Support phasing off SecurityManager usage in favor of Java Agent #3724

kumargu · 2025-04-11T16:27:06Z

Description

With Java agent as a replacement to security manager, we start enforcing access to UnixDomainSockets. On windows since UnixDomainSockets are used for loopback address windows builds are now starting to fail for skills and flow-framework.

Additionally for this plugin's integ test to work, it will need a new jvm args to be passed. this change also includes the JVM args included in build.gradle.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

kumargu · 2025-04-11T16:28:47Z

build.gradle

+    dependencies {
+        agent "org.opensearch:opensearch-agent-bootstrap:${opensearch_version}"
+        agent "org.opensearch:opensearch-agent:${opensearch_version}"
+        agent "net.bytebuddy:byte-buddy:1.17.5"


once this PR is green. I can try using agent "net.bytebuddy:byte-buddy:${versions.bytebuddy}"

We can send similar PR to all repos or remove after RC1.
Better solution will be implementing opensearch-project/OpenSearch#17900 in RC2.

andrross · 2025-04-11T16:32:24Z

build.gradle

+    tasks.withType(Test) {
+        dependsOn prepareAgent
+        jvmArgs += ["-javaagent:" + project.layout.buildDirectory.file("agent/opensearch-agent-${opensearch_version}.jar").get()]
+    }
+
+    task prepareAgent(type: Copy) {
+       from(configurations.agent)
+       into "$buildDir/agent"
+    }


I think this should not be nested within allprojects?

Yeah, i also think so. figuring that out.

prudhvigodithi · 2025-04-11T18:30:37Z

I have tested with this PR opensearch-project/OpenSearch#17900, just adding apply plugin: 'opensearch.java-agent' inside :opensearch-ml-plugin:yamlRestTest should solve the issue we dont have to add it across the gradle projects.

kumargu · 2025-04-11T18:34:49Z

I have tested with this PR opensearch-project/OpenSearch#17900, just adding apply plugin: 'opensearch.java-agent' inside :opensearch-ml-plugin:yamlRestTest should solve the issue we dont have to add it across the gradle projects.

that's only when opensearch-project/OpenSearch#17900 is merged?

prudhvigodithi · 2025-04-11T18:36:45Z

that's only when opensearch-project/OpenSearch#17900 is merged?

Yes Once merged, its under review hope to get the PR merged soon.
Thanks
@getsaurabh02

Signed-off-by: Gulshan <[email protected]>

codecov · 2025-04-11T21:20:58Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 79.11%. Comparing base (82da998) to head (bcc0f72).
Report is 5 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #3724      +/-   ##
============================================
- Coverage     80.32%   79.11%   -1.22%     
- Complexity     7092     7115      +23     
============================================
  Files           621      623       +2     
  Lines         30937    31578     +641     
  Branches       3494     3571      +77     
============================================
+ Hits          24851    24983     +132     
- Misses         4574     5054     +480     
- Partials       1512     1541      +29

Flag	Coverage Δ
ml-commons	`79.11% <ø> (-1.22%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

dhrubo-os · 2025-04-11T21:26:39Z

build.gradle

@@ -83,7 +83,16 @@ allprojects {
    }

    project.getExtensions().getExtraProperties().set("versions", VersionProperties.getVersions());
+}
+
+configurations {


Just curious, if we are already doing this in the root gradle file, do we still need to do the same for all the modules?

yup. one way to not do it across other modules is to include these on sub-projects, but that hasn't given me much of a success.

As-of-now, it seems like duplicating it across modules works. However this change in temporary to keep us unblocked. We may just define it at one place after this PR opensearch-project/OpenSearch#17900 is being merged and tested once.

peterzhuamazon · 2025-04-11T23:01:31Z

@prudhvigodithi opened:

Use java-agent Gradle plugin to support phasing off SecurityManager usage in favor of Java Agent #3727

peterzhuamazon · 2025-04-12T01:43:58Z

Closing as #3727 is merged now. Thanks.

kumargu requested review from b4sjoo, dhrubo-os, mingshl, jngz-es, model-collapse, rbhavna, ylwu-amzn, zane-neo, Zhangxunmt, austintlee, HenryL27 and xinyual as code owners April 11, 2025 16:27

opensearch-trigger-bot bot added the infra label Apr 11, 2025

kumargu commented Apr 11, 2025

View reviewed changes

prudhvigodithi mentioned this pull request Apr 11, 2025

[Build Tools] Custom Gradle plugin to leverage java agent opensearch-project/OpenSearch#17900

Merged

3 tasks

andrross reviewed Apr 11, 2025

View reviewed changes

kumargu force-pushed the support_java_agent branch from c774cc0 to a9523c2 Compare April 11, 2025 16:42

kumargu had a problem deploying to ml-commons-cicd-env-require-approval April 11, 2025 16:44 — with GitHub Actions Failure

kumargu had a problem deploying to ml-commons-cicd-env-require-approval April 11, 2025 16:44 — with GitHub Actions Error

kumargu had a problem deploying to ml-commons-cicd-env-require-approval April 11, 2025 16:44 — with GitHub Actions Failure

This was referenced Apr 11, 2025

Simple change to Readme.md #3723

Closed

[RELEASE] Release version 3.0.0 opensearch-project/opensearch-build#3747

Closed

kumargu force-pushed the support_java_agent branch from a9523c2 to ecb1d75 Compare April 11, 2025 17:54

kumargu temporarily deployed to ml-commons-cicd-env-require-approval April 11, 2025 17:55 — with GitHub Actions Inactive

kumargu had a problem deploying to ml-commons-cicd-env-require-approval April 11, 2025 17:55 — with GitHub Actions Error

kumargu temporarily deployed to ml-commons-cicd-env-require-approval April 11, 2025 17:55 — with GitHub Actions Inactive

kumargu had a problem deploying to ml-commons-cicd-env-require-approval April 11, 2025 17:55 — with GitHub Actions Failure

kumargu temporarily deployed to ml-commons-cicd-env-require-approval April 11, 2025 19:57 — with GitHub Actions Inactive

kumargu force-pushed the support_java_agent branch from ecb1d75 to 297b51b Compare April 11, 2025 20:06

kumargu temporarily deployed to ml-commons-cicd-env-require-approval April 11, 2025 20:07 — with GitHub Actions Inactive

kumargu force-pushed the support_java_agent branch 2 times, most recently from 5016cbe to 12dff37 Compare April 11, 2025 20:10

kumargu had a problem deploying to ml-commons-cicd-env-require-approval April 11, 2025 20:12 — with GitHub Actions Failure

Support phasing off SecurityManager usage in favor of Java Agent

bcc0f72

Signed-off-by: Gulshan <[email protected]>

kumargu force-pushed the support_java_agent branch from 12dff37 to bcc0f72 Compare April 11, 2025 20:14

kumargu temporarily deployed to ml-commons-cicd-env-require-approval April 11, 2025 20:16 — with GitHub Actions Inactive

kumargu temporarily deployed to ml-commons-cicd-env-require-approval April 11, 2025 21:21 — with GitHub Actions Inactive

dhrubo-os reviewed Apr 11, 2025

View reviewed changes

peterzhuamazon approved these changes Apr 11, 2025

View reviewed changes

This was referenced Apr 11, 2025

Use java-agent Gradle plugin to support phasing off SecurityManager usage in favor of Java Agent #3726

Closed

Use java-agent Gradle plugin to support phasing off SecurityManager usage in favor of Java Agent #3727

Merged

peterzhuamazon closed this Apr 12, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Support phasing off SecurityManager usage in favor of Java Agent #3724

Support phasing off SecurityManager usage in favor of Java Agent #3724

Uh oh!

kumargu commented Apr 11, 2025

Uh oh!

kumargu Apr 11, 2025

Uh oh!

peterzhuamazon Apr 11, 2025

Uh oh!

andrross Apr 11, 2025

Uh oh!

kumargu Apr 11, 2025

Uh oh!

prudhvigodithi commented Apr 11, 2025

Uh oh!

kumargu commented Apr 11, 2025

Uh oh!

prudhvigodithi commented Apr 11, 2025

Uh oh!

codecov bot commented Apr 11, 2025 •

edited

Loading

Uh oh!

dhrubo-os Apr 11, 2025

Uh oh!

kumargu Apr 11, 2025

Uh oh!

peterzhuamazon commented Apr 11, 2025

Uh oh!

peterzhuamazon commented Apr 12, 2025

Uh oh!

Uh oh!

Support phasing off SecurityManager usage in favor of Java Agent #3724

Support phasing off SecurityManager usage in favor of Java Agent #3724

Uh oh!

Conversation

kumargu commented Apr 11, 2025

Description

Uh oh!

kumargu Apr 11, 2025

Choose a reason for hiding this comment

Uh oh!

peterzhuamazon Apr 11, 2025

Choose a reason for hiding this comment

Uh oh!

andrross Apr 11, 2025

Choose a reason for hiding this comment

Uh oh!

kumargu Apr 11, 2025

Choose a reason for hiding this comment

Uh oh!

prudhvigodithi commented Apr 11, 2025

Uh oh!

kumargu commented Apr 11, 2025

Uh oh!

prudhvigodithi commented Apr 11, 2025

Uh oh!

codecov bot commented Apr 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

dhrubo-os Apr 11, 2025

Choose a reason for hiding this comment

Uh oh!

kumargu Apr 11, 2025

Choose a reason for hiding this comment

Uh oh!

peterzhuamazon commented Apr 11, 2025

Uh oh!

peterzhuamazon commented Apr 12, 2025

Uh oh!

Uh oh!

codecov bot commented Apr 11, 2025 •

edited

Loading