Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution] remove metadata integ test explicit timeouts #125742

Merged

Conversation

joeypoon
Copy link
Member

Summary

Replace explicit timeouts from endpoint metadata integration tests with waitFors as mentioned in #125675 (comment).

For maintainers

@joeypoon joeypoon added release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution auto-backport Deprecated - use backport:version if exact versions are needed v8.2.0 labels Feb 16, 2022
@joeypoon
Copy link
Member Author


describe('test metadata apis', () => {
before(async () => {
await endpointTestResources.setMetadataTransformFrequency('1s');
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ideally we'd set the united transform to 1s as well but as of 8.0.0, we get 403s when trying to edit the united transform. likely related to fleet permission changes since it utilizes the fleet-agents index.

await Promise.all([
bulkIndex(getService, AGENTS_INDEX, generateAgentDocs(currentTime, policyId)),
bulkIndex(getService, AGENTS_INDEX, agentDocs),
bulkIndex(getService, METADATA_DATASTREAM, generateMetadataDocs(currentTime)),
Copy link
Member Author

@joeypoon joeypoon Feb 16, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

in the future, it'd be nice to use the data generator but since we're testing field filtering in these tests and the generator doesn't support override fields yet (some fields on the generated are read only too), it's not a straight forward replace. will consider for a separate PR.

@joeypoon joeypoon marked this pull request as ready for review February 16, 2022 03:11
@joeypoon joeypoon requested review from a team as code owners February 16, 2022 03:11
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-onboarding-and-lifecycle-mgt (Team:Onboarding and Lifecycle Mgt)

Copy link
Contributor

@paul-tavares paul-tavares left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks Joey for making this change. Everytime I see setTimeout() I always start thinking about how we can use more reliable methods than just arbitruary timeout values, so this change should really make the tests much more reliable and run a little faster.

I left some comments that I would like to hear back on - but as it stands, it also looks good to merge if you like. Do you remember if the prior skipped test were done also on 8.1? You have this tagged only for 8.2, but I'm wondering if it should be backported to 8.1 as well.

body,
rest_total_hits_as_int: true,
});
await this.waitForIndex(ids, metadataCurrentIndexPattern, body, timeout);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm actually thinking maybe this needs to also be the united index. The goal of htis method (waitForEndpoints()) is to wait until we are sure data exists to be shown on the Endpoint LIst (or returned on the metadata api), so I think (correct me if I'm wrong) the United target index is the one that supports that api, right?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah, it definitely makes sense to wait for the united index. the issue I ran into here is that depending on the timing of the transform check point, it's possible that the united index doesn't get populated at all. I played around this in the test by only starting the united transform after verifying the metadata_current index was populated.

waitForEndpoints()
startTransform(UNITED_TRANSFORM)
waitForUnitedEndpoints()

I considered using a future timestamp for the metadata doc(s) + only checking for united index. while it works, it feels less reliable and similar to a timeout. what I think we can do in a follow up is update loadEndpointData to do:

stop united transform
generate + index docs
wait for metadata_current
start united transform
wait for metadata_united

I'm thinking we can also add an optional generateAndIndexDocs param for custom data so we can handle situations like the integration tests in this PR.

}
: {
query: {
match_all: {},
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wondering: in this case, maybe in order to speed the search up, we should limit the result to 1 only? we're just trying to ensure data exists right? (maybe do that change above too on line 197).

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

that makes sense

// We ignore 404's (index might not exist)
if (error instanceof errors.ResponseError && error.statusCode === 404) {
return false;
async waitForUnitedEndpoints(ids: string[] = [], timeout = this.config.get('timeouts.waitFor')) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If my comment above makes sense to you (about actualyl checking the united index rather than the other one), then maybe we don't need this method?

If you do keep it, please add JSDOCs that describe what this method does nad how its different from the one above.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

put a long winded response above but I definitely forgot to update the comments. will do that.

@@ -137,13 +139,45 @@ export class EndpointTestResources extends FtrService {
return deleteIndexedHostsAndAlerts(this.esClient as Client, this.kbnClient, indexedData);
}

private async waitForIndex(
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice. this is a good generic method that can be used to check for data in any index

@paul-tavares
Copy link
Contributor

@joeypoon

from: #125127 (comment)

I'm wondering if when we call the "setMetadataTransformFrequency()` we actually should apply the new frequency across all of our transforms and not just one.

cc/ @kevinlog

@joeypoon
Copy link
Member Author

joeypoon commented Feb 16, 2022

@joeypoon

from: #125127 (comment)

I'm wondering if when we call the "setMetadataTransformFrequency()` we actually should apply the new frequency across all of our transforms and not just one.

cc/ @kevinlog

for sure. I left a comment way above so it's a bit buried but in 8.0.0 there's some fleet permission issues that prevent updating the united transform which is why I wasn't able to also change the united transform frequency.

also just wrapped up transform frequency performance testing so we might just end up dropping both frequencies down to 1s.

@joeypoon joeypoon force-pushed the chore/remove-metadata-int-test-timeouts branch from a0f069d to 32a0dc2 Compare February 16, 2022 16:35
@kibana-ci
Copy link
Collaborator

💛 Build succeeded, but was flaky

Test Failures

  • [job] [logs] Default CI Group #1 / Execution context Browser apps dashboard app propagates context for Vertical bar visualization

Metrics [docs]

✅ unchanged

History

  • 💛 Build #24491 was flaky a0f069dfe007fda56931a704dfaa19cd3a9d8bc7

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@joeypoon joeypoon merged commit ecefde8 into elastic:main Feb 16, 2022
@joeypoon joeypoon deleted the chore/remove-metadata-int-test-timeouts branch February 16, 2022 20:48
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Feb 16, 2022
@kibanamachine
Copy link
Contributor

💚 All backports created successfully

Status Branch Result
8.1

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Feb 16, 2022
…5742) (#125871)

(cherry picked from commit ecefde8)

Co-authored-by: Joey F. Poon <joey.poon@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
auto-backport Deprecated - use backport:version if exact versions are needed release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v8.1.0 v8.2.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants