Skip to content

Conversation

cwperks
Copy link
Member

@cwperks cwperks commented Aug 15, 2025

Description

This PR extends the sample plugin to also allow this repo to test security behavior with scheduled jobs. There is a prevalent pattern of RolesInjection used across many plugins and I think its about time that we add automated tests in this repo to verify the behavior...especially looking forward to the future of replacing roles injection.

This PR essentially copies the same setup from the job scheduler and adds it to the sample plugin in this repo. Its debatable whether the tests should be in security or in job scheduler, but I'd argue that since the tests are pertinent to security behavior of scheduled jobs that they would be appropriate to add in this repo.

Note: This PR would have a circular dependency with the job-scheduler. i.e. job scheduler depends on security for integ tests and security also depends on the job scheduler for integ tests. I think this should either be permitted or a decision should be made to sever JS' dependency on security for integ tests and rely on this repo to test Job Scheduler behavior when the security plugin is installed.

In either event, my intent here is to making our testing harness increasingly capable to have a richer suite of test cases for common patterns with how plugins integrate with security. It serves demonstration purposes, but also allows us to start writing assertions for intended behaviors inside this repo.

  • Category (Enhancement, New feature, Bug fix, Test fix, Refactoring, Maintenance, Documentation)

Test Enhancement

Issues Resolved

Would be helpful for writing tests for the fix of opensearch-project/alerting#1829

Check List

  • New functionality includes testing
  • New functionality has been documented
  • New Roles/Permissions have a corresponding security dashboards plugin PR
  • API changes companion pull request created
  • Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Craig Perkins <cwperx@amazon.com>
@cwperks
Copy link
Member Author

cwperks commented Aug 15, 2025

This is making me think more in earnest about moving the entire job scheduler plugin to the core. As we enhance the job-scheduler, one of the features proposed is a central API for updating schedule information for any job. In terms of implementation, that would necessarily mean that job scheduler needs to be able to write to any job index. I'd like to create a boundary for system indices where plugins can access their own system index, but not those of other plugins with few exceptions. Conceptually, the line I draw with Job Scheduler is that it is a "core" module which would give it those abilities that are not granted to other plugins.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant