Skip to content

Enhancement/4811 fips to fips upgrade#7312

Merged
kaanyalti merged 11 commits intoelastic:mainfrom
kaanyalti:enhancement/4811_fips_to_fips_upgrade
Mar 14, 2025
Merged

Enhancement/4811 fips to fips upgrade#7312
kaanyalti merged 11 commits intoelastic:mainfrom
kaanyalti:enhancement/4811_fips_to_fips_upgrade

Conversation

@kaanyalti
Copy link

@kaanyalti kaanyalti commented Mar 11, 2025 •
edited
Loading

  • Enhancement

What does this PR do?

Updates the upgrade process to prevent fips to non-fips upgrades

Why is it important?

upgrading to non-fips agent is not going to be supported

Checklist

  • I have read and understood the pull request guidelines of this project.
  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • [ ] I have made corresponding changes to the documentation
  • [ ] I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in ./changelog/fragments using the changelog tool
  • [ ] I have added an integration test or an E2E test

How to test this PR locally

Related issues
@mergify
Copy link
Contributor

mergify bot commented Mar 11, 2025

This pull request does not have a backport label. Could you fix it @kaanyalti? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

  • backport-./d./d is the label that automatically backports to the 8./d branch. /d is the digit
  • backport-active-all is the label that automatically backports to all active branches.
  • backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
  • backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.
@jlind23 jlind23 added backport-8.x Automated backport to the 8.x branch with mergify backport-9.0 Automated backport to the 9.0 branch labels Mar 11, 2025
@kaanyalti kaanyalti force-pushed the enhancement/4811_fips_to_fips_upgrade branch from d07a634 to 01f3068 Compare March 13, 2025 18:23
@kaanyalti kaanyalti marked this pull request as ready for review March 14, 2025 05:29
@kaanyalti kaanyalti requested a review from a team as a code owner March 14, 2025 05:29
@kaanyalti kaanyalti requested review from pchila and swiatekm March 14, 2025 05:29
@elastic-sonarqube
Copy link

elastic-sonarqube bot commented Mar 14, 2025

Quality Gate passed Quality Gate passed

Issues
1 New issue
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
72.2% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube
@elasticmachine
Copy link
Contributor

elasticmachine commented Mar 14, 2025

💛 Build succeeded, but was flaky

Failed CI Steps

History

cc @kaanyalti
@pierrehilbert pierrehilbert added the Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team label Mar 14, 2025
@elasticmachine
Copy link
Contributor

elasticmachine commented Mar 14, 2025

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)
pchila
pchila approved these changes Mar 14, 2025
View reviewed changes
Copy link
Member

@pchila pchila left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@kaanyalti kaanyalti merged commit 5b45c94 into elastic:main Mar 14, 2025
13 checks passed
@kaanyalti kaanyalti deleted the enhancement/4811_fips_to_fips_upgrade branch March 14, 2025 14:31
mergify bot pushed a commit that referenced this pull request Mar 14, 2025
@pierrehilbert @mergify
Enhancement/4811 fips to fips upgrade (#7312)
450acc3 
* Fix typo in error message

* enhancement(4811): added fips in the package manifest

* enhancement(4811): prelimenary commit to prepare for implementation

* enhancement(4811): added fips to fips check for upgrades

* enhancement(4811): update fips check

* enhancment(4811): refactored upgrade version checks

* enhancement(4811): added tests for checkUpgrade

* enhancement(4811): added fips test case for sameReleaseVersion function

* enhancement(4811): added changelog

* enhancement(4811): remove unnecessary comment

* enhancement(4811): remove comment

---------

Co-authored-by: Pierre HILBERT <pierre.hilbert@elastic.co>
(cherry picked from commit 5b45c94)
@mergify mergify bot mentioned this pull request Mar 14, 2025
Merged
5 tasks
mergify bot pushed a commit that referenced this pull request Mar 14, 2025
@pierrehilbert @mergify
Enhancement/4811 fips to fips upgrade (#7312)
0a1c646 
* Fix typo in error message

* enhancement(4811): added fips in the package manifest

* enhancement(4811): prelimenary commit to prepare for implementation

* enhancement(4811): added fips to fips check for upgrades

* enhancement(4811): update fips check

* enhancment(4811): refactored upgrade version checks

* enhancement(4811): added tests for checkUpgrade

* enhancement(4811): added fips test case for sameReleaseVersion function

* enhancement(4811): added changelog

* enhancement(4811): remove unnecessary comment

* enhancement(4811): remove comment

---------

Co-authored-by: Pierre HILBERT <pierre.hilbert@elastic.co>
(cherry picked from commit 5b45c94)
@mergify mergify bot mentioned this pull request Mar 14, 2025
Merged
5 tasks
simitt
simitt reviewed Mar 17, 2025
View reviewed changes
internal/pkg/agent/application/upgrade/upgrade.go
var (
ErrWatcherNotStarted = errors.New("watcher did not start in time")
ErrUpgradeSameVersion = errors.New("upgrade did not occur because it is the same version")
ErrFipsNotUpgradedToFips = errors.New("cannot upgrade from a fips compliant agent to a non-compliant one")
Copy link
Contributor

@simitt simitt Mar 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The wording of the error should cover both cases:
(1) fips -> non-fips
(2) non-fips -> fips

In checkUpgrade it actually fails for both cases, but the error that will be logged would be confusing if someone tries to upgrade from non-fips to fips.

Also, we should be careful with wording and avoid fips compliant. I would suggest using a more neutral language, something along the lines of cannot switch fips mode when upgrading.
Copy link
Author

@kaanyalti kaanyalti Mar 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll create a PR to update the wording here
kaanyalti pushed a commit that referenced this pull request Mar 17, 2025
@pierrehilbert
Enhancement/4811 fips to fips upgrade (#7312)
878f808 
* Fix typo in error message

* enhancement(4811): added fips in the package manifest

* enhancement(4811): prelimenary commit to prepare for implementation

* enhancement(4811): added fips to fips check for upgrades

* enhancement(4811): update fips check

* enhancment(4811): refactored upgrade version checks

* enhancement(4811): added tests for checkUpgrade

* enhancement(4811): added fips test case for sameReleaseVersion function

* enhancement(4811): added changelog

* enhancement(4811): remove unnecessary comment

* enhancement(4811): remove comment

---------

Co-authored-by: Pierre HILBERT <pierre.hilbert@elastic.co>
(cherry picked from commit 5b45c94)
kaanyalti pushed a commit that referenced this pull request Mar 17, 2025
@pierrehilbert
Enhancement/4811 fips to fips upgrade (#7312)
d7ba1ab 
* Fix typo in error message

* enhancement(4811): added fips in the package manifest

* enhancement(4811): prelimenary commit to prepare for implementation

* enhancement(4811): added fips to fips check for upgrades

* enhancement(4811): update fips check

* enhancment(4811): refactored upgrade version checks

* enhancement(4811): added tests for checkUpgrade

* enhancement(4811): added fips test case for sameReleaseVersion function

* enhancement(4811): added changelog

* enhancement(4811): remove unnecessary comment

* enhancement(4811): remove comment

---------

Co-authored-by: Pierre HILBERT <pierre.hilbert@elastic.co>
(cherry picked from commit 5b45c94)
kaanyalti pushed a commit that referenced this pull request Mar 17, 2025
@mergify
Enhancement/4811 fips to fips upgrade (#7312) (#7423)
dfd7d70 
* Fix typo in error message

* enhancement(4811): added fips in the package manifest

* enhancement(4811): prelimenary commit to prepare for implementation

* enhancement(4811): added fips to fips check for upgrades

* enhancement(4811): update fips check

* enhancment(4811): refactored upgrade version checks

* enhancement(4811): added tests for checkUpgrade

* enhancement(4811): added fips test case for sameReleaseVersion function

* enhancement(4811): added changelog

* enhancement(4811): remove unnecessary comment

* enhancement(4811): remove comment

---------

Co-authored-by: Pierre HILBERT <pierre.hilbert@elastic.co>
(cherry picked from commit 5b45c94)

Co-authored-by: Kaan Yalti <kaan.yalti@elastic.co>
kaanyalti pushed a commit that referenced this pull request Mar 17, 2025
@mergify
Enhancement/4811 fips to fips upgrade (#7312) (#7424)
a0079b6 
* Fix typo in error message

* enhancement(4811): added fips in the package manifest

* enhancement(4811): prelimenary commit to prepare for implementation

* enhancement(4811): added fips to fips check for upgrades

* enhancement(4811): update fips check

* enhancment(4811): refactored upgrade version checks

* enhancement(4811): added tests for checkUpgrade

* enhancement(4811): added fips test case for sameReleaseVersion function

* enhancement(4811): added changelog

* enhancement(4811): remove unnecessary comment

* enhancement(4811): remove comment

---------

Co-authored-by: Pierre HILBERT <pierre.hilbert@elastic.co>
(cherry picked from commit 5b45c94)

Co-authored-by: Kaan Yalti <kaan.yalti@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport-8.x Automated backport to the 8.x branch with mergify backport-9.0 Automated backport to the 9.0 branch Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team

7 participants

@kaanyalti @elasticmachine @simitt @swiatekm @pchila @pierrehilbert @jlind23