-
Notifications
You must be signed in to change notification settings - Fork 83
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[8.x](backport #4361) Change CA generation in tests to avoid using SHA1 #4399
Conversation
(cherry picked from commit 8909668)
buildkite test this |
buildkite test this |
This pull request has not been merged yet. Could you please review and merge it @michel-laterman? 🙏 |
buildkite test this |
Current e2e failure is because the fleet-server & ES versions do not match: |
@michel-laterman how is this going to be fixed? |
I think #4371 needs to update the stack to the newer version |
This pull request has not been merged yet. Could you please review and merge it @michel-laterman? 🙏 |
|
What is the problem this PR solves?
Tests ran with
GODEBUG=fips140=only
will panic due to CA SubjectKeyId generation using SHA1 by default.How does this PR solve the problem?
Populate SubjectKeyId with value generated by other algorithm; copied implementation from elastic/elastic-agent-libs#263
How to test this PR locally
GODEBUG=fips140=only gotip test ./...
Design Checklist
I have ensured my design is stateless and will work when multiple fleet-server instances are behind a load balancer.I have or intend to scale test my changes, ensuring it will work reliably with 100K+ agents connected.I have included fail safe mechanisms to limit the load on fleet-server: rate limiting, circuit breakers, caching, load shedding, etc.Checklist
I have commented my code, particularly in hard-to-understand areasI have made corresponding changes to the documentationI have made corresponding change to the default configuration filesI have added tests that prove my fix is effective or that my feature worksI have added an entry in./changelog/fragments
using the changelog toolThis is an automatic backport of pull request Change CA generation in tests to avoid using SHA1 #4361 done by Mergify.