github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-23 17:28:26 -04:00
Code Issues Projects Releases Packages Wiki Activity

[osquery] Setup E2E against Serverless ES, Kibana, Fleet server standalone and Elastic agents in Docker (#165415)

Browse source 
## Summary

Let's automate E2E against Serverless

Changelog:
- updated certs to include additional dns names we are using for testing
locally, `host.docker.internal`, `es01`
- updated certs generation README to include changes related to
`openssl@3`
- added new certs for Fleet server
- added fleet-server service token
- added support for `ca_trusted_fingerprint` in fleet preconfig


![image](64860344-184f-45ef-99d4-dd7a5a8d6d23)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Tomasz Ciecierski <ciecierskitomek@gmail.com>
Co-authored-by: Tomasz Ciecierski <tomasz.ciecierski@elastic.co>
Co-authored-by: Kevin Logan <kevin.logan@elastic.co>
This commit is contained in:
Patryk Kopyciński 2023-09-29 10:33:06 +00:00 • committed by GitHub
parent 6cd8e257d9
commit 5dedc992a1
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
57 changed files with 764 additions and 492 deletions
Download patch file Download diff file Expand all files Collapse all files

27
.buildkite/pipelines/pull_request/osquery_cypress.yml
View file

@ -25,17 +25,16 @@ steps:
artifact_paths:
- "target/kibana-osquery/**/*"
# Error: self-signed certificate in certificate chain
# - command: .buildkite/scripts/steps/functional/security_serverless_osquery.sh
# label: 'Serverless Osquery Cypress Tests'
# agents:
# queue: n2-4-spot
# depends_on: build
# timeout_in_minutes: 50
# parallelism: 6
# retry:
# automatic:
# - exit_status: '*'
# limit: 1
# artifact_paths:
# - "target/kibana-osquery/**/*"
- command: .buildkite/scripts/steps/functional/security_serverless_osquery.sh
label: 'Serverless Osquery Cypress Tests'
agents:
queue: n2-4-spot
depends_on: build
timeout_in_minutes: 50
parallelism: 6
retry:
automatic:
- exit_status: '*'
limit: 1
artifact_paths:
- "target/kibana-osquery/**/*"

BIN
packages/kbn-crypto/src/__fixtures__/no_ca.p12
View file

Binary file not shown.

BIN
packages/kbn-crypto/src/__fixtures__/no_cert.p12
View file

Binary file not shown.

BIN
packages/kbn-crypto/src/__fixtures__/no_key.p12
View file

Binary file not shown.

BIN
packages/kbn-crypto/src/__fixtures__/two_cas.p12
View file

Binary file not shown.

BIN
packages/kbn-crypto/src/__fixtures__/two_keys.p12
View file

Binary file not shown.

19
packages/kbn-dev-utils/certs/README.md
View file

@ -37,13 +37,16 @@ __IMPORTANT:__ CA keystore (ca.p12) is not checked in intentionally, talk to @el
bin/elasticsearch-certutil ca --out ca.p12 -days 18250 --pass castorepass
# Generate the PKCS #12 keystore for Elasticsearch and sign it with the CA
bin/elasticsearch-certutil cert --out elasticsearch.p12 -days 18250 --ca ca.p12 --ca-pass castorepass --name elasticsearch --dns localhost --pass storepass
bin/elasticsearch-certutil cert --out elasticsearch.p12 -days 18250 --ca ca.p12 --ca-pass castorepass --name elasticsearch --dns localhost,host.docker.internal,es01,es02,es03 --pass storepass
# Generate the PKCS #12 keystore for Kibana and sign it with the CA
bin/elasticsearch-certutil cert --out kibana.p12 -days 18250 --ca ca.p12 --ca-pass castorepass --name kibana --dns localhost --pass storepass
bin/elasticsearch-certutil cert --out kibana.p12 -days 18250 --ca ca.p12 --ca-pass castorepass --name kibana --dns localhost,host.docker.internal,es01,es02,es03 --pass storepass
# Generate the PKCS #12 keystore for Fleet Server and sign it with the CA
bin/elasticsearch-certutil cert --out fleet_server.p12 -days 18250 --ca ca.p12 --ca-pass castorepass --name fleet_server --dns localhost,host.docker.internal,es01,es02,es03 --pass storepass
# Copy the PKCS #12 keystore for Elasticsearch with an empty password
openssl pkcs12 -in elasticsearch.p12 -nodes -passin pass:"storepass" -passout pass:"" | openssl pkcs12 -export -out elasticsearch_emptypassword.p12 -passout pass:""
openssl pkcs12 -in elasticsearch.p12 -nodes -passin pass:"storepass" -passout pass:"" | openssl pkcs12 -export -legacy -out elasticsearch_emptypassword.p12 -passout pass:""
# Manually create "elasticsearch_nopassword.p12" -- this can be done on macOS by importing the P12 key store into the Keychain and exporting it again
@ -51,14 +54,20 @@ openssl pkcs12 -in elasticsearch.p12 -nodes -passin pass:"storepass" -passout pa
openssl pkcs12 -in elasticsearch.p12 -out ca.crt -cacerts -passin pass:"storepass" -passout pass:
# Extract the PEM-formatted PKCS #1 private key for Elasticsearch
openssl pkcs12 -in elasticsearch.p12 -nocerts -passin pass:"storepass" -passout pass:"keypass" | openssl rsa -passin pass:keypass -out elasticsearch.key
openssl pkcs12 -in elasticsearch.p12 -nocerts -passin pass:"storepass" -passout pass:"keypass" | openssl rsa -passin pass:keypass -out elasticsearch.key -traditional
# Extract the PEM-formatted X.509 certificate for Elasticsearch
openssl pkcs12 -in elasticsearch.p12 -out elasticsearch.crt -clcerts -passin pass:"storepass" -passout pass:
# Extract the PEM-formatted PKCS #1 private key for Kibana
openssl pkcs12 -in kibana.p12 -nocerts -passin pass:"storepass" -passout pass:"keypass" | openssl rsa -passin pass:keypass -out kibana.key
openssl pkcs12 -in kibana.p12 -nocerts -passin pass:"storepass" -passout pass:"keypass" | openssl rsa -passin pass:keypass -out kibana.key -traditional
# Extract the PEM-formatted X.509 certificate for Kibana
openssl pkcs12 -in kibana.p12 -out kibana.crt -clcerts -passin pass:"storepass" -passout pass:
# Extract the PEM-formatted PKCS #1 private key for Fleet Server
openssl pkcs12 -in fleet_server.p12 -nocerts -passin pass:"storepass" -passout pass:"keypass" | openssl rsa -passin pass:keypass -out fleet_server.key -traditional
# Extract the PEM-formatted X.509 certificate for Fleet Server
openssl pkcs12 -in fleet_server.p12 -out fleet_server.crt -clcerts -passin pass:"storepass" -passout pass:
```

2
packages/kbn-dev-utils/certs/ca.crt
View file

@ -1,6 +1,6 @@
Bag Attributes
friendlyName: elasticsearch
localKeyID: 54 69 6D 65 20 31 36 33 34 31 32 30 31 35 32 31 39 33
localKeyID: 54 69 6D 65 20 31 36 39 35 34 38 32 34 30 38 35 33 39
Key Attributes: <No Attributes>
Bag Attributes
friendlyName: ca

41
packages/kbn-dev-utils/certs/elasticsearch.crt
View file

@ -1,29 +1,30 @@
Bag Attributes
friendlyName: elasticsearch
localKeyID: 54 69 6D 65 20 31 36 33 34 31 32 30 31 35 32 31 39 33
localKeyID: 54 69 6D 65 20 31 36 39 35 34 38 32 34 30 38 35 33 39
Key Attributes: <No Attributes>
Bag Attributes
friendlyName: elasticsearch
localKeyID: 54 69 6D 65 20 31 36 33 34 31 32 30 31 35 32 31 39 33
localKeyID: 54 69 6D 65 20 31 36 39 35 34 38 32 34 30 38 35 33 39
subject=CN = elasticsearch
issuer=CN = Elastic Certificate Tool Autogenerated CA
-----BEGIN CERTIFICATE-----
MIIDPzCCAiegAwIBAgIUCTO1pAvYtfaJndsQwa9cS/AtoSowDQYJKoZIhvcNAQEL
BQAwNDEyMDAGA1UEAxMpRWxhc3RpYyBDZXJ0aWZpY2F0ZSBUb29sIEF1dG9nZW5l
cmF0ZWQgQ0EwIBcNMjExMDEzMTAxNTUyWhgPMjA3MTEwMDExMDE1NTJaMBgxFjAU
BgNVBAMTDWVsYXN0aWNzZWFyY2gwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQCJK4KLS0kSIM+eqdMq4nO1p7nQ7ADUXIYjeRKaCycSJ7sj//1FRdj2NhLb
gdSX2VGIUZyOw4ptw6bGo0A7KyFE4yJZdG9m+VC1PFck3WaIdQHFdxgMia9deIHx
sU1ETnC4PstdkrsZZpf5+twS6O9TaIQolG6nEShst075v2b3y0NDHcxKW+BtSw27
HEHlchhP/Uj4haVMABQahfP8gv5vlHqStuOOWeoSgwF5FngCekx+ZeoIf5wVWfE1
SzDlU7L/JdYOrAp+kN+2g+b4qcr+WvFNCEwbhjJjd9/VIJ5z9kIjJhG9z1NilPhR
RVPG4njS6PxTufejbWN/360HfZbZAgMBAAGjYzBhMB0GA1UdDgQWBBR0kfoZtlNi
ZKxVBPhhpipoXdTQMjAfBgNVHSMEGDAWgBQwTCrAjlvQxik3HBocn1PDUunenjAU
BgNVHREEDTALgglsb2NhbGhvc3QwCQYDVR0TBAIwADANBgkqhkiG9w0BAQsFAAOC
AQEAkNcEM6mBzCdECFtuor3lfxrXzmrIo3wUspbv6Rrm4+n6TwJIYp6ydf4OcruR
Uv5feevaYXwDRHBkIEGvhU5po6sGp6k7ppXS5bgrEtAhJSK8SOsLINnbJLnptmZQ
Jharcks5STEqfJFB2QBZvFSLLpvO9g/N8sMro6ZvaUXhfW9DNpd6GIUXQiMhKLex
t80Sb4zuahTRqUSi2j5Hoq8ouc7U9T/RmA3zXNmzq7YvL/gv2it67qdyKvpzoX7t
HJaT1HU0o5Xi/Ol33C/wvfRe05UrHEUil148n/XWz3EJky7El2LYbg36/++mVTHX
xUXS+FdZ1rBlGnGwOHTPHj5FMQ==
MIIDajCCAlKgAwIBAgIVAItVW5PoG88CA9nHe8AQ5KlpBR3NMA0GCSqGSIb3DQEB
CwUAMDQxMjAwBgNVBAMTKUVsYXN0aWMgQ2VydGlmaWNhdGUgVG9vbCBBdXRvZ2Vu
ZXJhdGVkIENBMCAXDTIzMDkyMzE1MjAwOFoYDzIwNzMwOTEwMTUyMDA4WjAYMRYw
FAYDVQQDEw1lbGFzdGljc2VhcmNoMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEA0//9sbn3mgSZTAI2nwHlTWsD9quiXIAnsT2Z1EuZ4qbds/oXKAgD5o1D
pBiRMiqFjvaLSFQx/FpB5ZGYRzgh7gRUHf916ftSugcBtVBDt8BYLMhzwVjpLLC7
mOYTx8kUd0AvoRsiW23JEmFt8IPtoDj9P9qDhYDoaD5GuAS4EnAea0smtm5G1QMy
FtAsCX1qT1051rYUxlCLan7HeMWmIqPvCR1GzE9vP96Zb2gpAHzg0RHjLDOIDBmZ
DqGS4Egkrc/lvM9LLznqdBj/dzWQI0QQRv6gHzY2oHJorQYQ2xefgFjkdrhy5Sov
LqM+jvd3mUYrkVMgAUNVPYEHXg1clQIDAQABo4GMMIGJMB0GA1UdDgQWBBSomZga
0XXQlnT1T0I/BQ9AmAFdbTAfBgNVHSMEGDAWgBQwTCrAjlvQxik3HBocn1PDUune
njA8BgNVHREENTAzghRob3N0LmRvY2tlci5pbnRlcm5hbIIJbG9jYWxob3N0ggRl
czAzggRlczAyggRlczAxMAkGA1UdEwQCMAAwDQYJKoZIhvcNAQELBQADggEBABjM
xPHoqX5PyjPpySKSI2rrwIYlP78NKnwT8kd+Sk2kx0nrIj+GJBluerFTcHMSEQm2
Z7lAGsAMXxmy3J0PyiFoUlZ5dAaUvjPygbG2YBGRbnxrStXyFQe5R3Bq3dQ62hXl
/eo/UJFAKBzXUcbkrxAR5c/C0kBXAE/z5Qef9CNKGCtFeIeTigYSJd99+ek7hvW0
2QaI1Cd7qRe3Cy1C8DQMSFN1aB6gaT4FPDoi5pRbr/kX2Ch+JwD+1usKVgqe4sgI
kv2lak2L3rjMtZU9Uh1Kq228TSsagkNN2HadCxeOFPC/ZRs4cxo8cYrhotm8CJt9
QPfOO517N4ec6b0cIhk=
-----END CERTIFICATE-----

50
packages/kbn-dev-utils/certs/elasticsearch.key
View file

@ -1,27 +1,27 @@
-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEAiSuCi0tJEiDPnqnTKuJztae50OwA1FyGI3kSmgsnEie7I//9
RUXY9jYS24HUl9lRiFGcjsOKbcOmxqNAOyshROMiWXRvZvlQtTxXJN1miHUBxXcY
DImvXXiB8bFNRE5wuD7LXZK7GWaX+frcEujvU2iEKJRupxEobLdO+b9m98tDQx3M
SlvgbUsNuxxB5XIYT/1I+IWlTAAUGoXz/IL+b5R6krbjjlnqEoMBeRZ4AnpMfmXq
CH+cFVnxNUsw5VOy/yXWDqwKfpDftoPm+KnK/lrxTQhMG4YyY3ff1SCec/ZCIyYR
vc9TYpT4UUVTxuJ40uj8U7n3o21jf9+tB32W2QIDAQABAoIBAAdC/+q65hfpF8S5
Dd5X1bNYuUwXqmWTrmBDYRo5m+xooQ4jV7eqnnVOYIoxYd1WGmxikay3KmVsNbCP
ZO+c9WptsdxVfy5O5ZhqpNxlQi/YLetTxjins1p57jsq3UHP+0StwltmULRkC4im
4K65mS3ruw9g6Ei87kxvGeW73coha0syjORYGcFUynX/DfLi5svUjtSyVUQ1KCiU
KYc0q+SzsgXd71Ngr/HZR4ncCoACW3q/pLp0AUvDY0wZMkACOav2m9D2AnRPbPrA
+/n7LlrD0+LDScZx5nwO3ToFZuTDUXt3G0UWRaQfqiAZxNs2oeOc2gKegEJnPKIo
/BLN/D8CgYEAvMmtcZyrw8vifpP32erSBx2+wftt2JA9GdtZlOxu/kbWH7DAZ75g
YUT0nkcIRrvAS5FCVpOIENZit0RIvA5gM08Brko2mBIRQAbMWmu+c7RUBIa2xVDF
kjputhlWTT7xY03VbJThqUG4oK+zJJSb/RfRM4x2dRYskb7MEwqZFzcCgYEAugFT
t/0Lj+OXR+2pcjPk5VmxjCv4xohNOaX4YZ4/rK4H+gi9iyx232zE/1Dtz5SB4+uw
6hx7Aw3r5U9h1fauT60rSrydChEpFqcfpNQca7HncbF2DDdtEX+ZBkBDZ/U3LJ6Y
pI4o0vCLmiqZYbQ/+4v2f2/5ZqrzyMKLJ3zeqm8CgYAfCHP3ag6eJ+S6c+5ZJw2R
V+Vkk8URxVwV5QXLwjXYnKJUIUTviM7lDmW7oueMYQ6SHXWvL589TVB62cGvEBnm
NUWMdeyVgNrPEI8FChMLiAgLmm1u8AEaMXrDelTCa+dYMJI1wB98KC6GU3t6NueR
ahnchGlwg82dw6ReOO7DbwKBgGe5Sbg2EfaBUeE4dN9MdP44kDu8YZREedwF44Z8
OsHOooAZ06kCeJ+LBifiN1skU3KIAjXq/+XqI3vSUpqAXx/rT1Lz7xaoDyOkuo6u
AdNEd+38qfmSBu5VGz5TI8ObCNOG9VP+OmG25gJocvP7EhryJ9lU1d0cw6lWY0b3
6StdAoGBAKUkfbN7qbB+jiZt/6ArYWQE4PL4pqi+B+84xSrp46e41mmocezKhnsp
DxdcuZyg9OXs1xi6AaJtCbelho9bT8jC51GZSFvf887fvGVq7j1TgxWp4mvlqiX7
tztiggaPXwRZQiThxdJaCIadw26hxdLNOcdGOl/u2m0rudvwybab
MIIEpAIBAAKCAQEA0//9sbn3mgSZTAI2nwHlTWsD9quiXIAnsT2Z1EuZ4qbds/oX
KAgD5o1DpBiRMiqFjvaLSFQx/FpB5ZGYRzgh7gRUHf916ftSugcBtVBDt8BYLMhz
wVjpLLC7mOYTx8kUd0AvoRsiW23JEmFt8IPtoDj9P9qDhYDoaD5GuAS4EnAea0sm
tm5G1QMyFtAsCX1qT1051rYUxlCLan7HeMWmIqPvCR1GzE9vP96Zb2gpAHzg0RHj
LDOIDBmZDqGS4Egkrc/lvM9LLznqdBj/dzWQI0QQRv6gHzY2oHJorQYQ2xefgFjk
drhy5SovLqM+jvd3mUYrkVMgAUNVPYEHXg1clQIDAQABAoIBABXJIPo2VOQ6NEGs
GY5aDMUZqfjblu4ACnQrkycOlNQGl1JjMSV/O11iJ3ERyDv6RCrWmaYXZuKaqNpt
TZOGCHCT98v0YFro5Y2x4iJOiwLzTGxftguItj+OMt0Jyb8WYhjGGw7oga2ZGNhf
dEOK3yy/poC9FRZvUpLB0ZUgAQV92bKRYX8u/GPEwJ9oArOs2vqDZPPvByFT9Ve+
vFd5DebqLryRog9MpOhx4AUIu3tImL60AarqpmpKUVFwwRoAoN2ZRX989va8zOlR
OMwsFBQbTgoCAcT5lDt2aTB81YiiFVl40s89jomgIrw52mIOkGPCYHTI/5aSnNCp
Q/7qMdkCgYEA7aBeK9OLWGWE7Hxk8sG9BLFcByKpt/twZEEUiYWueyXn/0QHBc2M
deplxYBKee62vLgsw5qlZhR/sPAl33yzE6dBHUHMcsUYPh4FQJItdwhpxgmCDSn0
1t7r3YMIKQeu1OlSQMteQnsDbdVT9tH0HwnE7MwqaC+AgvP+mq2BUPkCgYEA5GRd
6445rljyZIAx9HF+700LW6YIPFrZ+DWfkbqqelj53v9CazDaefPzkb/bkjyjiig0
Rz8OuTfq9nfdfneAUSvhUAVPGU/iQ4rv3iAY4VgTPFNSmTYvbyFRwilV0Qn692dc
r/a3Pa7vyTaLZrisF4UDUqnF9Wyfe/YgpIqHK30CgYB/EjEJsrhjbvZkGClLf7r6
lXWnAyxLDJSPqBW5bNlfVWf4o4I14jNoow4FTZOGHNdvl/WoLDyil/eowOMf3elN
azVw1czk2u0Z2qfoXcMeUktt8YuwSm15sf/jlrx4ZHljtdmceKRRXML6qweZh7DK
IElEb/GFgVFxtdTDFmF+0QKBgQC8sfeu4Cjj1PUe95NORF79UwgpRjnTs7QWkCcv
/atPvidjiD3V1d0LmPQJ3RuJ7LOpN6JJot2FRZ/I1iuXix/m8HwM4vYBEbD84NNh
D9++fkgWNTkvAEecZ0jnQ8N1G+vPcARyFUI7okbWVUxDKBx2qhyetUmqhX4Wqrk5
eIJI+QKBgQCXYaBPNAOPOpDF9IQKhZOWF4UhGoHV7xR/lVvhPlUNEzMj1lfZIWzj
QcQ1sys1G67ram/Hsz9ZWA15jTCYIdq5SS7tqKO1O+0WTkH9YnyJYvYi3yD/KhT3
r30+REsprs44RyQvqcV60OCo1xQeM4fNwFL0lJLUedlhrS42/jysyw==
-----END RSA PRIVATE KEY-----

BIN
packages/kbn-dev-utils/certs/elasticsearch.p12
View file

Binary file not shown.

BIN
packages/kbn-dev-utils/certs/elasticsearch_emptypassword.p12
View file

Binary file not shown.

BIN
packages/kbn-dev-utils/certs/elasticsearch_nopassword.p12
View file

Binary file not shown.

30
packages/kbn-dev-utils/certs/fleet_server.crt Normal file
View file

@ -0,0 +1,30 @@
Bag Attributes
friendlyName: fleet_server
localKeyID: 54 69 6D 65 20 31 36 39 35 34 38 32 34 31 37 37 31 38
Key Attributes: <No Attributes>
Bag Attributes
friendlyName: fleet_server
localKeyID: 54 69 6D 65 20 31 36 39 35 34 38 32 34 31 37 37 31 38
subject=CN = fleet_server
issuer=CN = Elastic Certificate Tool Autogenerated CA
-----BEGIN CERTIFICATE-----
MIIDaDCCAlCgAwIBAgIUNsPACNdd6yg9RtG2RjaXhLgcSBcwDQYJKoZIhvcNAQEL
BQAwNDEyMDAGA1UEAxMpRWxhc3RpYyBDZXJ0aWZpY2F0ZSBUb29sIEF1dG9nZW5l
cmF0ZWQgQ0EwIBcNMjMwOTIzMTUyMDE3WhgPMjA3MzA5MTAxNTIwMTdaMBcxFTAT
BgNVBAMMDGZsZWV0X3NlcnZlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
ggEBALvyofG61gLV5MvhpsVwIecicRbtsbTeirGOrXG6astWUEiR45os/2nb3TkR
3844O4xi2zlaHSVPnK3D5QZCehZWoKhnc7sWrPQbiypEFwQ76IqG4f82jfyl7l6J
SnEpAx6W23zAGGCr5tHNWn0kAUq2ZlLKxuWvR9vp70jzOOl2SZ4q1uj4R+Iu639o
W0kp8oxKrH+N/XOgEzttxSpEfEgs9XCAzUeeGyQf2luv0f2PP6Gw/57VsAoB4Xa+
Y76MuFD7TjSknS3ipQ9SYJooqwgZA1W9Ba2Myh5r4ypSFfJ59N9Jnu7jyK8DX9S4
Mjw5/pbReGr8CWQlTck6e7rFFEUCAwEAAaOBjDCBiTAdBgNVHQ4EFgQU1AY1UdL6
rxUs/nG1sJR57FwJxSAwHwYDVR0jBBgwFoAUMEwqwI5b0MYpNxwaHJ9Tw1Lp3p4w
PAYDVR0RBDUwM4IUaG9zdC5kb2NrZXIuaW50ZXJuYWyCCWxvY2FsaG9zdIIEZXMw
M4IEZXMwMoIEZXMwMTAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQAoOpD/
jk/4uHMvm+e4ICdRpxCMoTmzL1sCXjEyTEIUrtnGajFBQ1Afsh3hRBjmFjpzvagB
78iSmVYPLKvk5vGWhz+f3f5HOfWbKhbfE2tDkXCYb3g9i65hj54RZyBN1jnxW6bs
cMD6h6frwX/KmBKtcuVkgIdUSpAX7MyDvlflvdKJvdOWiTaO30RbmcSJCgchOmcK
9tR7UrzEa4kB0e+MZ62Kmwp+WGzNilwvumrLSUpchaoZ/MJwW4HTvHELeoUERPvs
x6c9UkB2K5rGs28VWjB7QX/+VD6ecUYFXcXX8kvKUU67Mq8HHfhAsSJUUz+kpvan
pNYlrbZ1lKP/lrUL
-----END CERTIFICATE-----

27
packages/kbn-dev-utils/certs/fleet_server.key Normal file
View file

@ -0,0 +1,27 @@
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAu/Kh8brWAtXky+GmxXAh5yJxFu2xtN6KsY6tcbpqy1ZQSJHj
miz/advdORHfzjg7jGLbOVodJU+crcPlBkJ6FlagqGdzuxas9BuLKkQXBDvoiobh
/zaN/KXuXolKcSkDHpbbfMAYYKvm0c1afSQBSrZmUsrG5a9H2+nvSPM46XZJnirW
6PhH4i7rf2hbSSnyjEqsf439c6ATO23FKkR8SCz1cIDNR54bJB/aW6/R/Y8/obD/
ntWwCgHhdr5jvoy4UPtONKSdLeKlD1JgmiirCBkDVb0FrYzKHmvjKlIV8nn030me
7uPIrwNf1LgyPDn+ltF4avwJZCVNyTp7usUURQIDAQABAoIBACCUDj44hKA5M0+j
7aSLq1TFQ5UV3pfbe28LrETqa1iTvZbWsv0mj59p3Q7nakP0u126RQXL+QFeq2nz
at+K5l645WBLjmP/qjsmCxlodBTnzYc1mjcC3dnNaWQ5qA21bjT/MUyOf6tCIOB9
GBJZC2BH/bScMZ3epDYadr/OaS8OZX0iEKm/pApfjPsNyuIpgnrkEOiUqwCwDr7l
Z0z0wAIPVewN7z1mBoLO3ZT72WR8iKvdXAt982C9z8K4w0YKmVnexD6FHY37uXsE
RHggcRM0psjJ2vpu7Ha1q/pmyAdb8RQ+1tAGApn+DgLRjEdIMX7CvHQFZ2m/+7lC
Y1SUcAECgYEAxXBf0VuR1z9xIdE7i2WteNJtE4zJgO8N0tIMTiRCTGE4kiclCRzX
AN2xiwkvGM2tLo5XC5FvD6AHBdLng1n1xOIgsAgNOAIcjiexm0P/D9EHeOnua7wc
DRQGQgjPNYv9TxPs4K25T9v1uV4hzQFfKq+JyOlzEP5S4vkyHw08AqECgYEA87GW
yidal1nTndAvkBHmYGMu0aHgK0U5NIlgmqqDsqIaES6XATUdjLw2xjiwtwQfEOLm
ZRHc6rgyA0o6QcWhD3TM9X3eJ3Hf4cAETES+rBRTTHY/u71LzjiAQCNAemceWbYX
RAyYYngtMxAyiis/8sFTVNoxGIHHehvLJKIu0yUCgYEArqeHu3Wbf6O5ekbSu69I
U1ch8mdaYVoXCmWRSRa+Jz7hgjhqhLMkZrm2Mt3+8ZwQFN0Jl0whyNqxG6/D6OgN
hwraC54zw1Xq2L24WTc/TEiGqamWpWsUDWWnW4bbdezOOcPQibhj84cKyd3BXM5X
1zTNWBNbHK89t1blxZ45dcECgYEAuRZ44LFjLPEcuRAWD+aIg0zRkobQLA03lZ+B
r/cyb8qO4d3w8wnUl7+cGpGUJm0K61hqhPk8QUoFMlp+RNZFreeYhBxFTtA+qsec
fBD6gNgvLDPj1EPB/68KOayMnGsVsi2LHjQyyRddvRrgR/DxcP9Eu329LE/loeja
Mci8p8ECgYBrIucmzOakwamH5cEI++3UaNHp9AUFsoN8T1Bo7MgdrqGIZ7yUzfzN
ymBeJSN4JJsI3S4tt2fQ2pexfvbk5wAl9sZiR38fRIYMs5NDqRVyISLxd5cbmEqX
04PnNCs3IHpdMA3jfpk0q6wmEtdQNLQWRr3v7e0RvHCG254YY6UN5Q==
-----END RSA PRIVATE KEY-----

BIN
packages/kbn-dev-utils/certs/fleet_server.p12 Normal file
View file

Binary file not shown.

41
packages/kbn-dev-utils/certs/kibana.crt
View file

@ -1,29 +1,30 @@
Bag Attributes
friendlyName: kibana
localKeyID: 54 69 6D 65 20 31 36 33 34 31 32 30 31 35 38 38 30 33
localKeyID: 54 69 6D 65 20 31 36 39 35 34 38 32 34 31 34 33 39 35
Key Attributes: <No Attributes>
Bag Attributes
friendlyName: kibana
localKeyID: 54 69 6D 65 20 31 36 33 34 31 32 30 31 35 38 38 30 33
localKeyID: 54 69 6D 65 20 31 36 39 35 34 38 32 34 31 34 33 39 35
subject=CN = kibana
issuer=CN = Elastic Certificate Tool Autogenerated CA
-----BEGIN CERTIFICATE-----
MIIDOTCCAiGgAwIBAgIVAN0GVNLw3IaUBuG7t6CeW8w2wyymMA0GCSqGSIb3DQEB
CwUAMDQxMjAwBgNVBAMTKUVsYXN0aWMgQ2VydGlmaWNhdGUgVG9vbCBBdXRvZ2Vu
ZXJhdGVkIENBMCAXDTIxMTAxMzEwMTU1OFoYDzIwNzExMDAxMTAxNTU4WjARMQ8w
DQYDVQQDEwZraWJhbmEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3
nvfL3/26D8EkLso+t9S0m+tSJipLsBWs0dCpc8KRJ/+ijDRnAQ5lOmOAcxt43SNY
KFr0EntQEZyYaRwMIM8aPR0WYW/VV5o4fq2o/JnmHqzZJRJCwZq+5WiCiDPt012N
mRGYCMUxjlEwejue6diLAeQhZ/sfN4jUp217bMEHrhHrNBWTwwJ+Uk5TBQMhviCW
LKbsKrfluA6DGHWrXN4pH7Xmaf/Zyc9AYL/nxwv3VQHZzIAK/U/WNCgFJJ3qoFYY
6TUwDDNa30mSj165OOds9N+VmUlDC3IFiHV3osBWscSU4HJd6QJ8huHrFLLV4y4i
u62el47Qr+/8Ut3SzeIXAgMBAAGjYzBhMB0GA1UdDgQWBBQli5f2bYL9jKUA5Uxp
yRRHeCoPJzAfBgNVHSMEGDAWgBQwTCrAjlvQxik3HBocn1PDUunenjAUBgNVHREE
DTALgglsb2NhbGhvc3QwCQYDVR0TBAIwADANBgkqhkiG9w0BAQsFAAOCAQEATFNj
WkTBPfgflGYZD4OsYvfT/rVjFKbJP/u1a0rkzNamA2QKNzI9JTOzONPTyRhe9yVS
zeO8X2rtN63l38dtgMjFQ15Xxnp7GFT7GkXfa1JR+tGSGTgVld8nLUzig+mNmBoR
nE4cNc0JJ1PsXPzfPgJ6WMp2WOoNUrQf2cm42i36Jk+7KGcosfyFMPQILZE34Geo
DAgCVpNWPgST4HYBUCHMC7S14LHLVdUXPsfGZPEqU5Zf9Hvy61rQC/RdNjnMI6JD
s57l9oHASNeEg55NQm01aOmwq/z1DXs3UP2nRmp6XCCfE61ghofO5dtV1j3cZ3f5
dzkzSBV7H6+/MD3Y8Q==
MIIDYjCCAkqgAwIBAgIUZ2p8K7GMXGk6xwCS9S91BUl1JnAwDQYJKoZIhvcNAQEL
BQAwNDEyMDAGA1UEAxMpRWxhc3RpYyBDZXJ0aWZpY2F0ZSBUb29sIEF1dG9nZW5l
cmF0ZWQgQ0EwIBcNMjMwOTIzMTUyMDE0WhgPMjA3MzA5MTAxNTIwMTRaMBExDzAN
BgNVBAMTBmtpYmFuYTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMOU
r52dbZ5dY0BoP2p7CEnOpG+qHTNrOAqZO/OJfniPMtpGmwAMl3WZDca6u2XkV2KE
qQyevQ2ADk6G3o8S2RU8mO/+UweuCDF7LHuSdxEGTpucidZErmVhEGUOFosL5UeB
AtIDWxvWwgK+W9Yzt5IEN2HzNCZ6h0dOSk2r9EjVMG5yF4Q6kuqOYxBT7jxoaOtO
OCrgBRummtUga4T13WZ/ZIyyHpXj2+JD4YEmrDyoTa7NLaphv0hnVhHXYoYBI/c6
2SwwAoBlmtDmlinwSACQ3o/8eLWk0tqkIP14rc3oFh3m7D2c3c2m2HXuyoSDMfGW
beG2IE1Q3idcGmeG3qsCAwEAAaOBjDCBiTAdBgNVHQ4EFgQUMOUM7w5jmIozDvnq
RpM779m5GigwHwYDVR0jBBgwFoAUMEwqwI5b0MYpNxwaHJ9Tw1Lp3p4wPAYDVR0R
BDUwM4IUaG9zdC5kb2NrZXIuaW50ZXJuYWyCCWxvY2FsaG9zdIIEZXMwM4IEZXMw
MoIEZXMwMTAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQCxqvQYXSKqgpdl
SP4gXgwipAnYsoW9qkgWQODTvSBEzUdOWme0d3j7i2l6Ur/nVSv5YjkqAv1hf/yJ
Hrk9h+j29ZO/aQ/KDh5i/gTEUnPw3Bxbw47dfn23tjMWO7NCU1fr5HNztRsa/gQr
e9s07g25u/gTfTi9Fyu0lcRe3bXOLS/mFVcuC5oxuS65R9OlbIsiORkZ2EfwuNUf
wAAYOGPIjM2VlQCvBitefsd/SzRKHdxSPy6KSjkO6MGEGo87fr7B7Nx1qp1DVrK7
q9XeP1Cuygjg9WTcnsvWvNw8CssyuFM6X/3tGjpPasXwLvNUoG2AairK2AYTWhvS
foE31cFg
-----END CERTIFICATE-----

50
packages/kbn-dev-utils/certs/kibana.key
View file

@ -1,27 +1,27 @@
-----BEGIN RSA PRIVATE KEY-----
MIIEpQIBAAKCAQEAt573y9/9ug/BJC7KPrfUtJvrUiYqS7AVrNHQqXPCkSf/oow0
ZwEOZTpjgHMbeN0jWCha9BJ7UBGcmGkcDCDPGj0dFmFv1VeaOH6tqPyZ5h6s2SUS
QsGavuVogogz7dNdjZkRmAjFMY5RMHo7nunYiwHkIWf7HzeI1Kdte2zBB64R6zQV
k8MCflJOUwUDIb4gliym7Cq35bgOgxh1q1zeKR+15mn/2cnPQGC/58cL91UB2cyA
Cv1P1jQoBSSd6qBWGOk1MAwzWt9Jko9euTjnbPTflZlJQwtyBYh1d6LAVrHElOBy
XekCfIbh6xSy1eMuIrutnpeO0K/v/FLd0s3iFwIDAQABAoIBAAKgqzzHI/Xdfi7l
iS5e6hPQPAytECOMza/vQV7+EZWLLtIlfdB63Y5e8107XclxJ1gpHQLAyvPz3zui
cWzOVrhc5zAn98uOmTM1bjMXXkptO52l3/4wOrsq7upt8YmgjIZXX5Q/N+HZfq7v
aNqsJQBO6B6pmBiJGROrS6/y9/Yt+3jDolgtI6fifYZcMXACoal++BAXbiHYPoff
+nG5lHrAdQoEfNACNnGFlq2O85EWmr3qxUsZV8TblOirAuaUFk5KhhDvTOfTknHY
pW8Z4ttD26+QITyUbI56flgLOfe57y0u4XsOPtWQWEteIBxBFsB9MMj4B8XYdiO/
hma1jSUCgYEA14H/6vtzM42INgphoj0lHFVL8N0DnuUquR77vQStTO2sDvMQrVTk
BKpy5iYmokHPjY7qV7C37/tQVKdQpUz9Lr0ylwinHwX1KasJkYEJGv++Z59sKH+C
CZX9lZjfTqPpuEonGgPruc8LOXaaM/+g3Nvs7M4S339gnjCZExNzpLsCgYEA2h8z
OhHJpOWOy004HHVjpkWHKTxgZ9xfMLCKjMi1m5sCJ2PCdkd4+wTtkY+u7+iFF1cp
5CVSvZC6fS0rk11ygXix1ZP7cDJj1y4mxvbzWOtPxvZc882Xv0RDXAQBLXgHW6YE
RqvdMczfAx0mbUNke4Umwa5PngSWQAqCYkXNkFUCgYEAhEAY5wEsLyTZxCAWzlMr
pPmLQuK+yBHmZ/hlkBeAqkboYbw0Lcp8q4hWPnqHFufAEST1Fp8yIaleILUUvnxC
mx4sH5eFx3oGe22kz5AaIGF1XW3uF+Q3zt4m4lkQINhiI2AOIt7pF/vA7aCk/OgQ
tbiY6rGDz3gBuNIl/hjfzOUCgYEAy1rDO6RRxnZuhoPbiEy5Ns8jkAJGLw55gL9W
rKKDDiuZ+nc7WWKRHBYgFtFKW0kArB4LZDSXyzwfYYy3T5CTrLmFsoVgqd2Qz5Cr
flvFzGS139zYFETc8OkHk8X4AxggZAWHfwvEESXb1N9ccAmgqLgexftpJv1HxzUF
EfHaEHECgYEArtWvtUdvRQ20r/X/g+mNyUhbYOy15pAgswLK4gIi8rmQPxR08spl
uJJ/cl4fGxG95dl/OV+lNdwl4UcvjATdreEMKvG4X4Cxd+42SUf40M6pGxXoyYz+
i4WujBaEqBBqjKmYNJVgY7EvqF+VYLBVFZYB1zQhdNPcoPgIH/97vvI=
MIIEpAIBAAKCAQEAw5SvnZ1tnl1jQGg/ansISc6kb6odM2s4Cpk784l+eI8y2kab
AAyXdZkNxrq7ZeRXYoSpDJ69DYAOTobejxLZFTyY7/5TB64IMXsse5J3EQZOm5yJ
1kSuZWEQZQ4WiwvlR4EC0gNbG9bCAr5b1jO3kgQ3YfM0JnqHR05KTav0SNUwbnIX
hDqS6o5jEFPuPGho6044KuAFG6aa1SBrhPXdZn9kjLIelePb4kPhgSasPKhNrs0t
qmG/SGdWEddihgEj9zrZLDACgGWa0OaWKfBIAJDej/x4taTS2qQg/XitzegWHebs
PZzdzabYde7KhIMx8ZZt4bYgTVDeJ1waZ4beqwIDAQABAoIBABaXTBm2n3zVaKt9
3yVbhL+RwOitC6Zu0hBXVtdwoE0orUUNNsYwriYFQdQcqZzBXV6h2Cz/APNYQU7M
wVRhZvXPBBNkmw6eCZA9nAvCBULQKbBLypgXYtWO+qfRksUI4Lj7q+m6PYHfspVC
i7UYUDHrjsIfp3xyVsHjxy1lmVf4JFAANNHAQeYPR6l5bw/t5yA6qQ9vBtVRz9da
nCE2mQHAODXHMXdiIss4YA3a3uIuN54ud0/cWP/Pn2eM2MHsQYEKFISd7rZ81wlE
+9DmENkL3L9iK0Zx4xUTGGS8R8oM5jimUaa4PQLwoD6IolY0C33Ri6d4IK23AtOH
/+687lECgYEA0oJ2CPNCmbB4Sy7ry3PYZhxZk8qaS5dmYrmB+Z5wNu/mpC2/6M72
Vkol3BG+5yPgAB4SW09TeRh7VczGu+8juZW1q/Hi1MinhwCfGOvWlIFD9+G4d/gF
5EgWaDwCkimUo218Wry88hCzWuUKyd4HS3PODE0v39Jt1eLSQFGbqEcCgYEA7dha
UBs/I0kPvrYmlDrEH0dJRyvaG5ODv2gqvPtURNqFNMWAZ7146ZTDe2IvZ5bRTikc
B+lwlkMb+yhPvoGX1o3EkOYUhdUcgzSU9nL+ynSoWeOqprJ9Q/al4rIEh8ebvbZI
RF0qvBU6Q8Qg6aA/pcTVHU0+fFe6GDYarWvarH0CgYEAoxYphfOYVGMwPucCDKQa
Mbmi+GnNMeUAkFmxxYam3xjq8aTz+dRlaiKVxDIHWSElCFJD3HPPcpCx9J3qFW1G
mx/OGIEUP8+YYnHr0C3eFz0yQBeih2cigWIL4gMj5sLKAfbvkYiJRWwE19V8jzox
IpZ8OnGONnPbXgoU43mWAz8CgYEA3qvrAYxAtBw2rWmC/Mt3yYDHzeX0MFUOxygS
uxLhdgTPKPSunnD4vlYUHXNyxhygn/hE0fNvAH6bt6up3MUfDjNzj+SX2iQGqZ+U
xpYqjAhjhKRso9v/Ap3r+CyJqUTrPdVmGvrOg3+sKL15wr/QVrXMf75NfcPz6a7d
kvaip1ECgYA/T6EllMlRBM7hMnhZlgt3Ccu/e6VcVzQxqp0EewHzw+N17LdoaWaB
0bw9AqTwLeEhf4s4vidB7pO8YGNkCOKkQ3gqA/pF21VtF4xBRP6iYFa9rEGrHsRU
as68JJ6Lk+gn0aJ0RJNRaOa8xeoA/YWYNfnCfiAHj82UzP5TT4L/BQ==
-----END RSA PRIVATE KEY-----

BIN
packages/kbn-dev-utils/certs/kibana.p12
View file

Binary file not shown.

5
packages/kbn-dev-utils/index.ts
View file

@ -8,6 +8,7 @@
export {
CA_CERT_PATH,
CA_TRUSTED_FINGERPRINT,
ES_KEY_PATH,
ES_CERT_PATH,
ES_P12_PATH,
@ -18,6 +19,10 @@ export {
KBN_CERT_PATH,
KBN_P12_PATH,
KBN_P12_PASSWORD,
FLEET_SERVER_KEY_PATH,
FLEET_SERVER_CERT_PATH,
FLEET_SERVER_P12_PATH,
FLEET_SERVER_P12_PASSWORD,
} from './src/certs';
export * from './src/dev_service_account';
export * from './src/axios';

6
packages/kbn-dev-utils/src/certs.ts
View file

@ -9,6 +9,8 @@
import { resolve } from 'path';
export const CA_CERT_PATH = process.env.TEST_CA_CERT_PATH || resolve(__dirname, '../certs/ca.crt');
export const CA_TRUSTED_FINGERPRINT =
'F71F73085975FD977339A1909EBFE2DF40DB255E0D5BB56FC37246BF383FFC84';
export const ES_KEY_PATH = resolve(__dirname, '../certs/elasticsearch.key');
export const ES_CERT_PATH = resolve(__dirname, '../certs/elasticsearch.crt');
export const ES_P12_PATH = resolve(__dirname, '../certs/elasticsearch.p12');
@ -22,3 +24,7 @@ export const KBN_KEY_PATH = resolve(__dirname, '../certs/kibana.key');
export const KBN_CERT_PATH = resolve(__dirname, '../certs/kibana.crt');
export const KBN_P12_PATH = resolve(__dirname, '../certs/kibana.p12');
export const KBN_P12_PASSWORD = 'storepass';
export const FLEET_SERVER_KEY_PATH = resolve(__dirname, '../certs/fleet_server.key');
export const FLEET_SERVER_CERT_PATH = resolve(__dirname, '../certs/fleet_server.crt');
export const FLEET_SERVER_P12_PATH = resolve(__dirname, '../certs/fleet_server.p12');
export const FLEET_SERVER_P12_PASSWORD = 'storepass';

6
packages/kbn-dev-utils/src/dev_service_account.ts
View file

@ -17,3 +17,9 @@ export const kibanaDevServiceAccount = {
env.TEST_KIBANA_SERVICE_ACCOUNT_TOKEN ||
'AAEAAWVsYXN0aWMva2liYW5hL2tpYmFuYS1kZXY6VVVVVVVVTEstKiBaNA',
};
export const fleetServerDevServiceAccount = {
token:
env.TEST_FLEET_SERVER_SERVICE_ACCOUNT_TOKEN ||
'AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL2ZsZWV0LXNlcnZlci1kZXY6VVo1TWd6MnFTX3FVTWliWGNXNzlwQQ',
};

3
packages/kbn-es/index.ts
View file

@ -12,6 +12,9 @@ export {
SYSTEM_INDICES_SUPERUSER,
ELASTIC_SERVERLESS_SUPERUSER,
ELASTIC_SERVERLESS_SUPERUSER_PASSWORD,
SERVERLESS_NODES,
getDockerFileMountPath,
verifyDockerInstalled,
maybeCreateDockerNetwork,
} from './src/utils';
export type { ArtifactLicense } from './src/artifact';

1
packages/kbn-es/src/serverless_resources/README.md
View file

@ -26,6 +26,7 @@ This section for Service Accounts was originally from the [ES Serverless reposit
The "service_tokens" file contains this line:
```
elastic/kibana/kibana-dev:$2a$10$mY2RuGROhk56vLNh.Mgwue98BnkdQPlTR.yGh38ao5jhPJobvuBCq
elastic/fleet-server/fleet-server-dev:$2a$10$tgMX7U09G/EVTP8F/O4zHewhA3DXdv7iM5F2vny9TC6zw77RrutyG
```
That line defines a single service token

5
packages/kbn-es/src/serverless_resources/operator_users.yml
View file

@ -7,3 +7,8 @@ operator:
auth_type: "token"
token_source: "file"
token_names: [ "kibana-dev" ]
- usernames: [ "elastic/fleet-server" ]
realm_type: "_service_account"
auth_type: "token"
token_source: "file"
token_names: [ "fleet-server-dev" ]

3
packages/kbn-es/src/serverless_resources/service_tokens
View file

@ -1 +1,2 @@
elastic/kibana/kibana-dev:$2a$10$mY2RuGROhk56vLNh.Mgwue98BnkdQPlTR.yGh38ao5jhPJobvuBCq
elastic/kibana/kibana-dev:$2a$10$mY2RuGROhk56vLNh.Mgwue98BnkdQPlTR.yGh38ao5jhPJobvuBCq
elastic/fleet-server/fleet-server-dev:$2a$10$tgMX7U09G/EVTP8F/O4zHewhA3DXdv7iM5F2vny9TC6zw77RrutyG

2
packages/kbn-es/src/utils/docker.ts
View file

@ -218,7 +218,7 @@ const DOCKER_SSL_ESARGS: Array<[string, string]> = [
['xpack.security.transport.ssl.keystore.password', ES_P12_PASSWORD],
];
const SERVERLESS_NODES: Array<Omit<ServerlessEsNodeArgs, 'image'>> = [
export const SERVERLESS_NODES: Array<Omit<ServerlessEsNodeArgs, 'image'>> = [
{
name: 'es01',
params: [

1
x-pack/plugins/fleet/common/types/index.ts
View file

@ -23,6 +23,7 @@ export interface FleetConfigType {
elasticsearch: {
hosts?: string[];
ca_sha256?: string;
ca_trusted_fingerprint?: string;
};
fleet_server?: {
hosts?: string[];

1
x-pack/plugins/fleet/public/mock/plugin_configuration.ts
View file

@ -18,6 +18,7 @@ export const createConfigurationMock = (): FleetConfigType => {
elasticsearch: {
hosts: [''],
ca_sha256: '',
ca_trusted_fingerprint: '',
},
},
};

1
x-pack/plugins/fleet/server/config.ts
View file

@ -120,6 +120,7 @@ export const config: PluginConfigDescriptor = {
elasticsearch: schema.object({
hosts: schema.maybe(schema.arrayOf(schema.uri({ scheme: ['http', 'https'] }))),
ca_sha256: schema.maybe(schema.string()),
ca_trusted_fingerprint: schema.maybe(schema.string()),
}),
fleet_server: schema.maybe(
schema.object({

1
x-pack/plugins/fleet/server/services/preconfiguration/outputs.test.ts
View file

@ -89,6 +89,7 @@ describe('output preconfiguration', () => {
Array [
Object {
"ca_sha256": undefined,
"ca_trusted_fingerprint": undefined,
"hosts": Array [
"http://elasticsearc:9201",
],

1
x-pack/plugins/fleet/server/services/preconfiguration/outputs.ts
View file

@ -30,6 +30,7 @@ export function getPreconfiguredOutputFromConfig(config?: FleetConfigType) {
id: DEFAULT_OUTPUT_ID,
hosts: config?.agents.elasticsearch.hosts,
ca_sha256: config?.agents.elasticsearch.ca_sha256,
ca_trusted_fingerprint: config?.agents.elasticsearch.ca_trusted_fingerprint,
is_preconfigured: true,
} as PreconfiguredOutput,
]

212
x-pack/plugins/osquery/cypress/e2e/all/alerts_cases.cy.ts
View file

@ -25,120 +25,128 @@ import {
} from '../../tasks/live_query';
import { generateRandomStringName, interceptCaseId } from '../../tasks/integrations';
import { ServerlessRoleName } from '../../support/roles';
describe('Alert Event Details - Cases', { tags: ['@ess', '@serverless'] }, () => {
let ruleId: string;
let ruleName: string;
let packId: string;
let packName: string;
const packData = packFixture();
before(() => {
loadPack(packData).then((data) => {
packId = data.saved_object_id;
packName = data.name;
});
loadRule(true).then((data) => {
ruleId = data.id;
ruleName = data.name;
loadRuleAlerts(data.name);
});
});
beforeEach(() => {
cy.login(ServerlessRoleName.SOC_MANAGER);
cy.visit('/app/security/rules');
clickRuleName(ruleName);
});
after(() => {
cleanupPack(packId);
cleanupRule(ruleId);
});
describe('Case creation', () => {
let caseId: string;
describe(
'Alert Event Details - Cases',
{ tags: ['@ess', '@serverless', '@brokenInServerless'] },
() => {
let ruleId: string;
let ruleName: string;
let packId: string;
let packName: string;
const packData = packFixture();
before(() => {
interceptCaseId((id) => {
caseId = id;
loadPack(packData).then((data) => {
packId = data.saved_object_id;
packName = data.name;
});
loadRule(true).then((data) => {
ruleId = data.id;
ruleName = data.name;
loadRuleAlerts(data.name);
});
});
beforeEach(() => {
cy.login(ServerlessRoleName.SOC_MANAGER);
cy.visit('/app/security/rules');
clickRuleName(ruleName);
});
after(() => {
cleanupCase(caseId);
cleanupPack(packId);
cleanupRule(ruleId);
});
it('runs osquery against alert and creates a new case', () => {
const [caseName, caseDescription] = generateRandomStringName(2);
cy.getBySel('expand-event').first().click({ force: true });
cy.getBySel('take-action-dropdown-btn').click();
cy.getBySel('osquery-action-item').click();
cy.contains(/^\d+ agen(t|ts) selected/);
cy.contains('Run a set of queries in a pack').click();
cy.get(LIVE_QUERY_EDITOR).should('not.exist');
cy.getBySel('select-live-pack').click().type(`${packName}{downArrow}{enter}`);
submitQuery();
cy.get('[aria-label="Add to Case"]').first().click();
cy.getBySel('cases-table-add-case-filter-bar').click();
cy.getBySel('create-case-flyout').should('be.visible');
cy.getBySel('caseTitle').within(() => {
cy.getBySel('input').type(caseName);
});
cy.getBySel('caseDescription').within(() => {
cy.getBySel('euiMarkdownEditorTextArea').type(caseDescription);
});
cy.getBySel('create-case-submit').click();
cy.contains(`An alert was added to "${caseName}"`);
});
});
describe('Case creation', () => {
let caseId: string;
// verify why calling new action doesnt add to response actions list
describe.skip('Case', () => {
let caseId: string;
before(() => {
loadCase('securitySolution').then((data) => {
caseId = data.id;
});
});
after(() => {
cleanupCase(caseId);
});
it('sees osquery results from last action and add to a case', () => {
cy.getBySel('expand-event').first().click();
cy.getBySel('securitySolutionDocumentDetailsFlyoutResponseSectionHeader').click();
cy.getBySel('securitySolutionDocumentDetailsFlyoutResponseButton').click();
cy.getBySel('responseActionsViewWrapper').should('exist');
cy.contains('select * from users;');
cy.contains("SELECT * FROM os_version where name='Ubuntu';");
cy.getBySel('osquery-results-comment').each(($comment) => {
cy.wrap($comment).within(() => {
// On initial load result table might not render due to displayed error
if ($comment.find('div .euiDataGridRow').length <= 0) {
// If tabs are present try clicking between status and results to get rid of the error message
if ($comment.find('div .euiTabs').length > 0) {
cy.getBySel('osquery-status-tab').click();
cy.getBySel('osquery-results-tab').click();
cy.getBySel('dataGridRowCell', { timeout: 120000 }).should('have.lengthOf.above', 0);
}
} else {
// Result tab was rendered successfully
cy.getBySel('dataGridRowCell', { timeout: 120000 }).should('have.lengthOf.above', 0);
}
// }
before(() => {
interceptCaseId((id) => {
caseId = id;
});
});
checkActionItemsInResults({
lens: true,
discover: true,
cases: true,
timeline: true,
after(() => {
cleanupCase(caseId);
});
addToCase(caseId);
viewRecentCaseAndCheckResults();
it('runs osquery against alert and creates a new case', () => {
const [caseName, caseDescription] = generateRandomStringName(2);
cy.getBySel('expand-event').first().click({ force: true });
cy.getBySel('take-action-dropdown-btn').click();
cy.getBySel('osquery-action-item').click();
cy.contains(/^\d+ agen(t|ts) selected/);
cy.contains('Run a set of queries in a pack').click();
cy.get(LIVE_QUERY_EDITOR).should('not.exist');
cy.getBySel('select-live-pack').click().type(`${packName}{downArrow}{enter}`);
submitQuery();
cy.get('[aria-label="Add to Case"]').first().click();
cy.getBySel('cases-table-add-case-filter-bar').click();
cy.getBySel('create-case-flyout').should('be.visible');
cy.getBySel('caseTitle').within(() => {
cy.getBySel('input').type(caseName);
});
cy.getBySel('caseDescription').within(() => {
cy.getBySel('euiMarkdownEditorTextArea').type(caseDescription);
});
cy.getBySel('create-case-submit').click();
cy.contains(`An alert was added to "${caseName}"`);
});
});
});
});
// verify why calling new action doesnt add to response actions list
describe.skip('Case', () => {
let caseId: string;
before(() => {
loadCase('securitySolution').then((data) => {
caseId = data.id;
});
});
after(() => {
cleanupCase(caseId);
});
it('sees osquery results from last action and add to a case', () => {
cy.getBySel('expand-event').first().click();
cy.getBySel('securitySolutionDocumentDetailsFlyoutResponseSectionHeader').click();
cy.getBySel('securitySolutionDocumentDetailsFlyoutResponseButton').click();
cy.getBySel('responseActionsViewWrapper').should('exist');
cy.contains('select * from users;');
cy.contains("SELECT * FROM os_version where name='Ubuntu';");
cy.getBySel('osquery-results-comment').each(($comment) => {
cy.wrap($comment).within(() => {
// On initial load result table might not render due to displayed error
if ($comment.find('div .euiDataGridRow').length <= 0) {
// If tabs are present try clicking between status and results to get rid of the error message
if ($comment.find('div .euiTabs').length > 0) {
cy.getBySel('osquery-status-tab').click();
cy.getBySel('osquery-results-tab').click();
cy.getBySel('dataGridRowCell', { timeout: 120000 }).should(
'have.lengthOf.above',
0
);
}
} else {
// Result tab was rendered successfully
cy.getBySel('dataGridRowCell', { timeout: 120000 }).should('have.lengthOf.above', 0);
}
// }
});
});
checkActionItemsInResults({
lens: true,
discover: true,
cases: true,
timeline: true,
});
addToCase(caseId);
viewRecentCaseAndCheckResults();
});
});
}
);

1
x-pack/plugins/osquery/cypress/e2e/all/alerts_liked_apps.cy.ts
View file

@ -20,6 +20,7 @@ import { ServerlessRoleName } from '../../support/roles';
const UUID_REGEX = '[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}';
// Issue: https://github.com/elastic/security-team/issues/7731
describe.skip('Alert Event Details', { tags: ['@ess', '@serverless'] }, () => {
let ruleId: string;
let ruleName: string;

170
x-pack/plugins/osquery/cypress/e2e/all/alerts_multiple_agents.cy.ts
View file

@ -15,93 +15,97 @@ import {
} from '../../tasks/live_query';
import { ServerlessRoleName } from '../../support/roles';
describe('Alert Event Details - dynamic params', { tags: ['@ess', '@serverless'] }, () => {
let ruleId: string;
let ruleName: string;
describe(
'Alert Event Details - dynamic params',
{ tags: ['@ess', '@serverless', '@brokenInServerless'] },
() => {
let ruleId: string;
let ruleName: string;
before(() => {
loadRule(true).then((data) => {
ruleId = data.id;
ruleName = data.name;
loadRuleAlerts(data.name);
});
});
after(() => {
cleanupRule(ruleId);
});
beforeEach(() => {
cy.login(ServerlessRoleName.SOC_MANAGER);
cy.visit('/app/security/rules');
clickRuleName(ruleName);
});
it('should substitute parameters in investigation guide', () => {
cy.getBySel('expand-event').first().click();
cy.getBySel('securitySolutionFlyoutInvestigationGuideButton').click();
cy.contains('Get processes').click();
cy.getBySel('flyout-body-osquery').within(() => {
cy.contains("SELECT * FROM os_version where name='Ubuntu';");
cy.contains('host.os.platform');
cy.contains('platform');
});
});
// response-actions-notification doesn't exist in expandable flyout
it.skip('should substitute parameters in live query and increase number of ran queries', () => {
let initialNotificationCount: number;
let updatedNotificationCount: number;
cy.getBySel('expand-event').first().click();
cy.getBySel('response-actions-notification')
.should('not.have.text', '0')
.then((element) => {
initialNotificationCount = parseInt(element.text(), 10);
before(() => {
loadRule(true).then((data) => {
ruleId = data.id;
ruleName = data.name;
loadRuleAlerts(data.name);
});
takeOsqueryActionWithParams();
cy.getBySel('osquery-empty-button').click();
cy.getBySel('response-actions-notification')
.should('not.have.text', '0')
.then((element) => {
updatedNotificationCount = parseInt(element.text(), 10);
expect(initialNotificationCount).to.be.equal(updatedNotificationCount - 1);
})
.then(() => {
cy.getBySel('securitySolutionDocumentDetailsFlyoutResponseSectionHeader').click();
cy.getBySel('securitySolutionDocumentDetailsFlyoutResponseButton').click();
cy.getBySel('responseActionsViewWrapper').within(() => {
cy.contains('tags');
cy.getBySel('osquery-results-comment').should('have.length', updatedNotificationCount);
});
after(() => {
cleanupRule(ruleId);
});
beforeEach(() => {
cy.login(ServerlessRoleName.SOC_MANAGER);
cy.visit('/app/security/rules');
clickRuleName(ruleName);
});
it('should substitute parameters in investigation guide', () => {
cy.getBySel('expand-event').first().click();
cy.getBySel('securitySolutionFlyoutInvestigationGuideButton').click();
cy.contains('Get processes').click();
cy.getBySel('flyout-body-osquery').within(() => {
cy.contains("SELECT * FROM os_version where name='Ubuntu';");
cy.contains('host.os.platform');
cy.contains('platform');
});
});
// response-actions-notification doesn't exist in expandable flyout
it.skip('should substitute parameters in live query and increase number of ran queries', () => {
let initialNotificationCount: number;
let updatedNotificationCount: number;
cy.getBySel('expand-event').first().click();
cy.getBySel('response-actions-notification')
.should('not.have.text', '0')
.then((element) => {
initialNotificationCount = parseInt(element.text(), 10);
});
takeOsqueryActionWithParams();
cy.getBySel('osquery-empty-button').click();
cy.getBySel('response-actions-notification')
.should('not.have.text', '0')
.then((element) => {
updatedNotificationCount = parseInt(element.text(), 10);
expect(initialNotificationCount).to.be.equal(updatedNotificationCount - 1);
})
.then(() => {
cy.getBySel('securitySolutionDocumentDetailsFlyoutResponseSectionHeader').click();
cy.getBySel('securitySolutionDocumentDetailsFlyoutResponseButton').click();
cy.getBySel('responseActionsViewWrapper').within(() => {
cy.contains('tags');
cy.getBySel('osquery-results-comment').should('have.length', updatedNotificationCount);
});
});
it('should be able to run take action query against all enrolled agents', () => {
cy.getBySel('expand-event').first().click();
cy.getBySel('take-action-dropdown-btn').click();
cy.getBySel('osquery-action-item').click();
cy.getBySel('agentSelection').within(() => {
cy.getBySel('comboBoxClearButton').click();
cy.getBySel('comboBoxInput').type('All{downArrow}{enter}{esc}');
cy.contains('All agents');
});
inputQuery("SELECT * FROM os_version where name='{{host.os.name}}';", {
parseSpecialCharSequences: false,
});
cy.wait(1000);
submitQuery();
cy.getBySel('flyout-body-osquery').within(() => {
// at least 2 agents should have responded, sometimes it takes a while for the agents to respond
cy.get('[data-grid-row-index]', { timeout: 6000000 }).should('have.length.at.least', 2);
});
});
it('should be able to run take action query against all enrolled agents', () => {
cy.getBySel('expand-event').first().click();
cy.getBySel('take-action-dropdown-btn').click();
cy.getBySel('osquery-action-item').click();
cy.getBySel('agentSelection').within(() => {
cy.getBySel('comboBoxClearButton').click();
cy.getBySel('comboBoxInput').type('All{downArrow}{enter}{esc}');
cy.contains('All agents');
});
inputQuery("SELECT * FROM os_version where name='{{host.os.name}}';", {
parseSpecialCharSequences: false,
});
cy.wait(1000);
submitQuery();
cy.getBySel('flyout-body-osquery').within(() => {
// at least 2 agents should have responded, sometimes it takes a while for the agents to respond
cy.get('[data-grid-row-index]', { timeout: 6000000 }).should('have.length.at.least', 2);
it('should substitute params in osquery ran from timelines alerts', () => {
loadRuleAlerts(ruleName);
cy.getBySel('send-alert-to-timeline-button').first().click();
cy.getBySel('query-events-table').within(() => {
cy.getBySel('expand-event').first().click();
});
takeOsqueryActionWithParams();
});
});
it('should substitute params in osquery ran from timelines alerts', () => {
loadRuleAlerts(ruleName);
cy.getBySel('send-alert-to-timeline-button').first().click();
cy.getBySel('query-events-table').within(() => {
cy.getBySel('expand-event').first().click();
});
takeOsqueryActionWithParams();
});
});
});
}
);

1
x-pack/plugins/osquery/cypress/e2e/all/alerts_response_actions_form.cy.ts
View file

@ -28,6 +28,7 @@ import {
import { closeDateTabIfVisible, closeToastIfVisible } from '../../tasks/integrations';
import { ServerlessRoleName } from '../../support/roles';
// Issue: https://github.com/elastic/security-team/issues/7731
describe.skip(
'Alert Event Details - Response Actions Form',
{ tags: ['@ess', '@serverless'] },

2
x-pack/plugins/osquery/cypress/e2e/all/live_query.cy.ts
View file

@ -18,7 +18,7 @@ import { LIVE_QUERY_EDITOR } from '../../screens/live_query';
import { getAdvancedButton } from '../../screens/integrations';
import { ServerlessRoleName } from '../../support/roles';
describe('ALL - Live Query', { tags: ['@serverless', '@ess'] }, () => {
describe('ALL - Live Query', { tags: ['@ess', '@serverless'] }, () => {
beforeEach(() => {
cy.login(ServerlessRoleName.SOC_MANAGER);
navigateTo('/app/osquery');

3
x-pack/plugins/osquery/cypress/e2e/all/live_query_packs.cy.ts
View file

@ -18,7 +18,7 @@ import { LIVE_QUERY_EDITOR } from '../../screens/live_query';
import { loadPack, cleanupPack, cleanupCase, loadCase } from '../../tasks/api_fixtures';
import { ServerlessRoleName } from '../../support/roles';
describe('ALL - Live Query Packs', { tags: ['@serverless', '@ess'] }, () => {
describe('ALL - Live Query Packs', { tags: ['@ess', '@serverless'] }, () => {
let packName: string;
let packId: string;
let caseId: string;
@ -75,7 +75,6 @@ describe('ALL - Live Query Packs', { tags: ['@serverless', '@ess'] }, () => {
cy.contains('failingQuery');
selectAllAgents();
submitQuery();
cy.getBySel('live-query-loading').should('exist');
cy.getBySel('toggleIcon-system_memory_linux_elastic').click();
checkResults();
checkActionItemsInResults({

122
x-pack/plugins/osquery/cypress/e2e/all/packs_create_edit.cy.ts
View file

@ -509,70 +509,74 @@ describe('Packs - Create and Edit', () => {
});
});
describe('should verify that packs are triggered', { tags: ['@ess', '@serverless'] }, () => {
let packId: string;
let packName: string;
describe(
'should verify that packs are triggered',
{ tags: ['@ess', '@serverless', '@brokenInServerless'] },
() => {
let packId: string;
let packName: string;
before(() => {
request<{ items: PackagePolicy[] }>({
url: '/internal/osquery/fleet_wrapper/package_policies',
headers: {
'Elastic-Api-Version': API_VERSIONS.internal.v1,
},
})
.then((response) =>
loadPack({
policy_ids: [response.body.items[0].policy_id],
queries: {
[savedQueryName]: { ecs_mapping: {}, interval: 60, query: 'select * from uptime;' },
},
})
)
.then((pack) => {
packId = pack.saved_object_id;
packName = pack.name;
});
});
after(() => {
cleanupPack(packId);
});
it('', () => {
preparePack(packName);
cy.contains(`${packName} details`).should('exist');
recurse<string>(
() => {
cy.getBySel('docsLoading').should('exist');
cy.getBySel('docsLoading').should('not.exist');
return cy.get('tbody .euiTableRow > td:nth-child(5)').invoke('text');
},
(response) => response === 'Docs1',
{
timeout: 300000,
post: () => {
cy.reload();
before(() => {
request<{ items: PackagePolicy[] }>({
url: '/internal/osquery/fleet_wrapper/package_policies',
headers: {
'Elastic-Api-Version': API_VERSIONS.internal.v1,
},
}
);
})
.then((response) =>
loadPack({
policy_ids: [response.body.items[0].policy_id],
queries: {
[savedQueryName]: { ecs_mapping: {}, interval: 60, query: 'select * from uptime;' },
},
})
)
.then((pack) => {
packId = pack.saved_object_id;
packName = pack.name;
});
});
cy.react('ScheduledQueryLastResults', { options: { timeout: 3000 } })
.should('exist')
.within(() => {
cy.react('FormattedRelative');
after(() => {
cleanupPack(packId);
});
it('', () => {
preparePack(packName);
cy.contains(`${packName} details`).should('exist');
recurse<string>(
() => {
cy.getBySel('docsLoading').should('exist');
cy.getBySel('docsLoading').should('not.exist');
return cy.get('tbody .euiTableRow > td:nth-child(5)').invoke('text');
},
(response) => response === 'Docs1',
{
timeout: 300000,
post: () => {
cy.reload();
},
}
);
cy.react('ScheduledQueryLastResults', { options: { timeout: 3000 } })
.should('exist')
.within(() => {
cy.react('FormattedRelative');
});
cy.react('DocsColumnResults').within(() => {
cy.react('EuiNotificationBadge').contains('1');
});
cy.react('DocsColumnResults').within(() => {
cy.react('EuiNotificationBadge').contains('1');
cy.react('AgentsColumnResults').within(() => {
cy.react('EuiNotificationBadge').contains('1');
});
cy.getBySel('packResultsErrorsEmpty').should('have.length', 1);
});
cy.react('AgentsColumnResults').within(() => {
cy.react('EuiNotificationBadge').contains('1');
});
cy.getBySel('packResultsErrorsEmpty').should('have.length', 1);
});
});
}
);
describe('delete all queries in the pack', { tags: ['@ess', '@serverless'] }, () => {
let packId: string;

1
x-pack/plugins/osquery/cypress/e2e/all/packs_integration.cy.ts
View file

@ -160,7 +160,6 @@ describe('ALL - Packs', { tags: ['@ess', '@serverless'] }, () => {
cy.getBySel('select-live-pack').click().type('osquery-monitoring{downArrow}{enter}');
selectAllAgents();
submitQuery();
cy.getBySel('live-query-loading').should('exist');
cy.getBySel('toggleIcon-events').click();
checkResults();
checkActionItemsInResults({

3
x-pack/plugins/osquery/cypress/e2e/all/saved_queries.cy.ts
View file

@ -22,7 +22,7 @@ import { getSavedQueriesComplexTest } from '../../tasks/saved_queries';
import { loadCase, cleanupCase, loadPack, cleanupPack } from '../../tasks/api_fixtures';
import { ServerlessRoleName } from '../../support/roles';
describe('ALL - Saved queries', { tags: ['@ess', '@serverless'] }, () => {
describe('ALL - Saved queries', { tags: ['@ess', '@serverless', '@brokenInServerless'] }, () => {
let caseId: string;
before(() => {
@ -82,6 +82,7 @@ describe('ALL - Saved queries', { tags: ['@ess', '@serverless'] }, () => {
});
beforeEach(() => {
cy.login(ServerlessRoleName.SOC_MANAGER);
navigateTo('/app/osquery/saved_queries');
cy.getBySel('tablePaginationPopoverButton').click();
cy.getBySel('tablePagination-50-rows').click();

4
x-pack/plugins/osquery/cypress/e2e/roles/t1_and_t2_analyst.cy.ts
View file

@ -23,9 +23,9 @@ import {
} from '../../tasks/api_fixtures';
import type { ServerlessRoleName } from '../../support/roles';
describe(`T1 and T2 analysts`, { tags: ['@ess', '@serverless'] }, () => {
describe(`T1 and T2 analysts`, { tags: ['@ess', '@serverless', '@brokenInServerless'] }, () => {
['t1_analyst', 't2_analyst'].forEach((role: string) => {
describe(`${role}- READ + runSavedQueries `, { tags: ['@ess', '@serverless'] }, () => {
describe(`${role}- READ + runSavedQueries `, () => {
let savedQueryName: string;
let savedQueryId: string;
let packName: string;

12
x-pack/plugins/osquery/cypress/support/e2e.ts
View file

@ -72,7 +72,17 @@ Cypress.Commands.add(
() => cy.get('body').click(0, 0) // 0,0 here are the x and y coordinates
);
Cypress.Commands.add('login', login);
Cypress.Commands.add('login', (role) => {
// TODO Temporary approach to login until login with role is supported in serverless
// Cypress.Commands.add('login', login);
const isServerless = Cypress.env().IS_SERVERLESS;
if (isServerless) {
return login.with('system_indices_superuser', 'changeme');
}
return login(role);
});
// Alternatively you can use CommonJS syntax:
// require('./commands')

144
x-pack/plugins/security_solution/scripts/endpoint/endpoint_agent_runner/fleet_server.ts
View file

@ -5,6 +5,12 @@
* 2.0.
*/
import {
CA_TRUSTED_FINGERPRINT,
FLEET_SERVER_CERT_PATH,
FLEET_SERVER_KEY_PATH,
fleetServerDevServiceAccount,
} from '@kbn/dev-utils';
import type {
AgentPolicy,
CreateAgentPolicyResponse,
@ -37,6 +43,9 @@ import type {
PostFleetServerHostsResponse,
} from '@kbn/fleet-plugin/common/types/rest_spec/fleet_server_hosts';
import chalk from 'chalk';
import { resolve } from 'path';
import { SERVERLESS_NODES, verifyDockerInstalled, maybeCreateDockerNetwork } from '@kbn/es';
import { isServerlessKibanaFlavor } from '../common/stack_services';
import type { FormattedAxiosError } from '../common/format_axios_error';
import { catchAxiosErrorFormatAndThrow } from '../common/format_axios_error';
import { isLocalhost } from '../common/is_localhost';
@ -44,32 +53,42 @@ import { dump } from './utils';
import { fetchFleetServerUrl, waitForHostToEnroll } from '../common/fleet_services';
import { getRuntimeServices } from './runtime';
const FLEET_SERVER_CUSTOM_CONFIG = resolve(__dirname, './fleet_server.yml');
export const runFleetServerIfNeeded = async (): Promise<
{ fleetServerContainerId: string; fleetServerAgentPolicyId: string } | undefined
{ fleetServerContainerId: string; fleetServerAgentPolicyId: string | undefined } | undefined
> => {
let fleetServerContainerId;
let fleetServerAgentPolicyId;
let serviceToken;
const {
log,
kibana: { isLocalhost: isKibanaOnLocalhost },
kbnClient,
} = getRuntimeServices();
log.info(`Setting up fleet server (if necessary)`);
log.indent(4);
const isServerless = await isServerlessKibanaFlavor(kbnClient);
await verifyDockerInstalled(log);
await maybeCreateDockerNetwork(log);
try {
fleetServerAgentPolicyId = await getOrCreateFleetServerAgentPolicyId();
const serviceToken = await generateFleetServiceToken();
if (isKibanaOnLocalhost) {
await configureFleetIfNeeded();
if (isServerless) {
fleetServerContainerId = await startFleetServerStandAloneWithDocker();
} else {
fleetServerAgentPolicyId = await getOrCreateFleetServerAgentPolicyId();
serviceToken = await generateFleetServiceToken();
if (isKibanaOnLocalhost) {
await configureFleetIfNeeded();
}
fleetServerContainerId = await startFleetServerWithDocker({
policyId: fleetServerAgentPolicyId,
serviceToken,
});
}
fleetServerContainerId = await startFleetServerWithDocker({
policyId: fleetServerAgentPolicyId,
serviceToken,
});
} catch (error) {
log.error(dump(error));
log.indent(-4);
@ -201,39 +220,29 @@ export const startFleetServerWithDocker = async ({
try {
const dockerArgs = [
'run',
'--restart',
'no',
'--net',
'elastic',
'--add-host',
'host.docker.internal:host-gateway',
'--rm',
'--detach',
'--name',
containerName,
// The container's hostname will appear in Fleet when the agent enrolls
'--hostname',
containerName,
'--env',
'FLEET_SERVER_ENABLE=1',
'--env',
`FLEET_SERVER_ELASTICSEARCH_HOST=${esUrlWithRealIp}`,
'--env',
`FLEET_SERVER_SERVICE_TOKEN=${serviceToken}`,
'--env',
`FLEET_SERVER_POLICY=${policyId}`,
'--publish',
`${fleetServerPort}:8220`,
`docker.elastic.co/beats/elastic-agent:${version}`,
];
@ -278,6 +287,95 @@ export const startFleetServerWithDocker = async ({
return containerId;
};
export const startFleetServerStandAloneWithDocker = async () => {
let containerId;
const {
log,
elastic: { url: elasticUrl },
fleetServer: { port: fleetServerPort },
} = getRuntimeServices();
log.info(`Starting a new fleet server using Docker`);
log.indent(4);
const esURL = new URL(elasticUrl);
esURL.hostname = SERVERLESS_NODES[0].name;
const esUrlWithRealIp = esURL.toString();
const containerName = `dev-fleet-server.${fleetServerPort}`;
try {
const dockerArgs = [
'run',
'--restart',
'no',
'--net',
'elastic',
'--add-host',
'host.docker.internal:host-gateway',
'--rm',
'--detach',
'--name',
containerName,
// The container's hostname will appear in Fleet when the agent enrolls
'--hostname',
containerName,
'--volume',
`${FLEET_SERVER_CERT_PATH}:/fleet-server.crt`,
'--volume',
`${FLEET_SERVER_KEY_PATH}:/fleet-server.key`,
'--env',
'FLEET_SERVER_CERT=/fleet-server.crt',
'--env',
'FLEET_SERVER_CERT_KEY=/fleet-server.key',
'--env',
`ELASTICSEARCH_HOSTS=${esUrlWithRealIp}`,
'--env',
`ELASTICSEARCH_SERVICE_TOKEN=${fleetServerDevServiceAccount.token}`,
'--env',
`ELASTICSEARCH_CA_TRUSTED_FINGERPRINT=${CA_TRUSTED_FINGERPRINT}`,
'--volume',
`${FLEET_SERVER_CUSTOM_CONFIG}:/etc/fleet-server.yml:ro`,
'--publish',
`${fleetServerPort}:8220`,
`docker.elastic.co/observability-ci/fleet-server:latest`,
];
await execa('docker', ['kill', containerName])
.then(() => {
log.verbose(
`Killed an existing container with name [${containerName}]. New one will be started.`
);
})
.catch((error) => {
log.verbose(`Attempt to kill currently running fleet-server container (if any) with name [${containerName}] was unsuccessful:
${error}
(This is ok if one was not running already)`);
});
log.verbose(`docker arguments:\n${dockerArgs.join(' ')}`);
containerId = (await execa('docker', dockerArgs)).stdout;
log.info(`Done. Fleet Server Stand Alone is running and connected to Fleet.
Container Name: ${containerName}
Container Id: ${containerId}
View running output: ${chalk.bold(`docker attach ---sig-proxy=false ${containerName}`)}
Shell access: ${chalk.bold(`docker exec -it ${containerName} /bin/bash`)}
Kill container: ${chalk.bold(`docker kill ${containerId}`)}
`);
} catch (error) {
log.error(dump(error));
log.indent(-4);
throw error;
}
log.indent(-4);
return containerId;
};
const configureFleetIfNeeded = async () => {
const { log, kbnClient, localhostRealIp } = getRuntimeServices();

26
x-pack/plugins/security_solution/scripts/endpoint/endpoint_agent_runner/fleet_server.yml Normal file
View file

@ -0,0 +1,26 @@
# This config is intended to be used with a stand-alone fleet-server instance for development.
output:
elasticsearch:
hosts: '${ELASTICSEARCH_HOSTS}'
service_token: '${ELASTICSEARCH_SERVICE_TOKEN}'
ssl.ca_trusted_fingerprint: '${ELASTICSEARCH_CA_TRUSTED_FINGERPRINT}'
fleet:
agent:
id: '${FLEET_SERVER_AGENT_ID:dev-fleet-server}'
inputs:
- type: fleet-server
policy.id: '${FLEET_SERVER_POLICY_ID:fleet-server-policy}'
server:
ssl:
enabled: true
certificate: /fleet-server.crt
key: /fleet-server.key
logging:
to_stderr: true # Force the logging output to stderr
pretty: true
level: '${LOG_LEVEL:DEBUG}'
http.enabled: true

27
x-pack/plugins/security_solution/scripts/run_cypress/get_ftr_config.ts
View file

@ -6,9 +6,10 @@
*/
import _ from 'lodash';
import { SERVERLESS_NODES } from '@kbn/es';
import { EsVersion, readConfigFile } from '@kbn/test';
import type { ToolingLog } from '@kbn/tooling-log';
import { CA_TRUSTED_FINGERPRINT } from '@kbn/dev-utils';
import { getLocalhostRealIp } from '../endpoint/common/localhost_services';
import type { parseTestFileConfig } from './utils';
@ -133,15 +134,23 @@ export const getFTRConfig = ({
}
if (hasFleetServerArgs) {
vars.kbnTestServer.serverArgs.push(
`--xpack.fleet.agents.fleet_server.hosts=["https://${hostRealIp}:${fleetServerPort}"]`
);
vars.kbnTestServer.serverArgs.push(
`--xpack.fleet.agents.elasticsearch.host=http://${hostRealIp}:${esPort}`
);
if (vars.serverless) {
vars.kbnTestServer.serverArgs.push(`--xpack.fleet.internal.fleetServerStandalone=false`);
vars.kbnTestServer.serverArgs.push(
`--xpack.fleet.agents.fleet_server.hosts=["https://host.docker.internal:${fleetServerPort}"]`
);
vars.kbnTestServer.serverArgs.push(
`--xpack.fleet.agents.elasticsearch.host=https://${SERVERLESS_NODES[0].name}:${esPort}`
);
vars.kbnTestServer.serverArgs.push(
`--xpack.fleet.agents.elasticsearch.ca_trusted_fingerprint=${CA_TRUSTED_FINGERPRINT}`
);
} else {
vars.kbnTestServer.serverArgs.push(
`--xpack.fleet.agents.fleet_server.hosts=["https://${hostRealIp}:${fleetServerPort}"]`
);
vars.kbnTestServer.serverArgs.push(
`--xpack.fleet.agents.elasticsearch.host=http://${hostRealIp}:${esPort}`
);
}
}

3
x-pack/plugins/security_solution/tsconfig.json
View file

@ -173,6 +173,7 @@
"@kbn/content-management-plugin",
"@kbn/discover-utils",
"@kbn/subscription-tracking",
"@kbn/openapi-generator"
"@kbn/openapi-generator",
"@kbn/es"
]
}

37
x-pack/test/cloud_integration/plugins/saml_provider/metadata.xml
View file

@ -7,24 +7,25 @@
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<!-- This certificate is extracted from KBN_CERT_PATH in @kbn/dev-utils and should always be in sync with it -->
<ds:X509Certificate>MIIDOTCCAiGgAwIBAgIVAN0GVNLw3IaUBuG7t6CeW8w2wyymMA0GCSqGSIb3DQEB
CwUAMDQxMjAwBgNVBAMTKUVsYXN0aWMgQ2VydGlmaWNhdGUgVG9vbCBBdXRvZ2Vu
ZXJhdGVkIENBMCAXDTIxMTAxMzEwMTU1OFoYDzIwNzExMDAxMTAxNTU4WjARMQ8w
DQYDVQQDEwZraWJhbmEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3
nvfL3/26D8EkLso+t9S0m+tSJipLsBWs0dCpc8KRJ/+ijDRnAQ5lOmOAcxt43SNY
KFr0EntQEZyYaRwMIM8aPR0WYW/VV5o4fq2o/JnmHqzZJRJCwZq+5WiCiDPt012N
mRGYCMUxjlEwejue6diLAeQhZ/sfN4jUp217bMEHrhHrNBWTwwJ+Uk5TBQMhviCW
LKbsKrfluA6DGHWrXN4pH7Xmaf/Zyc9AYL/nxwv3VQHZzIAK/U/WNCgFJJ3qoFYY
6TUwDDNa30mSj165OOds9N+VmUlDC3IFiHV3osBWscSU4HJd6QJ8huHrFLLV4y4i
u62el47Qr+/8Ut3SzeIXAgMBAAGjYzBhMB0GA1UdDgQWBBQli5f2bYL9jKUA5Uxp
yRRHeCoPJzAfBgNVHSMEGDAWgBQwTCrAjlvQxik3HBocn1PDUunenjAUBgNVHREE
DTALgglsb2NhbGhvc3QwCQYDVR0TBAIwADANBgkqhkiG9w0BAQsFAAOCAQEATFNj
WkTBPfgflGYZD4OsYvfT/rVjFKbJP/u1a0rkzNamA2QKNzI9JTOzONPTyRhe9yVS
zeO8X2rtN63l38dtgMjFQ15Xxnp7GFT7GkXfa1JR+tGSGTgVld8nLUzig+mNmBoR
nE4cNc0JJ1PsXPzfPgJ6WMp2WOoNUrQf2cm42i36Jk+7KGcosfyFMPQILZE34Geo
DAgCVpNWPgST4HYBUCHMC7S14LHLVdUXPsfGZPEqU5Zf9Hvy61rQC/RdNjnMI6JD
s57l9oHASNeEg55NQm01aOmwq/z1DXs3UP2nRmp6XCCfE61ghofO5dtV1j3cZ3f5
dzkzSBV7H6+/MD3Y8Q==</ds:X509Certificate>
<ds:X509Certificate>MIIDYjCCAkqgAwIBAgIUZ2p8K7GMXGk6xwCS9S91BUl1JnAwDQYJKoZIhvcNAQEL
BQAwNDEyMDAGA1UEAxMpRWxhc3RpYyBDZXJ0aWZpY2F0ZSBUb29sIEF1dG9nZW5l
cmF0ZWQgQ0EwIBcNMjMwOTIzMTUyMDE0WhgPMjA3MzA5MTAxNTIwMTRaMBExDzAN
BgNVBAMTBmtpYmFuYTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMOU
r52dbZ5dY0BoP2p7CEnOpG+qHTNrOAqZO/OJfniPMtpGmwAMl3WZDca6u2XkV2KE
qQyevQ2ADk6G3o8S2RU8mO/+UweuCDF7LHuSdxEGTpucidZErmVhEGUOFosL5UeB
AtIDWxvWwgK+W9Yzt5IEN2HzNCZ6h0dOSk2r9EjVMG5yF4Q6kuqOYxBT7jxoaOtO
OCrgBRummtUga4T13WZ/ZIyyHpXj2+JD4YEmrDyoTa7NLaphv0hnVhHXYoYBI/c6
2SwwAoBlmtDmlinwSACQ3o/8eLWk0tqkIP14rc3oFh3m7D2c3c2m2HXuyoSDMfGW
beG2IE1Q3idcGmeG3qsCAwEAAaOBjDCBiTAdBgNVHQ4EFgQUMOUM7w5jmIozDvnq
RpM779m5GigwHwYDVR0jBBgwFoAUMEwqwI5b0MYpNxwaHJ9Tw1Lp3p4wPAYDVR0R
BDUwM4IUaG9zdC5kb2NrZXIuaW50ZXJuYWyCCWxvY2FsaG9zdIIEZXMwM4IEZXMw
MoIEZXMwMTAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQCxqvQYXSKqgpdl
SP4gXgwipAnYsoW9qkgWQODTvSBEzUdOWme0d3j7i2l6Ur/nVSv5YjkqAv1hf/yJ
Hrk9h+j29ZO/aQ/KDh5i/gTEUnPw3Bxbw47dfn23tjMWO7NCU1fr5HNztRsa/gQr
e9s07g25u/gTfTi9Fyu0lcRe3bXOLS/mFVcuC5oxuS65R9OlbIsiORkZ2EfwuNUf
wAAYOGPIjM2VlQCvBitefsd/SzRKHdxSPy6KSjkO6MGEGo87fr7B7Nx1qp1DVrK7
q9XeP1Cuygjg9WTcnsvWvNw8CssyuFM6X/3tGjpPasXwLvNUoG2AairK2AYTWhvS
foE31cFg</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>

2
x-pack/test/osquery_cypress/agent.ts
View file

@ -32,6 +32,8 @@ export class AgentManager extends Manager {
const dockerArgs = [
'run',
'--net',
'elastic',
'--detach',
'--add-host',
'host.docker.internal:host-gateway',

2
x-pack/test/osquery_cypress/artifact_manager.ts
View file

@ -6,5 +6,5 @@
*/
export async function getLatestVersion(): Promise<string> {
return '8.10.0-SNAPSHOT';
return '8.11.0-SNAPSHOT';
}

4
x-pack/test/osquery_cypress/runner.ts
View file

@ -7,6 +7,7 @@
import Url from 'url';
import { verifyDockerInstalled, maybeCreateDockerNetwork } from '@kbn/es';
import { startRuntimeServices } from '@kbn/security-solution-plugin/scripts/endpoint/endpoint_agent_runner/runtime';
import { FtrProviderContext } from './ftr_provider_context';
@ -29,6 +30,9 @@ async function setupFleetAgent({ getService }: FtrProviderContext) {
const username = config.get('servers.elasticsearch.username');
const password = config.get('servers.elasticsearch.password');
await verifyDockerInstalled(log);
await maybeCreateDockerNetwork(log);
await startRuntimeServices({
log,
elasticUrl,

8
x-pack/test/osquery_cypress/serverless_cli_config.ts
View file

@ -7,6 +7,7 @@
import { FtrConfigProviderContext } from '@kbn/test';
import { SERVERLESS_NODES } from '@kbn/es';
import { startOsqueryCypress } from './runner';
export default async function ({ readConfigFile }: FtrConfigProviderContext) {
@ -32,12 +33,11 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
serverArgs: [
...securitySolutionCypressConfig.get('kbnTestServer.serverArgs'),
`--xpack.fleet.agents.fleet_server.hosts=["https://host.docker.internal:8220"]`,
`--xpack.fleet.agents.elasticsearch.host=http://host.docker.internal:${securitySolutionCypressConfig.get(
'servers.elasticsearch.port'
)}`,
`--xpack.fleet.agents.elasticsearch.host=http://${
SERVERLESS_NODES[0].name
}:${securitySolutionCypressConfig.get('servers.elasticsearch.port')}`,
`--xpack.fleet.packages.0.name=osquery_manager`,
`--xpack.fleet.packages.0.version=latest`,
`--xpack.fleet.internal.fleetServerStandalone=false`,
],
},

37
x-pack/test/security_api_integration/packages/helpers/saml/idp_metadata.xml
View file

@ -7,24 +7,25 @@
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<!-- This certificate is extracted from KBN_CERT_PATH in @kbn/dev-utils and should always be in sync with it -->
<ds:X509Certificate>MIIDOTCCAiGgAwIBAgIVAN0GVNLw3IaUBuG7t6CeW8w2wyymMA0GCSqGSIb3DQEB
CwUAMDQxMjAwBgNVBAMTKUVsYXN0aWMgQ2VydGlmaWNhdGUgVG9vbCBBdXRvZ2Vu
ZXJhdGVkIENBMCAXDTIxMTAxMzEwMTU1OFoYDzIwNzExMDAxMTAxNTU4WjARMQ8w
DQYDVQQDEwZraWJhbmEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3
nvfL3/26D8EkLso+t9S0m+tSJipLsBWs0dCpc8KRJ/+ijDRnAQ5lOmOAcxt43SNY
KFr0EntQEZyYaRwMIM8aPR0WYW/VV5o4fq2o/JnmHqzZJRJCwZq+5WiCiDPt012N
mRGYCMUxjlEwejue6diLAeQhZ/sfN4jUp217bMEHrhHrNBWTwwJ+Uk5TBQMhviCW
LKbsKrfluA6DGHWrXN4pH7Xmaf/Zyc9AYL/nxwv3VQHZzIAK/U/WNCgFJJ3qoFYY
6TUwDDNa30mSj165OOds9N+VmUlDC3IFiHV3osBWscSU4HJd6QJ8huHrFLLV4y4i
u62el47Qr+/8Ut3SzeIXAgMBAAGjYzBhMB0GA1UdDgQWBBQli5f2bYL9jKUA5Uxp
yRRHeCoPJzAfBgNVHSMEGDAWgBQwTCrAjlvQxik3HBocn1PDUunenjAUBgNVHREE
DTALgglsb2NhbGhvc3QwCQYDVR0TBAIwADANBgkqhkiG9w0BAQsFAAOCAQEATFNj
WkTBPfgflGYZD4OsYvfT/rVjFKbJP/u1a0rkzNamA2QKNzI9JTOzONPTyRhe9yVS
zeO8X2rtN63l38dtgMjFQ15Xxnp7GFT7GkXfa1JR+tGSGTgVld8nLUzig+mNmBoR
nE4cNc0JJ1PsXPzfPgJ6WMp2WOoNUrQf2cm42i36Jk+7KGcosfyFMPQILZE34Geo
DAgCVpNWPgST4HYBUCHMC7S14LHLVdUXPsfGZPEqU5Zf9Hvy61rQC/RdNjnMI6JD
s57l9oHASNeEg55NQm01aOmwq/z1DXs3UP2nRmp6XCCfE61ghofO5dtV1j3cZ3f5
dzkzSBV7H6+/MD3Y8Q==</ds:X509Certificate>
<ds:X509Certificate>MIIDYjCCAkqgAwIBAgIUZ2p8K7GMXGk6xwCS9S91BUl1JnAwDQYJKoZIhvcNAQEL
BQAwNDEyMDAGA1UEAxMpRWxhc3RpYyBDZXJ0aWZpY2F0ZSBUb29sIEF1dG9nZW5l
cmF0ZWQgQ0EwIBcNMjMwOTIzMTUyMDE0WhgPMjA3MzA5MTAxNTIwMTRaMBExDzAN
BgNVBAMTBmtpYmFuYTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMOU
r52dbZ5dY0BoP2p7CEnOpG+qHTNrOAqZO/OJfniPMtpGmwAMl3WZDca6u2XkV2KE
qQyevQ2ADk6G3o8S2RU8mO/+UweuCDF7LHuSdxEGTpucidZErmVhEGUOFosL5UeB
AtIDWxvWwgK+W9Yzt5IEN2HzNCZ6h0dOSk2r9EjVMG5yF4Q6kuqOYxBT7jxoaOtO
OCrgBRummtUga4T13WZ/ZIyyHpXj2+JD4YEmrDyoTa7NLaphv0hnVhHXYoYBI/c6
2SwwAoBlmtDmlinwSACQ3o/8eLWk0tqkIP14rc3oFh3m7D2c3c2m2HXuyoSDMfGW
beG2IE1Q3idcGmeG3qsCAwEAAaOBjDCBiTAdBgNVHQ4EFgQUMOUM7w5jmIozDvnq
RpM779m5GigwHwYDVR0jBBgwFoAUMEwqwI5b0MYpNxwaHJ9Tw1Lp3p4wPAYDVR0R
BDUwM4IUaG9zdC5kb2NrZXIuaW50ZXJuYWyCCWxvY2FsaG9zdIIEZXMwM4IEZXMw
MoIEZXMwMTAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQCxqvQYXSKqgpdl
SP4gXgwipAnYsoW9qkgWQODTvSBEzUdOWme0d3j7i2l6Ur/nVSv5YjkqAv1hf/yJ
Hrk9h+j29ZO/aQ/KDh5i/gTEUnPw3Bxbw47dfn23tjMWO7NCU1fr5HNztRsa/gQr
e9s07g25u/gTfTi9Fyu0lcRe3bXOLS/mFVcuC5oxuS65R9OlbIsiORkZ2EfwuNUf
wAAYOGPIjM2VlQCvBitefsd/SzRKHdxSPy6KSjkO6MGEGo87fr7B7Nx1qp1DVrK7
q9XeP1Cuygjg9WTcnsvWvNw8CssyuFM6X/3tGjpPasXwLvNUoG2AairK2AYTWhvS
foE31cFg</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>

37
x-pack/test/security_api_integration/packages/helpers/saml/idp_metadata_2.xml
View file

@ -7,24 +7,25 @@
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<!-- This certificate is extracted from KBN_CERT_PATH in @kbn/dev-utils and should always be in sync with it -->
<ds:X509Certificate>MIIDOTCCAiGgAwIBAgIVAN0GVNLw3IaUBuG7t6CeW8w2wyymMA0GCSqGSIb3DQEB
CwUAMDQxMjAwBgNVBAMTKUVsYXN0aWMgQ2VydGlmaWNhdGUgVG9vbCBBdXRvZ2Vu
ZXJhdGVkIENBMCAXDTIxMTAxMzEwMTU1OFoYDzIwNzExMDAxMTAxNTU4WjARMQ8w
DQYDVQQDEwZraWJhbmEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3
nvfL3/26D8EkLso+t9S0m+tSJipLsBWs0dCpc8KRJ/+ijDRnAQ5lOmOAcxt43SNY
KFr0EntQEZyYaRwMIM8aPR0WYW/VV5o4fq2o/JnmHqzZJRJCwZq+5WiCiDPt012N
mRGYCMUxjlEwejue6diLAeQhZ/sfN4jUp217bMEHrhHrNBWTwwJ+Uk5TBQMhviCW
LKbsKrfluA6DGHWrXN4pH7Xmaf/Zyc9AYL/nxwv3VQHZzIAK/U/WNCgFJJ3qoFYY
6TUwDDNa30mSj165OOds9N+VmUlDC3IFiHV3osBWscSU4HJd6QJ8huHrFLLV4y4i
u62el47Qr+/8Ut3SzeIXAgMBAAGjYzBhMB0GA1UdDgQWBBQli5f2bYL9jKUA5Uxp
yRRHeCoPJzAfBgNVHSMEGDAWgBQwTCrAjlvQxik3HBocn1PDUunenjAUBgNVHREE
DTALgglsb2NhbGhvc3QwCQYDVR0TBAIwADANBgkqhkiG9w0BAQsFAAOCAQEATFNj
WkTBPfgflGYZD4OsYvfT/rVjFKbJP/u1a0rkzNamA2QKNzI9JTOzONPTyRhe9yVS
zeO8X2rtN63l38dtgMjFQ15Xxnp7GFT7GkXfa1JR+tGSGTgVld8nLUzig+mNmBoR
nE4cNc0JJ1PsXPzfPgJ6WMp2WOoNUrQf2cm42i36Jk+7KGcosfyFMPQILZE34Geo
DAgCVpNWPgST4HYBUCHMC7S14LHLVdUXPsfGZPEqU5Zf9Hvy61rQC/RdNjnMI6JD
s57l9oHASNeEg55NQm01aOmwq/z1DXs3UP2nRmp6XCCfE61ghofO5dtV1j3cZ3f5
dzkzSBV7H6+/MD3Y8Q==</ds:X509Certificate>
<ds:X509Certificate>MIIDYjCCAkqgAwIBAgIUZ2p8K7GMXGk6xwCS9S91BUl1JnAwDQYJKoZIhvcNAQEL
BQAwNDEyMDAGA1UEAxMpRWxhc3RpYyBDZXJ0aWZpY2F0ZSBUb29sIEF1dG9nZW5l
cmF0ZWQgQ0EwIBcNMjMwOTIzMTUyMDE0WhgPMjA3MzA5MTAxNTIwMTRaMBExDzAN
BgNVBAMTBmtpYmFuYTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMOU
r52dbZ5dY0BoP2p7CEnOpG+qHTNrOAqZO/OJfniPMtpGmwAMl3WZDca6u2XkV2KE
qQyevQ2ADk6G3o8S2RU8mO/+UweuCDF7LHuSdxEGTpucidZErmVhEGUOFosL5UeB
AtIDWxvWwgK+W9Yzt5IEN2HzNCZ6h0dOSk2r9EjVMG5yF4Q6kuqOYxBT7jxoaOtO
OCrgBRummtUga4T13WZ/ZIyyHpXj2+JD4YEmrDyoTa7NLaphv0hnVhHXYoYBI/c6
2SwwAoBlmtDmlinwSACQ3o/8eLWk0tqkIP14rc3oFh3m7D2c3c2m2HXuyoSDMfGW
beG2IE1Q3idcGmeG3qsCAwEAAaOBjDCBiTAdBgNVHQ4EFgQUMOUM7w5jmIozDvnq
RpM779m5GigwHwYDVR0jBBgwFoAUMEwqwI5b0MYpNxwaHJ9Tw1Lp3p4wPAYDVR0R
BDUwM4IUaG9zdC5kb2NrZXIuaW50ZXJuYWyCCWxvY2FsaG9zdIIEZXMwM4IEZXMw
MoIEZXMwMTAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQCxqvQYXSKqgpdl
SP4gXgwipAnYsoW9qkgWQODTvSBEzUdOWme0d3j7i2l6Ur/nVSv5YjkqAv1hf/yJ
Hrk9h+j29ZO/aQ/KDh5i/gTEUnPw3Bxbw47dfn23tjMWO7NCU1fr5HNztRsa/gQr
e9s07g25u/gTfTi9Fyu0lcRe3bXOLS/mFVcuC5oxuS65R9OlbIsiORkZ2EfwuNUf
wAAYOGPIjM2VlQCvBitefsd/SzRKHdxSPy6KSjkO6MGEGo87fr7B7Nx1qp1DVrK7
q9XeP1Cuygjg9WTcnsvWvNw8CssyuFM6X/3tGjpPasXwLvNUoG2AairK2AYTWhvS
foE31cFg</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>

37
x-pack/test/security_api_integration/packages/helpers/saml/idp_metadata_never_login.xml
View file

@ -7,24 +7,25 @@
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<!-- This certificate is extracted from KBN_CERT_PATH in @kbn/dev-utils and should always be in sync with it -->
<ds:X509Certificate>MIIDOTCCAiGgAwIBAgIVAN0GVNLw3IaUBuG7t6CeW8w2wyymMA0GCSqGSIb3DQEB
CwUAMDQxMjAwBgNVBAMTKUVsYXN0aWMgQ2VydGlmaWNhdGUgVG9vbCBBdXRvZ2Vu
ZXJhdGVkIENBMCAXDTIxMTAxMzEwMTU1OFoYDzIwNzExMDAxMTAxNTU4WjARMQ8w
DQYDVQQDEwZraWJhbmEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3
nvfL3/26D8EkLso+t9S0m+tSJipLsBWs0dCpc8KRJ/+ijDRnAQ5lOmOAcxt43SNY
KFr0EntQEZyYaRwMIM8aPR0WYW/VV5o4fq2o/JnmHqzZJRJCwZq+5WiCiDPt012N
mRGYCMUxjlEwejue6diLAeQhZ/sfN4jUp217bMEHrhHrNBWTwwJ+Uk5TBQMhviCW
LKbsKrfluA6DGHWrXN4pH7Xmaf/Zyc9AYL/nxwv3VQHZzIAK/U/WNCgFJJ3qoFYY
6TUwDDNa30mSj165OOds9N+VmUlDC3IFiHV3osBWscSU4HJd6QJ8huHrFLLV4y4i
u62el47Qr+/8Ut3SzeIXAgMBAAGjYzBhMB0GA1UdDgQWBBQli5f2bYL9jKUA5Uxp
yRRHeCoPJzAfBgNVHSMEGDAWgBQwTCrAjlvQxik3HBocn1PDUunenjAUBgNVHREE
DTALgglsb2NhbGhvc3QwCQYDVR0TBAIwADANBgkqhkiG9w0BAQsFAAOCAQEATFNj
WkTBPfgflGYZD4OsYvfT/rVjFKbJP/u1a0rkzNamA2QKNzI9JTOzONPTyRhe9yVS
zeO8X2rtN63l38dtgMjFQ15Xxnp7GFT7GkXfa1JR+tGSGTgVld8nLUzig+mNmBoR
nE4cNc0JJ1PsXPzfPgJ6WMp2WOoNUrQf2cm42i36Jk+7KGcosfyFMPQILZE34Geo
DAgCVpNWPgST4HYBUCHMC7S14LHLVdUXPsfGZPEqU5Zf9Hvy61rQC/RdNjnMI6JD
s57l9oHASNeEg55NQm01aOmwq/z1DXs3UP2nRmp6XCCfE61ghofO5dtV1j3cZ3f5
dzkzSBV7H6+/MD3Y8Q==</ds:X509Certificate>
<ds:X509Certificate>MIIDYjCCAkqgAwIBAgIUZ2p8K7GMXGk6xwCS9S91BUl1JnAwDQYJKoZIhvcNAQEL
BQAwNDEyMDAGA1UEAxMpRWxhc3RpYyBDZXJ0aWZpY2F0ZSBUb29sIEF1dG9nZW5l
cmF0ZWQgQ0EwIBcNMjMwOTIzMTUyMDE0WhgPMjA3MzA5MTAxNTIwMTRaMBExDzAN
BgNVBAMTBmtpYmFuYTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMOU
r52dbZ5dY0BoP2p7CEnOpG+qHTNrOAqZO/OJfniPMtpGmwAMl3WZDca6u2XkV2KE
qQyevQ2ADk6G3o8S2RU8mO/+UweuCDF7LHuSdxEGTpucidZErmVhEGUOFosL5UeB
AtIDWxvWwgK+W9Yzt5IEN2HzNCZ6h0dOSk2r9EjVMG5yF4Q6kuqOYxBT7jxoaOtO
OCrgBRummtUga4T13WZ/ZIyyHpXj2+JD4YEmrDyoTa7NLaphv0hnVhHXYoYBI/c6
2SwwAoBlmtDmlinwSACQ3o/8eLWk0tqkIP14rc3oFh3m7D2c3c2m2HXuyoSDMfGW
beG2IE1Q3idcGmeG3qsCAwEAAaOBjDCBiTAdBgNVHQ4EFgQUMOUM7w5jmIozDvnq
RpM779m5GigwHwYDVR0jBBgwFoAUMEwqwI5b0MYpNxwaHJ9Tw1Lp3p4wPAYDVR0R
BDUwM4IUaG9zdC5kb2NrZXIuaW50ZXJuYWyCCWxvY2FsaG9zdIIEZXMwM4IEZXMw
MoIEZXMwMTAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQCxqvQYXSKqgpdl
SP4gXgwipAnYsoW9qkgWQODTvSBEzUdOWme0d3j7i2l6Ur/nVSv5YjkqAv1hf/yJ
Hrk9h+j29ZO/aQ/KDh5i/gTEUnPw3Bxbw47dfn23tjMWO7NCU1fr5HNztRsa/gQr
e9s07g25u/gTfTi9Fyu0lcRe3bXOLS/mFVcuC5oxuS65R9OlbIsiORkZ2EfwuNUf
wAAYOGPIjM2VlQCvBitefsd/SzRKHdxSPy6KSjkO6MGEGo87fr7B7Nx1qp1DVrK7
q9XeP1Cuygjg9WTcnsvWvNw8CssyuFM6X/3tGjpPasXwLvNUoG2AairK2AYTWhvS
foE31cFg</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>

37
x-pack/test/security_api_integration/plugins/saml_provider/metadata.xml
View file

@ -7,24 +7,25 @@
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<!-- This certificate is extracted from KBN_CERT_PATH in @kbn/dev-utils and should always be in sync with it -->
<ds:X509Certificate>MIIDOTCCAiGgAwIBAgIVAN0GVNLw3IaUBuG7t6CeW8w2wyymMA0GCSqGSIb3DQEB
CwUAMDQxMjAwBgNVBAMTKUVsYXN0aWMgQ2VydGlmaWNhdGUgVG9vbCBBdXRvZ2Vu
ZXJhdGVkIENBMCAXDTIxMTAxMzEwMTU1OFoYDzIwNzExMDAxMTAxNTU4WjARMQ8w
DQYDVQQDEwZraWJhbmEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3
nvfL3/26D8EkLso+t9S0m+tSJipLsBWs0dCpc8KRJ/+ijDRnAQ5lOmOAcxt43SNY
KFr0EntQEZyYaRwMIM8aPR0WYW/VV5o4fq2o/JnmHqzZJRJCwZq+5WiCiDPt012N
mRGYCMUxjlEwejue6diLAeQhZ/sfN4jUp217bMEHrhHrNBWTwwJ+Uk5TBQMhviCW
LKbsKrfluA6DGHWrXN4pH7Xmaf/Zyc9AYL/nxwv3VQHZzIAK/U/WNCgFJJ3qoFYY
6TUwDDNa30mSj165OOds9N+VmUlDC3IFiHV3osBWscSU4HJd6QJ8huHrFLLV4y4i
u62el47Qr+/8Ut3SzeIXAgMBAAGjYzBhMB0GA1UdDgQWBBQli5f2bYL9jKUA5Uxp
yRRHeCoPJzAfBgNVHSMEGDAWgBQwTCrAjlvQxik3HBocn1PDUunenjAUBgNVHREE
DTALgglsb2NhbGhvc3QwCQYDVR0TBAIwADANBgkqhkiG9w0BAQsFAAOCAQEATFNj
WkTBPfgflGYZD4OsYvfT/rVjFKbJP/u1a0rkzNamA2QKNzI9JTOzONPTyRhe9yVS
zeO8X2rtN63l38dtgMjFQ15Xxnp7GFT7GkXfa1JR+tGSGTgVld8nLUzig+mNmBoR
nE4cNc0JJ1PsXPzfPgJ6WMp2WOoNUrQf2cm42i36Jk+7KGcosfyFMPQILZE34Geo
DAgCVpNWPgST4HYBUCHMC7S14LHLVdUXPsfGZPEqU5Zf9Hvy61rQC/RdNjnMI6JD
s57l9oHASNeEg55NQm01aOmwq/z1DXs3UP2nRmp6XCCfE61ghofO5dtV1j3cZ3f5
dzkzSBV7H6+/MD3Y8Q==</ds:X509Certificate>
<ds:X509Certificate>MIIDYjCCAkqgAwIBAgIUZ2p8K7GMXGk6xwCS9S91BUl1JnAwDQYJKoZIhvcNAQEL
BQAwNDEyMDAGA1UEAxMpRWxhc3RpYyBDZXJ0aWZpY2F0ZSBUb29sIEF1dG9nZW5l
cmF0ZWQgQ0EwIBcNMjMwOTIzMTUyMDE0WhgPMjA3MzA5MTAxNTIwMTRaMBExDzAN
BgNVBAMTBmtpYmFuYTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMOU
r52dbZ5dY0BoP2p7CEnOpG+qHTNrOAqZO/OJfniPMtpGmwAMl3WZDca6u2XkV2KE
qQyevQ2ADk6G3o8S2RU8mO/+UweuCDF7LHuSdxEGTpucidZErmVhEGUOFosL5UeB
AtIDWxvWwgK+W9Yzt5IEN2HzNCZ6h0dOSk2r9EjVMG5yF4Q6kuqOYxBT7jxoaOtO
OCrgBRummtUga4T13WZ/ZIyyHpXj2+JD4YEmrDyoTa7NLaphv0hnVhHXYoYBI/c6
2SwwAoBlmtDmlinwSACQ3o/8eLWk0tqkIP14rc3oFh3m7D2c3c2m2HXuyoSDMfGW
beG2IE1Q3idcGmeG3qsCAwEAAaOBjDCBiTAdBgNVHQ4EFgQUMOUM7w5jmIozDvnq
RpM779m5GigwHwYDVR0jBBgwFoAUMEwqwI5b0MYpNxwaHJ9Tw1Lp3p4wPAYDVR0R
BDUwM4IUaG9zdC5kb2NrZXIuaW50ZXJuYWyCCWxvY2FsaG9zdIIEZXMwM4IEZXMw
MoIEZXMwMTAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQCxqvQYXSKqgpdl
SP4gXgwipAnYsoW9qkgWQODTvSBEzUdOWme0d3j7i2l6Ur/nVSv5YjkqAv1hf/yJ
Hrk9h+j29ZO/aQ/KDh5i/gTEUnPw3Bxbw47dfn23tjMWO7NCU1fr5HNztRsa/gQr
e9s07g25u/gTfTi9Fyu0lcRe3bXOLS/mFVcuC5oxuS65R9OlbIsiORkZ2EfwuNUf
wAAYOGPIjM2VlQCvBitefsd/SzRKHdxSPy6KSjkO6MGEGo87fr7B7Nx1qp1DVrK7
q9XeP1Cuygjg9WTcnsvWvNw8CssyuFM6X/3tGjpPasXwLvNUoG2AairK2AYTWhvS
foE31cFg</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>

1
x-pack/test/tsconfig.json
View file

@ -144,5 +144,6 @@
"@kbn/coloring",
"@kbn/profiling-utils",
"@kbn/profiling-data-access-plugin",
"@kbn/es",
]
}