[FEATURE] Built-in secure transports support

[reta]

Description

Ideally, the secure transport should be provided by the transport plugins, if and when those support secure communication. The role of the security plugin would be in providing the settings (certificates, keystores, etc) so the respective transport engine could be configured using those. Ideally, the change should be non-breaking and portable to 2.x (1.x?) release lines.

Related Issues

Closes #12256

Check List

• New functionality includes testing.
  • All tests pass
• New functionality has been documented.
  • New functionality has javadoc added
• Failing checks are inspected and point to the corresponding known issue(s) (See: Troubleshooting Failing Builds)
• Commits are signed per the DCO using --signoff
• Commit changes are listed out in CHANGELOG.md file (See: Changelog)
• Public documentation issue/PR created

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[github-actions]

Compatibility status:

Checks if related components are compatible with change 9a9387f

Incompatible components

Skipped components

Compatible components

Compatible components: [https://github.com/opensearch-project/custom-codecs.git, https://github.com/opensearch-project/asynchronous-search.git, https://github.com/opensearch-project/performance-analyzer-rca.git, https://github.com/opensearch-project/flow-framework.git, https://github.com/opensearch-project/job-scheduler.git, https://github.com/opensearch-project/cross-cluster-replication.git, https://github.com/opensearch-project/reporting.git, https://github.com/opensearch-project/security.git, https://github.com/opensearch-project/opensearch-oci-object-storage.git, https://github.com/opensearch-project/geospatial.git, https://github.com/opensearch-project/k-nn.git, https://github.com/opensearch-project/common-utils.git, https://github.com/opensearch-project/neural-search.git, https://github.com/opensearch-project/anomaly-detection.git, https://github.com/opensearch-project/performance-analyzer.git, https://github.com/opensearch-project/security-analytics.git, https://github.com/opensearch-project/index-management.git, https://github.com/opensearch-project/ml-commons.git, https://github.com/opensearch-project/notifications.git, https://github.com/opensearch-project/observability.git, https://github.com/opensearch-project/alerting.git, https://github.com/opensearch-project/sql.git]

[github-actions]

❌ Gradle check result for 7afc7fc: TIMEOUT

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

[github-actions]

✅ Gradle check result for 4224fe5: SUCCESS

[codecov]

Codecov Report

Attention: Patch coverage is 36.06061% with 211 lines in your changes are missing coverage. Please review.

Project coverage is 71.35%. Comparing base (b15cb0c) to head (c44709a).
Report is 59 commits behind head on main.

❗ Current head c44709a differs from pull request most recent head 9a9387f. Consider uploading reports for the commit 9a9387f to get more accurate results

Files	Patch %	Lines
...transport/netty4/ssl/SecureConnectionTestUtil.java	4.49%	85 Missing ⚠️
...ch/transport/netty4/ssl/SecureNetty4Transport.java	55.66%	37 Missing and 10 partials ⚠️
...earch/transport/netty4/ssl/DualModeSslHandler.java	0.00%	34 Missing ⚠️
.../org/opensearch/transport/netty4/ssl/SslUtils.java	0.00%	28 Missing ⚠️
...tp/netty4/ssl/SecureNetty4HttpServerTransport.java	78.57%	4 Missing and 5 partials ⚠️
...a/org/opensearch/transport/Netty4ModulePlugin.java	0.00%	6 Missing ⚠️
...a/org/opensearch/common/network/NetworkModule.java	86.66%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main   #12435      +/-   ##
============================================
- Coverage     71.42%   71.35%   -0.07%     
- Complexity    59978    60143     +165     
============================================
  Files          4985     5005      +20     
  Lines        282275   283375    +1100     
  Branches      40946    41067     +121     
============================================
+ Hits         201603   202213     +610     
- Misses        63999    64419     +420     
- Partials      16673    16743      +70     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[github-actions]

✅ Gradle check result for 22c8e3c: SUCCESS

[github-actions]

❕ Gradle check result for e459e90: UNSTABLE

• TEST FAILURES:

      1 org.opensearch.indices.replication.SegmentReplicationIT.classMethod

Please review all flaky tests that succeeded after retry and create an issue if one does not already exist to track the flaky failure.

[github-actions]

❌ Gradle check result for 6ba5653: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

[github-actions]

❌ Gradle check result for 6e58e5b: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

[reta]

❌ Gradle check result for 6e58e5b: FAILURE

#10006
#12197

[github-actions]

✅ Gradle check result for 6e58e5b: SUCCESS

[github-actions]

❌ Gradle check result for 984c140: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

[reta]

❌ Gradle check result for 984c140: FAILURE

#12664

[github-actions]

❌ Gradle check result for 984c140: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

[reta]

❌ Gradle check result for 984c140: FAILURE

#12665
#12664

[github-actions]

❌ Gradle check result for 984c140: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

[reta]

❌ Gradle check result for 984c140: FAILURE

#12664

[github-actions]

❌ Gradle check result for 984c140: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

[reta]

❌ Gradle check result for 984c140: FAILURE

#12664

[github-actions]

❕ Gradle check result for 984c140: UNSTABLE

• TEST FAILURES:

      1 org.opensearch.indices.replication.SegmentReplicationIT.testPrimaryStopped_ReplicaPromoted

Please review all flaky tests that succeeded after retry and create an issue if one does not already exist to track the flaky failure.

[peternied]

@reta Kudos! Thanks for working on this space - I'll try to free up some cycles to give this a detailed inspection ASAP alongside the security plugin modifications

[github-actions]

✅ Gradle check result for 037a2f7: SUCCESS

[github-actions]

✅ Gradle check result for c44709a: SUCCESS

[peternied]

I've finished reviewing - thanks for this great contribution @reta, only comment between me and approval is is around the NetworkPlugin interfaces.

[reta]

I've finished reviewing - thanks for this great contribution @reta, only comment between me and approval is is around the NetworkPlugin interfaces.

Thanks a lot @peternied , really appreciate it

[github-actions]

✅ Gradle check result for 9a9387f: SUCCESS

[opensearch-trigger-bot]

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/OpenSearch/backport-2.x 2.x
# Navigate to the new working tree
pushd ../.worktrees/OpenSearch/backport-2.x
# Create a new branch
git switch --create backport/backport-12435-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 773a93945429d99e3551fad6e4746668778aa563
# Push it to GitHub
git push --set-upstream origin backport/backport-12435-to-2.x
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/OpenSearch/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-12435-to-2.x.