Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Stricter validation for required checkin API attributes #3233

Merged
merged 4 commits into from
Jan 23, 2024

Conversation

michel-laterman
Copy link
Contributor

What is the problem this PR solves?

Checkin endpoint does not check for required attributes

How does this PR solve the problem?

Add validation to make sure that status and message are present in the checkin request body.

Design Checklist

  • I have ensured my design is stateless and will work when multiple fleet-server instances are behind a load balancer.
  • I have or intend to scale test my changes, ensuring it will work reliably with 100K+ agents connected.
  • I have included fail safe mechanisms to limit the load on fleet-server: rate limiting, circuit breakers, caching, load shedding, etc.

Checklist

  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in ./changelog/fragments using the changelog tool

Related issues

@michel-laterman michel-laterman added bug Something isn't working Team:Fleet Label for the Fleet team labels Jan 22, 2024
@michel-laterman michel-laterman requested a review from a team as a code owner January 22, 2024 22:58
Copy link
Member

@nchaulet nchaulet left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🚀 agents were always sending those attributes correct?

}
if len(req.Message) == 0 {
return val, fmt.Errorf("checkin message missing")
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On what cases these fields were empty? Is it possible that we are breaking checkin in some case?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@cmacknz, would the agent ever try to check in with an empty message?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It shouldn't, but if there were a bug that caused this, would it be better to accept the checkin instead of marking the agent offline and updating the component information?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've changed this to log a warning instead

@michel-laterman michel-laterman enabled auto-merge (squash) January 23, 2024 17:07
@michel-laterman
Copy link
Contributor Author

buildkite test this

Copy link

Quality Gate passed Quality Gate passed

The SonarQube Quality Gate passed, but some issues were introduced.

1 New issue
0 Security Hotspots
50.0% 50.0% Coverage on New Code
0.0% 0.0% Duplication on New Code

See analysis details on SonarQube

@michel-laterman michel-laterman merged commit 8ac12db into elastic:main Jan 23, 2024
8 checks passed
@michel-laterman michel-laterman deleted the checkin-api-strict branch January 23, 2024 18:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working Team:Fleet Label for the Fleet team
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Improve request validation on checkin API
4 participants