIntegration.inputIntegrationName(integrationPolicyName);
await pageObjects.header.waitUntilLoadingHasFinished();
await cisIntegration.selectSetupTechnology('agent-based');
await pageObjects.header.waitUntilLoadingHasFinished();
await cisIntegration.clickOptionButton(AWS_MANUAL_TEST_ID);
await cisIntegration.selectAwsCredentials('direct');
await cisIntegration.fillInTextField(DIRECT_ACCESS_KEY_ID_TEST_ID, 'test');
await cisIntegration.fillInTextField(DIRECT_ACCESS_SECRET_KEY_TEST_ID, 'test');
await cisIntegration.clickSaveButton();
await pageObjects.header.waitUntilLoadingHasFinished();

2
x-pack/test_serverless/functional/test_suites/security/ftr/cloud_security_posture/mki_only/agentless/mki_create_agent.ts
View file

@ -6,7 +6,7 @@
*/
import expect from '@kbn/expect';
import { AGENTLESS_SECURITY_POSTURE_PACKAGE_VERSION } from '../constants';
import { AGENTLESS_SECURITY_POSTURE_PACKAGE_VERSION } from '../../../../constants';
import type { FtrProviderContext } from '../../../../../../ftr_provider_context';
export default function ({ getPageObjects, getService }: FtrProviderContext) {
const testSubjects = getService('testSubjects');

8
x-pack/test_serverless/functional/test_suites/security/ftr/cloud_security_posture/mki_only/constants.ts
View file

@ -1,8 +0,0 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
export const AGENTLESS_SECURITY_POSTURE_PACKAGE_VERSION = '1.13.0-preview02';