Remove deprecated SSL settings and simplify SSL configuration #213

donoghuc · 2024-11-12T20:16:01Z

Get rid of the deprecated parameters and document their removal. Ensure the integration and unit tests pass and that the removals are clearly documented.

Closes #210

donoghuc · 2024-11-12T20:28:30Z

Got a failure on 7.x https://app.travis-ci.com/github/logstash-plugins/logstash-input-elasticsearch/jobs/628037127 that looked unrelated and suspiciously like a race condition. I reloaded that cell.

donoghuc · 2024-11-12T20:30:33Z

For reviewer: I found reviewing this work to be very helpful in making sense of the removals https://github.com/logstash-plugins/logstash-input-elasticsearch/pull/185/files

lib/logstash/inputs/elasticsearch.rb

robbavey

Partial review while we finalize the exact wording in docs, but let's get started with marking old settings as obsolete before removal

lib/logstash/inputs/elasticsearch.rb

donoghuc · 2024-11-14T01:05:39Z

TODO:

Review https://github.com/logstash-plugins/logstash-input-http/pull/182/files and make sure we have consistency where possible
Grep through the repo for the old settings (including docs, tests and comments) to find references to remove/update
Ensure Travis tests are running again against the new streams

donoghuc · 2024-11-14T01:11:21Z

spec/inputs/elasticsearch_spec.rb

@@ -52,6 +52,19 @@
      end
    end

+    describe 'handling obsolete settings' do


Inspired by tests in logstash-plugins/logstash-input-http#182 credit @robbavey

lib/logstash/inputs/elasticsearch.rb

robbavey · 2024-11-21T16:42:24Z

docs/index.asciidoc

@@ -608,12 +610,12 @@ option when authenticating to the Elasticsearch server. If set to an
 empty string authentication will be disabled.


-[id="plugins-{type}s-{plugin}-deprecated-options"]
-==== Elasticsearch Input deprecated configuration options
+[id="plugins-{type}s-{plugin}-removed-options"]


For the docs update, let's follow the example in logstash-plugins/logstash-output-http@2fae93e#diff-cae5619b3d18ec99c5ccd0a9f6de0c6d3f53343c64692444551a7d29da6863e7

ie, remove all inline references to deprecated settings, and add a dedicated section at the bottom, above "common options", with a link to that section just before the config table.

cc @karenzone

donoghuc · 2024-12-02T22:43:27Z

Rebased and updated documentation to match logstash-plugins/logstash-output-http#147

donoghuc · 2024-12-02T23:04:32Z

Corresponding docs PR elastic/logstash#16744 in LS

robbavey

Copy/paste error and a comment nit

docs/index.asciidoc

lib/logstash/inputs/elasticsearch.rb

robbavey · 2024-12-05T21:12:57Z

Should be good to go after a rebase

donoghuc · 2024-12-05T21:24:25Z

Pushed the rebase. I think outstanding work after merge is:

Publish 5.0.0
Confine to 4 series in LS 8.x example
Ensure changes are documented in LS

robbavey

LGTM - over to you @karenzone to check out doc changes

karenzone

Thanks for your work on this, @donoghuc. I left suggestion inline.

docs/index.asciidoc

donoghuc · 2024-12-13T17:35:46Z

Thanks @karenzone I committed your suggestion.

karenzone · 2024-12-13T18:08:22Z

@donoghuc, one more thing I noticed after I got the docs building successfully.
Looks like paragraph starting at line 633 was orphaned with removals.

Option to validate the server's certificate. Disabling this severely compromises security.
When certificate validation is disabled, this plugin implicitly trusts the machine
resolved at the given address without validating its proof-of-identity.
In this scenario, the plugin can transmit credentials to or process data from an untrustworthy
man-in-the-middle or other compromised infrastructure.
More information on the importance of certificate verification:
https://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf.

Should it be deleted as part of ssl_certificate_verification?

This commit updates SSL settings to be marked as obsolete: - Replace `ssl` with `ssl_enabled` - Replace `ca_file` with `ssl_certificate_authorities` - Replace `ssl_certificate_verification` with `ssl_verification_mode` `setup_ssl_params!` has been updated to only handle SSL inference when not explicitly configured.

donoghuc · 2024-12-13T18:25:19Z

You are right! I just deleted that and squashed all the commits to clean up before merging :)

karenzone

Please delete duplicate note. Otherwise, LGTM!

docs/index.asciidoc

CHANGELOG.md

During a rebase the latest 4 series entry was deleted. This restores it.

donoghuc commented Nov 12, 2024

View reviewed changes

lib/logstash/inputs/elasticsearch.rb Outdated Show resolved Hide resolved

donoghuc force-pushed the GH-210-remove-obsolet-ssl-settings branch from 3f3d572 to cde2f75 Compare November 12, 2024 20:41

donoghuc added breaking change status:needs-review labels Nov 12, 2024

robbavey requested changes Nov 13, 2024

View reviewed changes

lib/logstash/inputs/elasticsearch.rb Show resolved Hide resolved

donoghuc commented Nov 14, 2024

View reviewed changes

donoghuc force-pushed the GH-210-remove-obsolet-ssl-settings branch 3 times, most recently from c74627d to 6caee6d Compare November 14, 2024 17:30

robbavey reviewed Nov 14, 2024

View reviewed changes

lib/logstash/inputs/elasticsearch.rb Outdated Show resolved Hide resolved

donoghuc force-pushed the GH-210-remove-obsolet-ssl-settings branch 2 times, most recently from 57654c7 to 9b1f74c Compare November 18, 2024 17:42

robbavey reviewed Nov 21, 2024

View reviewed changes

donoghuc mentioned this pull request Nov 27, 2024

Remove deprecated SSL settings logstash-plugins/logstash-input-http#182

Merged

donoghuc force-pushed the GH-210-remove-obsolet-ssl-settings branch from 9b1f74c to c2bd0e6 Compare December 2, 2024 22:42

donoghuc requested a review from robbavey December 2, 2024 22:43

robbavey requested changes Dec 3, 2024

View reviewed changes

docs/index.asciidoc Outdated Show resolved Hide resolved

lib/logstash/inputs/elasticsearch.rb Outdated Show resolved Hide resolved

donoghuc force-pushed the GH-210-remove-obsolet-ssl-settings branch from c2bd0e6 to 876bf13 Compare December 3, 2024 17:42

donoghuc requested a review from robbavey December 3, 2024 17:43

donoghuc force-pushed the GH-210-remove-obsolet-ssl-settings branch from 876bf13 to 69c6aac Compare December 5, 2024 21:20

robbavey approved these changes Dec 5, 2024

View reviewed changes

robbavey requested a review from karenzone December 5, 2024 22:49

robbavey mentioned this pull request Dec 6, 2024

Remove deprecated SSL settings from Elasticsearch input plugin #210

Closed

6 tasks

donoghuc force-pushed the GH-210-remove-obsolet-ssl-settings branch from 69c6aac to e0ff435 Compare December 10, 2024 23:06

karenzone requested changes Dec 13, 2024

View reviewed changes

docs/index.asciidoc Outdated Show resolved Hide resolved

donoghuc force-pushed the GH-210-remove-obsolet-ssl-settings branch from 953aa8d to 3cef0e3 Compare December 13, 2024 18:24

karenzone approved these changes Dec 13, 2024

View reviewed changes

docs/index.asciidoc Show resolved Hide resolved

donoghuc commented Dec 16, 2024

View reviewed changes

CHANGELOG.md Show resolved Hide resolved

donoghuc force-pushed the GH-210-remove-obsolet-ssl-settings branch from 4135b5c to c225e46 Compare December 16, 2024 19:26

Fix accidental removal of changelog entry

cd2e2fd

During a rebase the latest 4 series entry was deleted. This restores it.

donoghuc force-pushed the GH-210-remove-obsolet-ssl-settings branch from c225e46 to cd2e2fd Compare December 16, 2024 19:36

donoghuc merged commit 56d923f into logstash-plugins:main Dec 16, 2024
2 checks passed

karenzone mentioned this pull request Dec 27, 2024

Doc: Validate SSL settings removals from Logstash plugin docs elastic/logstash#16841

Closed

15 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Remove deprecated SSL settings and simplify SSL configuration #213

Remove deprecated SSL settings and simplify SSL configuration #213

donoghuc commented Nov 12, 2024 •

edited

Loading

donoghuc commented Nov 12, 2024

donoghuc commented Nov 12, 2024

robbavey left a comment

donoghuc commented Nov 14, 2024 •

edited

Loading

donoghuc Nov 14, 2024

robbavey Nov 21, 2024

donoghuc commented Dec 2, 2024

donoghuc commented Dec 2, 2024

robbavey left a comment

robbavey commented Dec 5, 2024

donoghuc commented Dec 5, 2024 •

edited

Loading

robbavey left a comment

karenzone left a comment

donoghuc commented Dec 13, 2024

karenzone commented Dec 13, 2024

donoghuc commented Dec 13, 2024

karenzone left a comment

Remove deprecated SSL settings and simplify SSL configuration #213

Remove deprecated SSL settings and simplify SSL configuration #213

Conversation

donoghuc commented Nov 12, 2024 • edited Loading

donoghuc commented Nov 12, 2024

donoghuc commented Nov 12, 2024

robbavey left a comment

Choose a reason for hiding this comment

donoghuc commented Nov 14, 2024 • edited Loading

donoghuc Nov 14, 2024

Choose a reason for hiding this comment

robbavey Nov 21, 2024

Choose a reason for hiding this comment

donoghuc commented Dec 2, 2024

donoghuc commented Dec 2, 2024

robbavey left a comment

Choose a reason for hiding this comment

robbavey commented Dec 5, 2024

donoghuc commented Dec 5, 2024 • edited Loading

robbavey left a comment

Choose a reason for hiding this comment

karenzone left a comment

Choose a reason for hiding this comment

donoghuc commented Dec 13, 2024

karenzone commented Dec 13, 2024

donoghuc commented Dec 13, 2024

karenzone left a comment

Choose a reason for hiding this comment

donoghuc commented Nov 12, 2024 •

edited

Loading

donoghuc commented Nov 14, 2024 •

edited

Loading

donoghuc commented Dec 5, 2024 •

edited

Loading