Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[CI] LicenseDLSFLSRoleIT testQueryDLSFLSRolesShowAsDisabled failing #110729

Closed
elasticsearchmachine opened this issue Jul 10, 2024 · 4 comments
Closed

[CI] LicenseDLSFLSRoleIT testQueryDLSFLSRolesShowAsDisabled failing #110729

elasticsearchmachine opened this issue Jul 10, 2024 · 4 comments
Assignees
@jfreden
Labels
low-risk An open issue or test failure that is a low risk to future releases :Security/Security Security issues without another label Team:Security Meta label for security team >test-failure Triaged test failures from CI

Comments

@elasticsearchmachine
Copy link
Collaborator

elasticsearchmachine commented Jul 10, 2024 •
edited
Loading

Build Scans:

Reproduction Line:

gradlew ':x-pack:plugin:security:qa:security-basic:javaRestTest' --tests "org.elasticsearch.xpack.security.LicenseDLSFLSRoleIT.testQueryDLSFLSRolesShowAsDisabled" -Dtests.seed=BAF736A5E425FF9D -Dtests.locale=fi -Dtests.timezone=America/Indiana/Winamac -Druntime.java=22

Applicable branches:
8.15

Reproduces locally?:
N/A

Failure History:
See dashboard

Failure Message:

java.lang.AssertionError: license not yet installed

Issue Reasons:

  • [8.15] 2 failures in test testQueryDLSFLSRolesShowAsDisabled (0.6% fail rate in 317 executions)
  • [8.15] 2 failures in pipeline elasticsearch-periodic-platform-support (18.2% fail rate in 11 executions)

Note:
This issue was created using new test triage automation. Please report issues or feedback to es-delivery.
@elasticsearchmachine elasticsearchmachine added :Security/Security Security issues without another label >test-failure Triaged test failures from CI labels Jul 10, 2024
@elasticsearchmachine
Copy link
Collaborator Author

This has been muted on branch main

Mute Reasons:

  • [main] 9 failures in test testQueryDLSFLSRolesShowAsDisabled (0.9% fail rate)
  • [main] 6 failures in step part-4 (2.0% fail rate)
  • [main] 6 failures in pipeline elasticsearch-pull-request (2.0% fail rate)
  • [main] 2.0% failure rate in step part-4 (2.0% fail rate)
  • [main] 2.0% failure rate in pipeline elasticsearch-pull-request (2.0% fail rate)

Build Scans:

elasticsearchmachine added a commit that referenced this issue Jul 10, 2024
@elasticsearchmachine
Mute org.elasticsearch.xpack.security.LicenseDLSFLSRoleIT testQueryDL…
1f82b0c 
…SFLSRolesShowAsDisabled #110729
@elasticsearchmachine
Copy link
Collaborator Author

Pinging @elastic/es-security (Team:Security)

@elasticsearchmachine elasticsearchmachine added Team:Security Meta label for security team needs:risk Requires assignment of a risk label (low, medium, blocker) labels Jul 10, 2024
@jfreden jfreden added low-risk An open issue or test failure that is a low risk to future releases and removed needs:risk Requires assignment of a risk label (low, medium, blocker) labels Jul 11, 2024
@jfreden
Copy link
Contributor

jfreden commented Jul 11, 2024

Looks like a test infrastructure issue. Sometimes the waitForLicense returns 404 for more than 10 seconds. We have other tests doing this with success so not sure why it's failing. @albertzaharovits this is the new license test suite added for query roles.

@jfreden jfreden mentioned this issue Aug 20, 2024
Merged
@jfreden jfreden self-assigned this Aug 20, 2024
elasticsearchmachine pushed a commit that referenced this issue Aug 20, 2024
@jfreden
Fix query roles test by setting license synchronously (#112002)
47d3316 
Relates: #110729

The `testQueryDLSFLSRolesShowAsDisabled` failed intermittently and my
theory is that it's because applying the license of the cluster to
cluster state has `NORMAL` priority and therefore sometimes (very
rarely) takes more than 10 seconds. There are some related discussions
to this, see: #67182,
#64578

Since we're not testing the actual license lifecycle in this test, but
instead how an applied license impacts the query roles API, I changed
the approach to use the synchronous `/_license/start_trial` API in a
`@before` so we can be sure the license was applied before we start
testing. An alternative to this fix could be to increase the timeout.
@jfreden
Copy link
Contributor

jfreden commented Aug 20, 2024

Fixed in: #112002

@jfreden jfreden closed this as completed Aug 20, 2024
lkts pushed a commit to lkts/elasticsearch that referenced this issue Aug 20, 2024
@jfreden @lkts
Fix query roles test by setting license synchronously (elastic#112002)
dfc20cd 
Relates: elastic#110729

The `testQueryDLSFLSRolesShowAsDisabled` failed intermittently and my
theory is that it's because applying the license of the cluster to
cluster state has `NORMAL` priority and therefore sometimes (very
rarely) takes more than 10 seconds. There are some related discussions
to this, see: elastic#67182,
elastic#64578

Since we're not testing the actual license lifecycle in this test, but
instead how an applied license impacts the query roles API, I changed
the approach to use the synchronous `/_license/start_trial` API in a
`@before` so we can be sure the license was applied before we start
testing. An alternative to this fix could be to increase the timeout.
cbuescher pushed a commit to cbuescher/elasticsearch that referenced this issue Sep 4, 2024
@jfreden @cbuescher
Fix query roles test by setting license synchronously (elastic#112002)
d837246 
Relates: elastic#110729

The `testQueryDLSFLSRolesShowAsDisabled` failed intermittently and my
theory is that it's because applying the license of the cluster to
cluster state has `NORMAL` priority and therefore sometimes (very
rarely) takes more than 10 seconds. There are some related discussions
to this, see: elastic#67182,
elastic#64578

Since we're not testing the actual license lifecycle in this test, but
instead how an applied license impacts the query roles API, I changed
the approach to use the synchronous `/_license/start_trial` API in a
`@before` so we can be sure the license was applied before we start
testing. An alternative to this fix could be to increase the timeout.
davidkyle pushed a commit to davidkyle/elasticsearch that referenced this issue Sep 5, 2024
@jfreden @davidkyle
Fix query roles test by setting license synchronously (elastic#112002)
8c4e582 
Relates: elastic#110729

The `testQueryDLSFLSRolesShowAsDisabled` failed intermittently and my
theory is that it's because applying the license of the cluster to
cluster state has `NORMAL` priority and therefore sometimes (very
rarely) takes more than 10 seconds. There are some related discussions
to this, see: elastic#67182,
elastic#64578

Since we're not testing the actual license lifecycle in this test, but
instead how an applied license impacts the query roles API, I changed
the approach to use the synchronous `/_license/start_trial` API in a
`@before` so we can be sure the license was applied before we start
testing. An alternative to this fix could be to increase the timeout.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jfreden jfreden

Labels
low-risk An open issue or test failure that is a low risk to future releases :Security/Security Security issues without another label Team:Security Meta label for security team >test-failure Triaged test failures from CI
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@elasticsearchmachine @jfreden