Enable FIPS140LicenseBootstrapCheck

[jkakavas]

This commit ensures that xpack.security.fips_mode.enabled: true cannot be set in a node that doesn't have the appropriate license. The bootstrap check was introduced in #32437 but was not enabled.

[elasticmachine]

Pinging @elastic/es-security

[jasontedor]

LGTM. I did not notice this previously, but all of these bootstrap checks should be using the settings from the context rather than passing constructor parameters in derived from settings. For example, this is a patch for this bootstrap check:

diff --git a/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/FIPS140LicenseBootstrapCheck.java b/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/FIPS140LicenseBootstrapCheck.java
index d1bce0dcdd2..0b98cd7479b 100644
--- a/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/FIPS140LicenseBootstrapCheck.java
+++ b/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/FIPS140LicenseBootstrapCheck.java
@@ -10,6 +10,7 @@ import org.elasticsearch.bootstrap.BootstrapCheck;
 import org.elasticsearch.bootstrap.BootstrapContext;
 import org.elasticsearch.license.License;
 import org.elasticsearch.license.LicenseService;
+import org.elasticsearch.xpack.core.XPackSettings;
 
 import java.util.EnumSet;
 
@@ -21,15 +22,9 @@ final class FIPS140LicenseBootstrapCheck implements BootstrapCheck {
     static final EnumSet<License.OperationMode> ALLOWED_LICENSE_OPERATION_MODES =
         EnumSet.of(License.OperationMode.PLATINUM, License.OperationMode.TRIAL);
 
-    private final boolean isInFipsMode;
-
-    FIPS140LicenseBootstrapCheck(boolean isInFipsMode) {
-        this.isInFipsMode = isInFipsMode;
-    }
-
     @Override
-    public BootstrapCheckResult check(BootstrapContext context) {
-        if (isInFipsMode) {
+    public BootstrapCheckResult check(final BootstrapContext context) {
+        if (XPackSettings.FIPS_MODE_ENABLED.get(context.settings)) {
             License license = LicenseService.getLicense(context.metaData);
             if (license != null && ALLOWED_LICENSE_OPERATION_MODES.contains(license.operationMode()) == false) {
                 return BootstrapCheckResult.failure("FIPS mode is only allowed with a Platinum or Trial license");
diff --git a/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/Security.java b/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/Security.java
index 388a1a25896..d6f7283dd1a 100644
--- a/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/Security.java
+++ b/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/Security.java
@@ -303,7 +303,7 @@ public class Security extends Plugin implements ActionPlugin, IngestPlugin, Netw
                 new FIPS140SecureSettingsBootstrapCheck(settings, env),
                 new FIPS140JKSKeystoreBootstrapCheck(settings),
                 new FIPS140PasswordHashingAlgorithmBootstrapCheck(settings),
-                new FIPS140LicenseBootstrapCheck(XPackSettings.FIPS_MODE_ENABLED.get(settings))));
+                new FIPS140LicenseBootstrapCheck()));
             checks.addAll(InternalRealms.getBootstrapChecks(settings, env));
             this.bootstrapChecks = Collections.unmodifiableList(checks);
             Automatons.updateMaxDeterminizedStates(settings);

As a follow-up, can you address this for all the FIPS bootstrap checks?

[jkakavas]

As a follow-up, can you address this for all the FIPS bootstrap checks?

Sure, on it.

[jaymode]

LGTM

[jkakavas]

Jenkins test this please

[jkakavas]

Jenkins test this please

[tvernum]

all of these bootstrap checks should be using the settings from the context

I think we've fixed most of the cases where this matters (via #30953), but this doesn't work for secure settings. By the time the check runs, the es-keystore is closed, so you need to read the value from Settings during construction.