Enabling Full FTR, Integration, and Unit tests to the FIPS Test Pipeline

.buildkite/pipelines/fips.yml

@@ -40,14 +40,15 @@ steps:
       machineType: n2-standard-2
       preemptible: true
 
-  - command: .buildkite/scripts/steps/fips/smoke_test.sh
-    label: 'Pick Smoke Test Group Run Order'
+  - command: .buildkite/scripts/steps/test/pick_test_group_run_order.sh
+    label: 'Pick Test Group Run Order'
     depends_on: build
     timeout_in_minutes: 10
     env:
       FTR_CONFIGS_SCRIPT: '.buildkite/scripts/steps/test/ftr_configs.sh'
       FTR_EXTRA_ARGS: '$FTR_EXTRA_ARGS'
-      LIMIT_CONFIG_TYPE: 'functional'
+      JEST_UNIT_SCRIPT: '.buildkite/scripts/steps/test/jest.sh'
+      JEST_INTEGRATION_SCRIPT: '.buildkite/scripts/steps/test/jest_integration.sh'
     retry:
       automatic:
         - exit_status: '*'

.buildkite/scripts/steps/test/jest_parallel.sh

@@ -60,7 +60,16 @@ while read -r config; do
   # --trace-warnings to debug
   # Node.js process-warning detected:
   # Warning: Closing file descriptor 24 on garbage collection
-  cmd="NODE_OPTIONS=\"--max-old-space-size=12288 --trace-warnings\" node ./scripts/jest --config=\"$config\" $parallelism --coverage=false --passWithNoTests"
+  cmd="NODE_OPTIONS=\"--max-old-space-size=12288 --trace-warnings"
+
+  if [ "${KBN_ENABLE_FIPS:-}" == "true" ]; then
+    cmd=$cmd" --enable-fips --openssl-config=$HOME/nodejs.cnf\""
+  else
+    cmd=$cmd"\""
+  fi
+
+  cmd=$cmd" node ./scripts/jest --config=\"$config\" $parallelism --coverage=false --passWithNoTests"
+
   echo "actual full command is:"
   echo "$cmd"
   echo ""

packages/core/security/core-security-server-internal/src/security_service.test.ts

@@ -16,93 +16,100 @@ import { loggerMock, MockedLogger } from '@kbn/logging-mocks';
 import { mockCoreContext } from '@kbn/core-base-server-mocks';
 import type { CoreSecurityDelegateContract } from '@kbn/core-security-server';
 import { SecurityService } from './security_service';
+import { getFips } from 'crypto';
 
 const createStubInternalContract = (): CoreSecurityDelegateContract => {
   return Symbol('stubContract') as unknown as CoreSecurityDelegateContract;
 };
 
-describe('SecurityService', () => {
-  let coreContext: ReturnType<typeof mockCoreContext.create>;
-  let service: SecurityService;
+describe('SecurityService', function () {
+  if (getFips() !== 1) {
+    let coreContext: ReturnType<typeof mockCoreContext.create>;
+    let service: SecurityService;
 
-  beforeEach(() => {
-    coreContext = mockCoreContext.create();
-    service = new SecurityService(coreContext);
+    beforeEach(() => {
+      coreContext = mockCoreContext.create();
+      service = new SecurityService(coreContext);
 
-    convertSecurityApiMock.mockReset();
-    getDefaultSecurityImplementationMock.mockReset();
-  });
+      convertSecurityApiMock.mockReset();
+      getDefaultSecurityImplementationMock.mockReset();
+    });
 
-  describe('#setup', () => {
-    describe('#registerSecurityDelegate', () => {
-      it('throws if called more than once', () => {
-        const { registerSecurityDelegate } = service.setup();
+    describe('#setup', () => {
+      describe('#registerSecurityDelegate', () => {
+        it('throws if called more than once', () => {
+          const { registerSecurityDelegate } = service.setup();
 
-        const contract = createStubInternalContract();
-        registerSecurityDelegate(contract);
+          const contract = createStubInternalContract();
+          registerSecurityDelegate(contract);
 
-        expect(() => registerSecurityDelegate(contract)).toThrowErrorMatchingInlineSnapshot(
-          `"security API can only be registered once"`
-        );
+          expect(() => registerSecurityDelegate(contract)).toThrowErrorMatchingInlineSnapshot(
+            `"security API can only be registered once"`
+          );
+        });
       });
-    });
 
-    describe('#fips', () => {
-      describe('#isEnabled', () => {
-        it('should return boolean', () => {
-          const { fips } = service.setup();
+      describe('#fips', () => {
+        describe('#isEnabled', () => {
+          it('should return boolean', () => {
+            const { fips } = service.setup();
 
-          expect(fips.isEnabled()).toBe(false);
+            expect(fips.isEnabled()).toBe(false);
+          });
         });
       });
     });
-  });
 
-  describe('#start', () => {
-    it('logs a warning if the security API was not registered', () => {
-      service.setup();
-      service.start();
+    describe('#start', () => {
+      it('logs a warning if the security API was not registered', () => {
+        service.setup();
+        service.start();
 
-      expect(loggerMock.collect(coreContext.logger as MockedLogger).warn).toMatchInlineSnapshot(`
+        expect(loggerMock.collect(coreContext.logger as MockedLogger).warn).toMatchInlineSnapshot(`
         Array [
           Array [
             "Security API was not registered, using default implementation",
           ],
         ]
       `);
-    });
+      });
 
-    it('calls convertSecurityApi with the registered API', () => {
-      const { registerSecurityDelegate } = service.setup();
+      it('calls convertSecurityApi with the registered API', () => {
+        const { registerSecurityDelegate } = service.setup();
 
-      const contract = createStubInternalContract();
-      registerSecurityDelegate(contract);
+        const contract = createStubInternalContract();
+        registerSecurityDelegate(contract);
 
-      service.start();
+        service.start();
 
-      expect(convertSecurityApiMock).toHaveBeenCalledTimes(1);
-      expect(convertSecurityApiMock).toHaveBeenCalledWith(contract);
-    });
+        expect(convertSecurityApiMock).toHaveBeenCalledTimes(1);
+        expect(convertSecurityApiMock).toHaveBeenCalledWith(contract);
+      });
 
-    it('calls convertSecurityApi with the default implementation when no API was registered', () => {
-      const contract = createStubInternalContract();
-      getDefaultSecurityImplementationMock.mockReturnValue(contract);
+      it('calls convertSecurityApi with the default implementation when no API was registered', () => {
+        const contract = createStubInternalContract();
+        getDefaultSecurityImplementationMock.mockReturnValue(contract);
 
-      service.setup();
-      service.start();
+        service.setup();
+        service.start();
 
-      expect(convertSecurityApiMock).toHaveBeenCalledTimes(1);
-      expect(convertSecurityApiMock).toHaveBeenCalledWith(contract);
-    });
+        expect(convertSecurityApiMock).toHaveBeenCalledTimes(1);
+        expect(convertSecurityApiMock).toHaveBeenCalledWith(contract);
+      });
 
-    it('returns the result of convertSecurityApi as contract', () => {
-      const convertedContract = { stub: true };
-      convertSecurityApiMock.mockReturnValue(convertedContract);
+      it('returns the result of convertSecurityApi as contract', () => {
+        const convertedContract = { stub: true };
+        convertSecurityApiMock.mockReturnValue(convertedContract);
 
-      service.setup();
-      const startContract = service.start();
+        service.setup();
+        const startContract = service.start();
 
-      expect(startContract).toEqual(convertedContract);
+        expect(startContract).toEqual(convertedContract);
+      });
+    });
+  } else {
+    test('fips is enabled', function () {
+      expect(getFips() === 1).toEqual(true);
     });
-  });
+  }
 });

packages/core/test-helpers/core-test-helpers-kbn-server/src/create_root.ts

@@ -12,10 +12,12 @@ import loadJsonFile from 'load-json-file';
 import { defaultsDeep } from 'lodash';
 import { BehaviorSubject } from 'rxjs';
 import supertest from 'supertest';
+import { set } from '@kbn/safer-lodash-set';
 
 import { getPackages } from '@kbn/repo-packages';
 import { ToolingLog } from '@kbn/tooling-log';
 import { REPO_ROOT } from '@kbn/repo-info';
+import { getFips } from 'crypto';
 import {
   createTestEsCluster,
   CreateTestEsClusterOptions,
@@ -75,6 +77,13 @@ export function createRootWithSettings(
     pkg.version = customKibanaVersion;
   }
 
+  let oss = true;
+  if (getFips() === 1) {
+    set(settings, 'xpack.security.experimental.fipsMode.enabled', true);
+    oss = false;
+    delete cliArgs.oss;
+  }
+
   const env = Env.createDefault(
     REPO_ROOT,
     {
@@ -84,10 +93,10 @@ export function createRootWithSettings(
         watch: false,
         basePath: false,
         runExamples: false,
-        oss: true,
         disableOptimizer: true,
         cache: true,
         dist: false,
+        oss,
         ...cliArgs,
       },
       repoPackages: getPackages(REPO_ROOT),
@@ -255,7 +264,13 @@ export function createTestServers({
   if (!adjustTimeout) {
     throw new Error('adjustTimeout is required in order to avoid flaky tests');
   }
-  const license = settings.es?.license ?? 'basic';
+  let license = settings.es?.license ?? 'basic';
+
+  if (getFips() === 1) {
+    // Set license to 'trial' if Node is running in FIPS mode
+    license = 'trial';
+  }
+
   const usersToBeAdded = settings.users ?? [];
   if (usersToBeAdded.length > 0) {
     if (license !== 'trial') {
@@ -292,6 +307,7 @@ export function createTestServers({
           hosts: es.getHostUrls(),
           username: kibanaServerTestUser.username,
           password: kibanaServerTestUser.password,
+          ...(getFips() ? kbnSettings.elasticsearch : {}),
         };
       }
 

packages/core/test-helpers/core-test-helpers-kbn-server/tsconfig.json

@@ -20,6 +20,7 @@
     "@kbn/repo-packages",
     "@kbn/es",
     "@kbn/dev-utils",
+    "@kbn/safer-lodash-set",
   ],
   "exclude": [
     "target/**/*",

packages/kbn-es/src/install/install_source.ts

@@ -84,15 +84,15 @@ async function sourceInfo(cwd: string, license: string, log: ToolingLog = defaul
   log.info('on %s at %s', chalk.bold(branch), chalk.bold(sha));
   log.info('%s locally modified file(s)', chalk.bold(status.modified.length));
 
-  const etag = crypto.createHash('md5').update(branch); // eslint-disable-line @kbn/eslint/no_unsafe_hash
+  const etag = crypto.createHash('sha256').update(branch);
   etag.update(sha);
 
   // for changed files, use last modified times in hash calculation
   status.files.forEach((file) => {
     etag.update(fs.statSync(path.join(cwd, file.path)).mtime.toString());
   });
 
-  const cwdHash = crypto.createHash('md5').update(cwd).digest('hex').substr(0, 8); // eslint-disable-line @kbn/eslint/no_unsafe_hash
+  const cwdHash = crypto.createHash('sha256').update(cwd).digest('hex').substr(0, 8);
 
   const basename = `${branch}-${task}-${cwdHash}`;
   const filename = `${basename}.${ext}`;

packages/kbn-test/src/es/test_es_cluster.ts

@@ -21,6 +21,7 @@ import type { ToolingLog } from '@kbn/tooling-log';
 import { REPO_ROOT } from '@kbn/repo-info';
 import type { ArtifactLicense } from '@kbn/es';
 import type { ServerlessOptions } from '@kbn/es/src/utils';
+import { getFips } from 'crypto';
 import { CI_PARALLEL_PROCESS_PREFIX } from '../ci_parallel_process_prefix';
 import { esTestConfig } from './es_test_config';
 
@@ -200,12 +201,15 @@ export function createTestEsCluster<
 
   const esArgs = assignArgs(defaultEsArgs, customEsArgs);
 
+  // Use 'trial' license if FIPS mode is enabled, otherwise use the provided license or default to 'basic'
+  const testLicense: ArtifactLicense = getFips() === 1 ? 'trial' : license ? license : 'basic';
+
   const config = {
     version: esVersion,
     installPath: Path.resolve(basePath, clusterName),
     sourcePath: Path.resolve(REPO_ROOT, '../elasticsearch'),
+    license: testLicense,
     password,
-    license,
     basePath,
     esArgs,
     resources: files,