Skip to content

Remove serverless credentials reset #2307

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

Conversation

jsoriano
Copy link
Member

@jsoriano jsoriano commented Dec 30, 2024

We are using the internal _reset-internal-credentials API to obtain the credentials used for serverless stacks managed by elastic-package. But this API is only available to elastic employees.

There were two reasons to obtain credentials this way:

  • Some APIs were restricted in serverless to credentials obtained this way. From these internal APIs, the only one we use now is the one to check the cluster status (_cluster/health). In this case, if normal credentials are used, it returns HTTP status 410 (Gone) if the cluster is alive and the credentials are valid, I think we can consider this as an OK for this case. This will be also needed in any case for API keys support, because API keys don't have access to these internal APIs.
  • At some point during development the project creation API didn't return credentials with enough permissions, so we needed to request them using the reset credentials APIs. We are in GA now, and the project creation API returns user and password with admin privileges, what is enough for all elastic-package operations.

As these reasons are not strong enough now, I think it would be better if we just avoid these resets.

Relates to #1633, where it was observed that we need to make elastic-package work with non-internal credentials.

@jsoriano jsoriano requested a review from a team December 30, 2024 17:34
@jsoriano jsoriano self-assigned this Dec 30, 2024
trailer: {}
content_length: 363
uncompressed: false
body: '{"error":{"root_cause":[{"type":"api_not_available_exception","reason":"Request for uri [/_cluster/health] with method [GET] exists but is not available when running in serverless mode"}],"type":"api_not_available_exception","reason":"Request for uri [/_cluster/health] with method [GET] exists but is not available when running in serverless mode"},"status":410}'
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See here a response from serverless for the _cluster/health API.

@jsoriano jsoriano changed the title Remove serverless reset credentials Remove serverless credentials reset Dec 30, 2024
@elasticmachine
Copy link
Collaborator

💚 Build Succeeded

cc @jsoriano

jsoriano added a commit that referenced this pull request Jan 7, 2025
When creating new recordings for testing, tests that already have recordings fail if the host
doesn't match. This happens when recording from environments that don't use the usual
local values, as for example in the test case added for serverless in #2307. This can even
interfere with any other environment variable set by elastic-package stack shellinit.

With this change environment variables are only used to initialize the client when creating
new recording files and not in subsequent executions.
Copy link
Contributor

@mrodm mrodm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!
As you mentioned, it looks like we can rely on the 410 status to assume that the cluster is healthy 👍

@jsoriano jsoriano merged commit 395de04 into elastic:main Jan 7, 2025
3 checks passed
@jsoriano jsoriano deleted the remove-serverless-reset-credentials branch January 7, 2025 11:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants