Merge branch 'main' into issue-164406

.buildkite/ftr_configs.yml

@@ -223,14 +223,9 @@ enabled:
   - x-pack/test/cloud_security_posture_api/config.ts
   - x-pack/test/detection_engine_api_integration/basic/config.ts
   - x-pack/test/detection_engine_api_integration/security_and_spaces/group1/config.ts
-  - x-pack/test/detection_engine_api_integration/security_and_spaces/group2/config.ts
-  - x-pack/test/detection_engine_api_integration/security_and_spaces/group3/config.ts
   - x-pack/test/detection_engine_api_integration/security_and_spaces/group4/config.ts
   - x-pack/test/detection_engine_api_integration/security_and_spaces/group5/config.ts
   - x-pack/test/detection_engine_api_integration/security_and_spaces/group6/config.ts
-  - x-pack/test/detection_engine_api_integration/security_and_spaces/group7/config.ts
-  - x-pack/test/detection_engine_api_integration/security_and_spaces/group8/config.ts
-  - x-pack/test/detection_engine_api_integration/security_and_spaces/group9/config.ts
   - x-pack/test/detection_engine_api_integration/security_and_spaces/group10/config.ts
   - x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/config.ts
   - x-pack/test/detection_engine_api_integration/security_and_spaces/prebuilt_rules/config.ts
@@ -451,8 +446,18 @@ enabled:
   - x-pack/performance/journeys/apm_service_inventory.ts
   - x-pack/test/custom_branding/config.ts
   - x-pack/test/profiling_api_integration/cloud/config.ts
-  - x-pack/test/security_solution_api_integration/test_suites/detections_response/serverless.config.ts
-  - x-pack/test/security_solution_api_integration/test_suites/detections_response/ess.config.ts
+
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/workflows/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/date_numeric_types/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/keyword_text_long/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/exceptions/operators_data_types/ips_text_array/configs/ess.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/configs/serverless.config.ts
+  - x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_creation/configs/ess.config.ts
+
 
 
 

.buildkite/pipelines/es_serverless/verify_es_serverless_image.yml

@@ -63,7 +63,7 @@ steps:
           queue: n2-4-spot
         depends_on: build
         timeout_in_minutes: 60
-        parallelism: 2
+        parallelism: 4
         retry:
           automatic:
             - exit_status: '*'
@@ -89,7 +89,7 @@ steps:
           queue: n2-4-spot
         depends_on: build
         timeout_in_minutes: 60
-        parallelism: 4
+        parallelism: 8
         retry:
           automatic:
             - exit_status: '*'

.buildkite/pipelines/on_merge.yml

@@ -85,7 +85,7 @@ steps:
       queue: n2-4-spot
     depends_on: build
     timeout_in_minutes: 60
-    parallelism: 2
+    parallelism: 4
     retry:
       automatic:
         - exit_status: '*'
@@ -109,7 +109,7 @@ steps:
       queue: n2-4-spot
     depends_on: build
     timeout_in_minutes: 60
-    parallelism: 4
+    parallelism: 8
     retry:
       automatic:
         - exit_status: '*'

.buildkite/pipelines/on_merge_unsupported_ftrs.yml

@@ -27,7 +27,6 @@ steps:
       queue: n2-4-spot
     depends_on: build
     timeout_in_minutes: 120
-    parallelism: 4
     retry:
       automatic:
         - exit_status: '-1'
@@ -41,7 +40,6 @@ steps:
       queue: n2-4-spot
     depends_on: build
     timeout_in_minutes: 120
-    parallelism: 4
     retry:
       automatic:
         - exit_status: '-1'

.buildkite/pipelines/pull_request/base.yml

@@ -87,7 +87,7 @@ steps:
       queue: n2-4-spot
     depends_on: build
     timeout_in_minutes: 60
-    parallelism: 4
+    parallelism: 8
     retry:
       automatic:
         - exit_status: '*'
@@ -141,17 +141,6 @@ steps:
         - exit_status: '*'
           limit: 1
 
-  - command: .buildkite/scripts/steps/functional/defend_workflows_burn.sh
-    label: 'Defend Workflows Cypress Tests, burning changed specs'
-    agents:
-      queue: n2-4-virt
-    depends_on: build
-    timeout_in_minutes: 60
-    soft_fail: true
-    parallelism: 1
-    retry:
-      automatic: false
-
   - command: .buildkite/scripts/steps/functional/defend_workflows_serverless.sh
     label: 'Defend Workflows Cypress Tests on Serverless'
     agents:
@@ -164,17 +153,6 @@ steps:
         - exit_status: '*'
           limit: 1
 
-  - command: .buildkite/scripts/steps/functional/defend_workflows_serverless_burn.sh
-    label: 'Defend Workflows Cypress Tests on Serverless, burning changed specs'
-    agents:
-      queue: n2-4-virt
-    depends_on: build
-    timeout_in_minutes: 60
-    soft_fail: true
-    parallelism: 1
-    retry:
-      automatic: false
-
   - command: .buildkite/scripts/steps/functional/threat_intelligence.sh
     label: 'Threat Intelligence Cypress Tests'
     agents:
@@ -198,38 +176,6 @@ steps:
       automatic:
         - exit_status: '*'
           limit: 1
-    artifact_paths:
-      - 'target/kibana-osquery/**/*'
-
-  - command: .buildkite/scripts/steps/functional/security_solution_burn.sh
-    label: 'Security Solution Cypress tests, burning changed specs'
-    agents:
-      queue: n2-4-spot
-    depends_on: build
-    timeout_in_minutes: 60
-    parallelism: 1
-    retry:
-      automatic: false
-    soft_fail: true
-
-  - command: .buildkite/scripts/steps/code_generation/security_solution_codegen.sh
-    label: 'Security Solution OpenAPI codegen'
-    agents:
-      queue: n2-2-spot
-    timeout_in_minutes: 60
-    parallelism: 1
-
-  - command: .buildkite/scripts/steps/functional/osquery_cypress_burn.sh
-    label: 'Osquery Cypress Tests, burning changed specs'
-    agents:
-      queue: n2-4-spot
-    depends_on: build
-    timeout_in_minutes: 50
-    soft_fail: true
-    retry:
-      automatic: false
-    artifact_paths:
-      - 'target/kibana-osquery/**/*'
 
   - command: .buildkite/scripts/steps/functional/security_serverless_osquery.sh
     label: 'Serverless Osquery Cypress Tests'
@@ -242,8 +188,6 @@ steps:
       automatic:
         - exit_status: '*'
           limit: 1
-    artifact_paths:
-      - 'target/kibana-osquery/**/*'
 
   # status_exception: Native role management is not enabled in this Elasticsearch instance
   # - command: .buildkite/scripts/steps/functional/security_serverless_defend_workflows.sh

.buildkite/pipelines/pull_request/cypress_burn.yml

@@ -0,0 +1,43 @@
+steps:
+  - command: .buildkite/scripts/steps/functional/defend_workflows_burn.sh
+    label: 'Defend Workflows Cypress Tests, burning changed specs'
+    agents:
+      queue: n2-4-virt
+    depends_on: build
+    timeout_in_minutes: 60
+    soft_fail: true
+    parallelism: 1
+    retry:
+      automatic: false
+
+  - command: .buildkite/scripts/steps/functional/defend_workflows_serverless_burn.sh
+    label: 'Defend Workflows Cypress Tests on Serverless, burning changed specs'
+    agents:
+      queue: n2-4-virt
+    depends_on: build
+    timeout_in_minutes: 60
+    soft_fail: true
+    parallelism: 1
+    retry:
+      automatic: false
+
+  - command: .buildkite/scripts/steps/functional/security_solution_burn.sh
+    label: 'Security Solution Cypress tests, burning changed specs'
+    agents:
+      queue: n2-4-spot
+    depends_on: build
+    timeout_in_minutes: 60
+    parallelism: 1
+    retry:
+      automatic: false
+    soft_fail: true
+
+  - command: .buildkite/scripts/steps/functional/osquery_cypress_burn.sh
+    label: 'Osquery Cypress Tests, burning changed specs'
+    agents:
+      queue: n2-4-spot
+    depends_on: build
+    timeout_in_minutes: 50
+    soft_fail: true
+    retry:
+      automatic: false

.buildkite/pipelines/quality-gates/pipeline.tests-production.yaml

@@ -2,10 +2,6 @@
 # Incorporate any necessary additional logic to validate the service's integrity.
 # A failure in this pipeline build will prevent further progression to the subsequent stage.
 
-# DEPRECATION NOTICE:
-# PRODUCTION WILL SOON BE SPLIT INTO "CANARY" AND "NONCANARY" AND THIS FILE WILL BE DELETED.
-# ENSURE ANY CHANGE MADE TO THIS FILE IS REFLECTED IN THOSE FILES AS WELL.
-
 steps:
   - label: ":pipeline::kibana::seedling: Trigger SLO check"
     trigger: "serverless-quality-gates" # https://buildkite.com/elastic/serverless-quality-gates
@@ -18,9 +14,14 @@ steps:
     soft_fail: true
 
   - label: ":pipeline::rocket::seedling: Trigger control-plane e2e tests"
+    if: build.env("ENVIRONMENT") == "production-canary"
     trigger: "ess-k8s-production-e2e-tests" # https://buildkite.com/elastic/ess-k8s-production-e2e-tests
     build:
       env:
         REGION_ID: aws-us-east-1
         NAME_PREFIX: ci_test_kibana-promotion_
       message: "${BUILDKITE_MESSAGE} (triggered by pipeline.tests-production.yaml)"
+
+  - label: ":cookie: 24h bake time before continuing promotion"
+    if: build.env("ENVIRONMENT") == "production-canary"
+    command: "sleep 86400"

.buildkite/pipelines/quality-gates/pipeline.tests-qa.yaml

@@ -12,13 +12,15 @@ steps:
         EC_ENV: qa
         EC_REGION: aws-eu-west-1
       message: "${BUILDKITE_MESSAGE} (triggered by pipeline.tests-qa.yaml)"
-
-  - group: ":female-detective: Security Solution Tests"
-    key: "security"
-    steps:
-      - label: ":pipeline::female-detective::seedling: Trigger Security Solution quality gate script"
-        command: .buildkite/scripts/pipelines/security_solution_quality_gate/pipeline.sh
-        soft_fail: true # Remove this when tests are fixed
+
+  # TODO: Uncomment this code when the integration is ready. 
+  # - label: ":pipeline::female-detective::seedling: Trigger Security Solution quality gate script"
+  #   trigger: security-serverless-quality-gate # https://buildkite.com/elastic/security-serverless-quality-gate
+  #   soft_fail: true # Remove this when tests are fixed
+  #   build:
+  #     env:
+  #       ENVIRONMENT: ${ENVIRONMENT}
+  #     message: "${BUILDKITE_MESSAGE} (triggered by pipeline.tests-qa.yaml)"
 
   - label: ":pipeline::ship::seedling: Trigger Fleet serverless smoke tests for ${ENVIRONMENT}"
     trigger: fleet-smoke-tests # https://buildkite.com/elastic/fleet-smoke-tests

.buildkite/pull_requests.json

@@ -55,7 +55,7 @@
       "repoName": "kibana",
       "pipelineSlug": "kibana-kme-test",
 
-      "enabled": true,
+      "enabled": false,
       "allow_org_users": true,
       "allowed_repo_permissions": ["admin", "write"],
       "allowed_list": ["barlowm", "renovate[bot]"],

.buildkite/scripts/lifecycle/post_command.sh

@@ -14,6 +14,7 @@ if [[ "$IS_TEST_EXECUTION_STEP" == "true" ]]; then
   buildkite-agent artifact upload 'target/kibana-coverage/functional/**/*'
   buildkite-agent artifact upload 'target/kibana-*'
   buildkite-agent artifact upload 'target/kibana-security-solution/**/*.png'
+  buildkite-agent artifact upload 'target/kibana-osquery/**/*.png'
   buildkite-agent artifact upload 'target/kibana-fleet/**/*.png'
   buildkite-agent artifact upload 'target/test-metrics/*'
   buildkite-agent artifact upload 'target/test-suites-ci-plan.json'

.buildkite/scripts/pipelines/pull_request/pipeline.ts

@@ -164,6 +164,13 @@ const uploadPipeline = (pipelineContent: string | object) => {
       pipeline.push(getPipeline('.buildkite/pipelines/pull_request/check_next_docs.yml'));
     }
 
+    if (
+      GITHUB_PR_LABELS.includes('ci:cypress-burn') ||
+      GITHUB_PR_LABELS.includes('ci:all-cypress-suites')
+    ) {
+      pipeline.push(getPipeline('.buildkite/pipelines/pull_request/cypress_burn.yml'));
+    }
+
     pipeline.push(getPipeline('.buildkite/pipelines/pull_request/post_build.yml'));
 
     // remove duplicated steps

.buildkite/scripts/steps/artifacts/docker_image.sh

@@ -13,7 +13,8 @@ else
   KIBANA_IMAGE_TAG="pr-$BUILDKITE_PULL_REQUEST-$GIT_ABBREV_COMMIT"
 fi
 
-KIBANA_IMAGE="docker.elastic.co/kibana-ci/kibana-serverless:$KIBANA_IMAGE_TAG"
+KIBANA_BASE_IMAGE="docker.elastic.co/kibana-ci/kibana-serverless"
+KIBANA_IMAGE="$KIBANA_BASE_IMAGE:$KIBANA_IMAGE_TAG"
 
 echo "--- Verify manifest does not already exist"
 echo "$KIBANA_DOCKER_PASSWORD" | docker login -u "$KIBANA_DOCKER_USERNAME" --password-stdin docker.elastic.co
@@ -51,14 +52,21 @@ echo "--- Push images"
 docker image push "$KIBANA_IMAGE-arm64"
 docker image push "$KIBANA_IMAGE-amd64"
 
-echo "--- Create manifest"
+echo "--- Create and push manifests"
 docker manifest create \
   "$KIBANA_IMAGE" \
   --amend "$KIBANA_IMAGE-arm64" \
   --amend "$KIBANA_IMAGE-amd64"
-
-echo "--- Push manifest"
 docker manifest push "$KIBANA_IMAGE"
+
+if [[ "$BUILDKITE_BRANCH" == "$KIBANA_BASE_BRANCH" ]] && [[ "${BUILDKITE_PULL_REQUEST:-false}" == "false" ]]; then
+  docker manifest create \
+    "$KIBANA_BASE_IMAGE:latest" \
+    --amend "$KIBANA_IMAGE-arm64" \
+    --amend "$KIBANA_IMAGE-amd64"
+  docker manifest push "$KIBANA_BASE_IMAGE:latest"
+fi
+
 docker logout docker.elastic.co
 
 cat << EOF | buildkite-agent annotate --style "info" --context image
@@ -96,7 +104,6 @@ if [[ "$BUILDKITE_BRANCH" == "$KIBANA_BASE_BRANCH" ]] && [[ "${BUILDKITE_PULL_RE
   cat << EOF | buildkite-agent pipeline upload
 steps:
   - label: ":argo: Update kibana image tag for kibana-controller using gpctl"
-    async: true
     branches: main
     trigger: gpctl-promote-with-e2e-tests
     build: