Skip to content

buildkite: provision runtime resources (streams, entity store, risk engine) before KB tests #593

Description

@JoshMock

Opened from failing KB functional tests in test/functional/kb/definitions/. Some feature routes exist but require a one-time runtime API call before the tests hit them. No docker env flag creates this state, so the ops fail (streams 422, entity store 400 "install first", risk engine 404/400).

After the existing Kibana readiness gate in .buildkite/run-kb-tests-runner.sh, add idempotent provisioning curls (ignore "already enabled"):

  • Wired streams (422): POST /api/streams/_enable
  • Entity Store (400): POST /api/security/entity_store/install
  • Risk engine (404/400): risk-engine init/enable call

Note: Entity Store V2 currently disables the legacy risk API; confirm which surface the definitions target before enabling. Verify each provisioning call returns 2xx, then unskip the dependent generated scripts incrementally.

Failing test definitions:

Wired streams (422, stack + serverless):

  • streams_delete_streams_name.yml
  • streams_delete_streams_streamname_attachments_attachmenttype_attachmentid.yml
  • streams_get_streams_name.yml
  • streams_get_streams_name_ingest.yml
  • streams_get_streams_name_query.yml
  • streams_get_streams_streamname_attachments.yml
  • streams_post_streams_name_content_export.yml
  • streams_post_streams_name_content_import.yml
  • streams_post_streams_name_fork.yml
  • streams_post_streams_streamname_attachments_bulk.yml
  • streams_put_streams_name.yml
  • streams_put_streams_name_ingest.yml
  • streams_put_streams_name_query.yml
  • streams_put_streams_streamname_attachments_attachmenttype_attachmentid.yml

Entity Store not installed (400, stack + serverless):

  • security_entity_store_delete_security_entity_store_entities.yml
  • security_entity_store_get_security_entity_store_resolution_group.yml
  • security_entity_store_post_security_entity_store_entities_entitytype.yml
  • security_entity_store_post_security_entity_store_resolution_link.yml
  • security_entity_store_post_security_entity_store_resolution_unlink.yml
  • security_entity_store_put_security_entity_store.yml
  • security_entity_store_put_security_entity_store_entities_bulk.yml
  • security_entity_store_put_security_entity_store_entities_entitytype.yml

Risk engine unavailable (404/400, stack):

  • security_entity_analytics_api_clean_up_risk_engine.yml
  • security_entity_analytics_api_configure_risk_engine_saved_object.yml
  • security_entity_analytics_api_schedule_risk_engine_now.yml

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions