Skip to content

Commit fc8ebb6

Browse files
danhermanndanhermann
authored
Remove deprecated AUTH_PASSWORD setting (#54892)
1 parent b8ccf79 commit fc8ebb6

File tree

8 files changed

+29
-115
lines changed

8 files changed

+29
-115
lines changed

‎docs/reference/migration/migrate_8_0/settings.asciidoc‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,14 @@ In Elasticsearch 7.8.0, the setting `node.local_storage` was deprecated and
5252
beginning in Elasticsearch 8.0.0 all nodes will require local storage. Therefore,
5353
the `node.local_storage` setting has been removed.
5454

55+
[float]
56+
==== `auth.password` for HTTP monitoring is removed
57+
58+
In Elasticsearch 7.7.0, the setting `xpack.monitoring.exporters.<exporterName>.auth.password`
59+
was deprecated in favor of setting `xpack.monitoring.exporters.<exporterName>.auth.secure_password`.
60+
In Elasticsearch 8.0.0, the setting `xpack.monitoring.exporters.<exporterName>.auth.password` is
61+
removed.
62+
5563
[float]
5664
==== Option to disable basic license features is deprecated
5765

‎docs/reference/monitoring/collecting-monitoring-data.asciidoc‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ Alternatively, use the
143143
<<built-in-users,`remote_monitoring_user` built-in user>>.
144144

145145
... Add the user ID and password settings to the HTTP exporter settings in the
146-
`elasticsearch.yml` file on each node. +
146+
`elasticsearch.yml` file and keystore on each node. +
147147
+
148148
--
149149
For example:
@@ -155,7 +155,7 @@ xpack.monitoring.exporters:
155155
type: http
156156
host: ["http://es-mon-1:9200", "http://es-mon2:9200"]
157157
auth.username: remote_monitoring_user
158-
auth.password: YOUR_PASSWORD
158+
# "xpack.monitoring.exporters.id1.auth.secure_password" must be set in the keystore
159159
--------------------------------------------------
160160
--
161161

@@ -177,7 +177,7 @@ xpack.monitoring.exporters:
177177
host: ["https://es-mon1:9200", "https://es-mon2:9200"]
178178
auth:
179179
username: remote_monitoring_user
180-
password: YOUR_PASSWORD
180+
# "xpack.monitoring.exporters.id1.auth.secure_password" must be set in the keystore
181181
ssl:
182182
certificate_authorities: [ "/path/to/ca.crt" ]
183183
--------------------------------------------------
@@ -195,7 +195,7 @@ xpack.monitoring.exporters:
195195
host: ["https://es-mon1:9200", "https://es-mon2:9200"]
196196
auth:
197197
username: remote_monitoring_user
198-
password: YOUR_PASSWORD
198+
# "xpack.monitoring.exporters.id1.auth.secure_password" must be set in the keystore
199199
ssl:
200200
truststore.path: /path/to/file
201201
truststore.password: password

‎docs/reference/monitoring/http-export.asciidoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ xpack.monitoring.exporters:
4242
host: [ "10.1.2.3:9200", ... ] <3>
4343
auth: <4>
4444
username: my_username
45-
password: changeme
45+
# "xpack.monitoring.exporters.my_remote.auth.secure_password" must be set in the keystore
4646
connection:
4747
timeout: 6s
4848
read_timeout: 60s

‎docs/reference/settings/monitoring-settings.asciidoc‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -197,17 +197,11 @@ xpack.monitoring.exporters:
197197

198198
`auth.username`::
199199

200-
The username is required if `auth.secure_password` or `auth.password` is supplied.
200+
The username is required if `auth.secure_password` is supplied.
201201

202202
`auth.secure_password` (<<secure-settings,Secure>>, <<reloadable-secure-settings,reloadable>>)::
203203

204-
The password for the `auth.username`. Takes precedence over `auth.password` if it is also specified.
205-
206-
`auth.password`::
207-
208-
The password for the `auth.username`. If `auth.secure_password` is also specified, this setting is ignored.
209-
210-
deprecated[7.7.0, Use `auth.secure_password` instead.]
204+
The password for the `auth.username`.
211205

212206
`connection.timeout`::
213207

‎x-pack/plugin/monitoring/src/main/java/org/elasticsearch/xpack/monitoring/exporter/http/HttpExporter.java‎

Lines changed: 4 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -210,19 +210,13 @@ public void validate(final String username, final Map<Setting<?>, Object> settin
210210
HttpExporter.AUTH_USERNAME_SETTING.getNamespace(
211211
HttpExporter.AUTH_USERNAME_SETTING.getConcreteSetting(key));
212212

213-
// password must be specified along with username for any auth
214213
if (Strings.isNullOrEmpty(username) == false) {
215214
final String type =
216215
(String) settings.get(Exporter.TYPE_SETTING.getConcreteSettingForNamespace(namespace));
217216
if ("http".equals(type) == false) {
218217
throw new SettingsException("username for [" + key + "] is set but type is [" + type + "]");
219218
}
220219
}
221-
222-
// it would be ideal to validate that just one of either AUTH_PASSWORD_SETTING or
223-
// AUTH_SECURE_PASSWORD_SETTING were present here, but that is not currently possible with the settings
224-
// validation framework.
225-
// https://github.com/elastic/elasticsearch/issues/51332
226220
}
227221

228222
@Override
@@ -241,52 +235,6 @@ public Iterator<Setting<?>> settings() {
241235
Property.NodeScope,
242236
Property.Filtered),
243237
TYPE_DEPENDENCY);
244-
/**
245-
* Password for basic auth.
246-
*/
247-
public static final Setting.AffixSetting<String> AUTH_PASSWORD_SETTING =
248-
Setting.affixKeySetting("xpack.monitoring.exporters.","auth.password",
249-
(key) -> Setting.simpleString(key,
250-
new Setting.Validator<String>() {
251-
@Override
252-
public void validate(String password) {
253-
// no password validation that is independent of other settings
254-
}
255-
256-
@Override
257-
public void validate(String password, Map<Setting<?>, Object> settings) {
258-
final String namespace =
259-
HttpExporter.AUTH_PASSWORD_SETTING.getNamespace(
260-
HttpExporter.AUTH_PASSWORD_SETTING.getConcreteSetting(key));
261-
final String username =
262-
(String) settings.get(AUTH_USERNAME_SETTING.getConcreteSettingForNamespace(namespace));
263-
264-
// username is required for any auth
265-
if (Strings.isNullOrEmpty(username)) {
266-
if (Strings.isNullOrEmpty(password) == false) {
267-
throw new IllegalArgumentException(
268-
"[" + AUTH_PASSWORD_SETTING.getConcreteSettingForNamespace(namespace).getKey() + "] without [" +
269-
AUTH_USERNAME_SETTING.getConcreteSettingForNamespace(namespace).getKey() + "]");
270-
}
271-
}
272-
}
273-
274-
@Override
275-
public Iterator<Setting<?>> settings() {
276-
final String namespace =
277-
HttpExporter.AUTH_PASSWORD_SETTING.getNamespace(
278-
HttpExporter.AUTH_PASSWORD_SETTING.getConcreteSetting(key));
279-
final List<Setting<?>> settings = List.of(
280-
HttpExporter.AUTH_USERNAME_SETTING.getConcreteSettingForNamespace(namespace));
281-
return settings.iterator();
282-
}
283-
284-
},
285-
Property.Dynamic,
286-
Property.NodeScope,
287-
Property.Filtered,
288-
Property.Deprecated),
289-
TYPE_DEPENDENCY);
290238
/**
291239
* Secure password for basic auth.
292240
*/
@@ -757,18 +705,8 @@ public static List<String> loadSettings(Settings settings) {
757705
private static CredentialsProvider createCredentialsProvider(final Config config) {
758706
final String username = AUTH_USERNAME_SETTING.getConcreteSettingForNamespace(config.name()).get(config.settings());
759707

760-
final String deprecatedPassword = AUTH_PASSWORD_SETTING.getConcreteSettingForNamespace(config.name()).get(config.settings());
761708
final SecureString securePassword = SECURE_AUTH_PASSWORDS.get(config.name());
762-
final String password;
763-
if (securePassword != null) {
764-
password = securePassword.toString();
765-
if (Strings.isNullOrEmpty(deprecatedPassword) == false) {
766-
logger.warn("exporter [{}] specified both auth.secure_password and auth.password. using auth.secure_password and " +
767-
"ignoring auth.password", config.name());
768-
}
769-
} else {
770-
password = deprecatedPassword;
771-
}
709+
final String password = securePassword != null ? securePassword.toString() : null;
772710

773711
final CredentialsProvider credentialsProvider = new BasicCredentialsProvider();
774712
credentialsProvider.setCredentials(AuthScope.ANY, new UsernamePasswordCredentials(username, password));
@@ -934,9 +872,9 @@ public void doClose() {
934872
}
935873

936874
public static List<Setting.AffixSetting<?>> getDynamicSettings() {
937-
return Arrays.asList(HOST_SETTING, TEMPLATE_CREATE_LEGACY_VERSIONS_SETTING, AUTH_PASSWORD_SETTING, AUTH_USERNAME_SETTING,
938-
BULK_TIMEOUT_SETTING, CONNECTION_READ_TIMEOUT_SETTING, CONNECTION_TIMEOUT_SETTING, PIPELINE_CHECK_TIMEOUT_SETTING,
939-
PROXY_BASE_PATH_SETTING, SNIFF_ENABLED_SETTING, TEMPLATE_CHECK_TIMEOUT_SETTING, SSL_SETTING, HEADERS_SETTING);
875+
return Arrays.asList(HOST_SETTING, TEMPLATE_CREATE_LEGACY_VERSIONS_SETTING, AUTH_USERNAME_SETTING, BULK_TIMEOUT_SETTING,
876+
CONNECTION_READ_TIMEOUT_SETTING, CONNECTION_TIMEOUT_SETTING, PIPELINE_CHECK_TIMEOUT_SETTING, PROXY_BASE_PATH_SETTING,
877+
SNIFF_ENABLED_SETTING, TEMPLATE_CHECK_TIMEOUT_SETTING, SSL_SETTING, HEADERS_SETTING);
940878
}
941879

942880
public static List<Setting.AffixSetting<?>> getSecureSettings() {

‎x-pack/plugin/monitoring/src/test/java/org/elasticsearch/xpack/monitoring/exporter/http/HttpExporterIT.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -174,7 +174,6 @@ public void testSecureSetting() throws Exception {
174174
final String authHeaderValue2 = Base64.encode(userName + ":" + securePassword2);
175175

176176
Settings settings = secureSettings(securePassword1)
177-
.put("xpack.monitoring.exporters._http.auth.password", "insecurePassword") // verify this password is not used
178177
.build();
179178
PluginsService pluginsService = internalCluster().getInstances(PluginsService.class).iterator().next();
180179
LocalStateMonitoring localStateMonitoring = pluginsService.filterPlugins(LocalStateMonitoring.class).iterator().next();

‎x-pack/plugin/monitoring/src/test/java/org/elasticsearch/xpack/monitoring/exporter/http/HttpExporterTests.java‎

Lines changed: 4 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -238,24 +238,6 @@ public void testExporterWithEmptyHeaders() {
238238
assertThat(exception.getMessage(), equalTo(expected));
239239
}
240240

241-
public void testExporterWithPasswordButNoUsername() {
242-
final String expected =
243-
"[xpack.monitoring.exporters._http.auth.password] without [xpack.monitoring.exporters._http.auth.username]";
244-
final String prefix = "xpack.monitoring.exporters._http";
245-
final Settings settings = Settings.builder()
246-
.put(prefix + ".type", HttpExporter.TYPE)
247-
.put(prefix + ".host", "localhost:9200")
248-
.put(prefix + ".auth.password", "_pass")
249-
.build();
250-
251-
final IllegalArgumentException e = expectThrows(
252-
IllegalArgumentException.class,
253-
() -> HttpExporter.AUTH_PASSWORD_SETTING.getConcreteSetting(prefix + ".auth.password").get(settings));
254-
assertThat(e, hasToString(containsString(expected)));
255-
assertWarnings("[xpack.monitoring.exporters._http.auth.password] setting was deprecated in Elasticsearch and will be removed " +
256-
"in a future release! See the breaking changes documentation for the next major version.");
257-
}
258-
259241
public void testExporterWithUnknownBlacklistedClusterAlerts() {
260242
final SSLIOSessionStrategy sslStrategy = mock(SSLIOSessionStrategy.class);
261243
when(sslService.sslIOSessionStrategy(any(Settings.class))).thenReturn(sslStrategy);
@@ -332,8 +314,10 @@ public void testCreateRestClient() throws IOException {
332314
// use basic auth
333315
final boolean useBasicAuth = randomBoolean();
334316
if (useBasicAuth) {
335-
builder.put("xpack.monitoring.exporters._http.auth.username", "_user")
336-
.put("xpack.monitoring.exporters._http.auth.password", "_pass");
317+
builder.put("xpack.monitoring.exporters._http.auth.username", "_user");
318+
MockSecureSettings mockSecureSettings = new MockSecureSettings();
319+
mockSecureSettings.setString("xpack.monitoring.exporters._http.auth.secure_password", "securePassword");
320+
builder.setSecureSettings(mockSecureSettings);
337321
}
338322

339323
// use headers
@@ -346,10 +330,6 @@ public void testCreateRestClient() throws IOException {
346330

347331
// doesn't explode
348332
HttpExporter.createRestClient(config, sslService, listener).close();
349-
if (useBasicAuth) {
350-
assertWarnings("[xpack.monitoring.exporters._http.auth.password] setting was deprecated in Elasticsearch and will be " +
351-
"removed in a future release! See the breaking changes documentation for the next major version.");
352-
}
353333
}
354334

355335
public void testCreateSnifferDisabledByDefault() {

‎x-pack/qa/smoke-test-plugins-ssl/src/test/java/org/elasticsearch/smoketest/SmokeTestMonitoringWithSecurityIT.java‎

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
import org.elasticsearch.cluster.health.ClusterHealthStatus;
2727
import org.elasticsearch.common.Priority;
2828
import org.elasticsearch.common.io.PathUtils;
29+
import org.elasticsearch.common.settings.MockSecureSettings;
2930
import org.elasticsearch.common.settings.SecureString;
3031
import org.elasticsearch.common.settings.Settings;
3132
import org.elasticsearch.common.util.concurrent.ThreadContext;
@@ -149,18 +150,20 @@ protected Settings restClientSettings() {
149150

150151
@Before
151152
public void enableExporter() throws Exception {
153+
MockSecureSettings secureSettings = new MockSecureSettings();
154+
secureSettings.setString("xpack.monitoring.exporters._http.auth.secure_password", "x-pack-test-password");
152155
Settings exporterSettings = Settings.builder()
153156
.put("xpack.monitoring.collection.enabled", true)
154157
.put("xpack.monitoring.exporters._http.enabled", true)
155158
.put("xpack.monitoring.exporters._http.type", "http")
156159
.put("xpack.monitoring.exporters._http.host", "https://" + randomNodeHttpAddress())
157160
.put("xpack.monitoring.exporters._http.auth.username", "monitoring_agent")
158-
.put("xpack.monitoring.exporters._http.auth.password", "x-pack-test-password")
159161
.put("xpack.monitoring.exporters._http.ssl.verification_mode", "full")
160162
.put("xpack.monitoring.exporters._http.ssl.certificate_authorities", "testnode.crt")
163+
.setSecureSettings(secureSettings)
161164
.build();
162165
ClusterUpdateSettingsResponse response = newHighLevelClient().cluster().putSettings(
163-
new ClusterUpdateSettingsRequest().transientSettings(exporterSettings), getRequestOptions());
166+
new ClusterUpdateSettingsRequest().transientSettings(exporterSettings), RequestOptions.DEFAULT);
164167
assertTrue(response.isAcknowledged());
165168
}
166169

@@ -172,22 +175,14 @@ public void disableExporter() throws IOException {
172175
.putNull("xpack.monitoring.exporters._http.type")
173176
.putNull("xpack.monitoring.exporters._http.host")
174177
.putNull("xpack.monitoring.exporters._http.auth.username")
175-
.putNull("xpack.monitoring.exporters._http.auth.password")
176178
.putNull("xpack.monitoring.exporters._http.ssl.verification_mode")
177179
.putNull("xpack.monitoring.exporters._http.ssl.certificate_authorities")
178180
.build();
179181
ClusterUpdateSettingsResponse response = newHighLevelClient().cluster().putSettings(
180-
new ClusterUpdateSettingsRequest().transientSettings(exporterSettings), getRequestOptions());
182+
new ClusterUpdateSettingsRequest().transientSettings(exporterSettings), RequestOptions.DEFAULT);
181183
assertTrue(response.isAcknowledged());
182184
}
183185

184-
private RequestOptions getRequestOptions() {
185-
String deprecationWarning = "[xpack.monitoring.exporters._http.auth.password] setting was deprecated in Elasticsearch and will " +
186-
"be removed in a future release! See the breaking changes documentation for the next major version.";
187-
return RequestOptions.DEFAULT.toBuilder().setWarningsHandler(warnings -> warnings.size() != 1 ||
188-
warnings.get(0).equals(deprecationWarning) == false).build();
189-
}
190-
191186
private boolean getMonitoringUsageExportersDefined() throws Exception {
192187
RestHighLevelClient client = newHighLevelClient();
193188
final XPackUsageResponse usageResponse = client.xpack().usage(new XPackUsageRequest(), RequestOptions.DEFAULT);

0 commit comments

Comments
 (0)