[Feature] Check for and perform upgrades on security configurations by peternied · Pull Request #4102 · opensearch-project/security

peternied · 2024-03-08T00:21:33Z

Description

This adds a new API that allows for checking and updating configurations from the default configurations on disk. Initial feature supports only Roles.

Response when no upgrade is available

GET _plugins/_security/api/_upgrade_check
200 {
  "status": "ok",
  "upgradeAvailable" : false
}

Response when a new role is available

GET _plugins/_security/api/_upgrade_check
200 {
  "status": "ok",
  "upgradeAvailable" : true,
  "upgradeActions" : {
    "roles" : {
      "add" : [ "flow_framework_full_access" ]
    }
  }
}

Response when a new role + existing role were updated

GET _plugins/_security/api/_upgrade_check
200 {
  "status": "ok",
  "upgradeAvailable" : true,
  "upgradeActions" : {
    "roles" : {
      "add" : [ "flow_framework_full_access" ],
      "modify" : [ "flow_framework_read_access" ]
    }
  }
}

Perform an upgrade

POST _plugins/_security/api/_upgrade_perform
200 {
  "status" : "OK",
  "upgrades" : {
    "roles" : {
      "add" : [ "flow_framework_full_access" ],
      "modify" : [ "flow_framework_read_access" ]
    }
  }
}

Perform an upgrade when unneeded

POST _plugins/_security/api/_upgrade_perform
400 {
   "status": "BAD_REQUEST",
   "message": "Unable to upgrade, no differences found in 'roles' config"
}

Issues Resolved

[FEATURE] New reserved roles are not sourced to security index on an upgrade #2316

Testing

New unit test and integration test cases

Check List

New functionality includes testing
New functionality has been documented
Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Peter Nied <petern@amazon.com>

…t-index-on-managed-node' Signed-off-by: Andrey Pleskach <ples@aiven.io> Signed-off-by: Peter Nied <petern@amazon.com>

Signed-off-by: Peter Nied <petern@amazon.com>

Signed-off-by: Peter Nied <peternied@hotmail.com>

Signed-off-by: Peter Nied <petern@amazon.com>

src/main/java/org/opensearch/security/securityconf/impl/CType.java

Signed-off-by: Peter Nied <petern@amazon.com>

src/integrationTest/java/org/opensearch/security/DefaultConfigurationTests.java

cwperks

Thank you @peternied. This PR looks good to me. I left one minor comment on the integration test about strengthening the assertions post upgrade.

stephen-crawford

Overall looks good. Just two minor comments

src/integrationTest/resources/roles.yml

src/test/java/org/opensearch/security/dlic/rest/api/ConfigUpgradeApiActionUnitTest.java

Signed-off-by: Peter Nied <petern@amazon.com>

cwperks

Thank you for adding an additional assertion. This looks good to me.

Signed-off-by: Peter Nied <petern@amazon.com>

peternied · 2024-03-19T15:54:09Z

@DarshitChanpura @cwperks @scrawfor99 I've resolved all comment threads, could you take another look?

opensearch-trigger-bot · 2024-03-20T17:05:36Z

The backport to 2.13 failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/security/backport-2.13 2.13
# Navigate to the new working tree
pushd ../.worktrees/security/backport-2.13
# Create a new branch
git switch --create backport/backport-4102-to-2.13
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 fa877babe3dac13c30bcc2bcbe4d484bcdb6101f
# Push it to GitHub
git push --set-upstream origin backport/backport-4102-to-2.13
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/security/backport-2.13

Then, create a pull request where the base branch is 2.13 and the compare/head branch is backport/backport-4102-to-2.13.

opensearch-trigger-bot · 2024-03-20T17:05:37Z

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/security/backport-2.x 2.x
# Navigate to the new working tree
pushd ../.worktrees/security/backport-2.x
# Create a new branch
git switch --create backport/backport-4102-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 fa877babe3dac13c30bcc2bcbe4d484bcdb6101f
# Push it to GitHub
git push --set-upstream origin backport/backport-4102-to-2.x
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/security/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-4102-to-2.x.

…pensearch-project#4102) This adds a new API that allows for checking and updating configurations from the default configurations on disk. Initial feature supports only Roles. ``` GET _plugins/_security/api/_upgrade_check 200 { "status": "ok", "upgradeAvailable" : false } ``` ``` GET _plugins/_security/api/_upgrade_check 200 { "status": "ok", "upgradeAvailable" : true, "upgradeActions" : { "roles" : { "add" : [ "flow_framework_full_access" ] } } } ``` ``` GET _plugins/_security/api/_upgrade_check 200 { "status": "ok", "upgradeAvailable" : true, "upgradeActions" : { "roles" : { "add" : [ "flow_framework_full_access" ], "modify" : [ "flow_framework_read_access" ] } } } ``` ``` POST _plugins/_security/api/_upgrade_perform 200 { "status" : "OK", "upgrades" : { "roles" : { "add" : [ "flow_framework_full_access" ], "modify" : [ "flow_framework_read_access" ] } } } ``` ``` POST _plugins/_security/api/_upgrade_perform 400 { "status": "BAD_REQUEST", "message": "Unable to upgrade, no differences found in 'roles' config" } ``` - opensearch-project#2316 New unit test and integration test cases - [X] New functionality includes testing - [ ] New functionality has been documented - [X] Commits are signed per the DCO using --signoff By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license. For more information on following Developer Certificate of Origin and signing off your commits, please check [here](https://github.com/opensearch-project/OpenSearch/blob/main/CONTRIBUTING.md#developer-certificate-of-origin). --------- Signed-off-by: Peter Nied <petern@amazon.com> Signed-off-by: Andrey Pleskach <ples@aiven.io> Signed-off-by: Peter Nied <peternied@hotmail.com> (cherry picked from commit fa877ba)

…pensearch-project#4102) ### Description This adds a new API that allows for checking and updating configurations from the default configurations on disk. Initial feature supports only Roles. #### Response when no upgrade is available ``` GET _plugins/_security/api/_upgrade_check 200 { "status": "ok", "upgradeAvailable" : false } ``` #### Response when a new role is available ``` GET _plugins/_security/api/_upgrade_check 200 { "status": "ok", "upgradeAvailable" : true, "upgradeActions" : { "roles" : { "add" : [ "flow_framework_full_access" ] } } } ``` #### Response when a new role + existing role were updated ``` GET _plugins/_security/api/_upgrade_check 200 { "status": "ok", "upgradeAvailable" : true, "upgradeActions" : { "roles" : { "add" : [ "flow_framework_full_access" ], "modify" : [ "flow_framework_read_access" ] } } } ``` #### Perform an upgrade ``` POST _plugins/_security/api/_upgrade_perform 200 { "status" : "OK", "upgrades" : { "roles" : { "add" : [ "flow_framework_full_access" ], "modify" : [ "flow_framework_read_access" ] } } } ``` #### Perform an upgrade when unneeded ``` POST _plugins/_security/api/_upgrade_perform 400 { "status": "BAD_REQUEST", "message": "Unable to upgrade, no differences found in 'roles' config" } ``` ### Issues Resolved - opensearch-project#2316 ### Testing New unit test and integration test cases ### Check List - [X] New functionality includes testing - [ ] New functionality has been documented - [X] Commits are signed per the DCO using --signoff By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license. For more information on following Developer Certificate of Origin and signing off your commits, please check [here](https://github.com/opensearch-project/OpenSearch/blob/main/CONTRIBUTING.md#developer-certificate-of-origin). --------- Signed-off-by: Peter Nied <petern@amazon.com> Signed-off-by: Andrey Pleskach <ples@aiven.io> Signed-off-by: Peter Nied <peternied@hotmail.com>

peternied and others added 17 commits February 23, 2024 22:56

Start making a reserved role handler

3ccf38b

Signed-off-by: Peter Nied <petern@amazon.com>

Starting to read the file from disk

7fb4bea

Signed-off-by: Peter Nied <petern@amazon.com>

Functional diff

745eeb7

Signed-off-by: Peter Nied <petern@amazon.com>

Functional upgrade check

c8db0ec

Signed-off-by: Peter Nied <petern@amazon.com>

[Cherry-Pick] Configuration Type improvements from 'willyborankin/ini…

dd099be

…t-index-on-managed-node' Signed-off-by: Andrey Pleskach <ples@aiven.io> Signed-off-by: Peter Nied <petern@amazon.com>

Cleaning up

20acbba

Signed-off-by: Peter Nied <petern@amazon.com>

Functional upgrade check

cafb776

Signed-off-by: Peter Nied <petern@amazon.com>

Remove unneed deep copies

d2843cf

Signed-off-by: Peter Nied <peternied@hotmail.com>

Upgrade with tests

5db53a9

Signed-off-by: Peter Nied <peternied@hotmail.com>

Spotless formatting

1c0f623

Signed-off-by: Peter Nied <peternied@hotmail.com>

Add more stuff

051ed7e

Signed-off-by: Peter Nied <petern@amazon.com>

Spotless

a064136

Signed-off-by: Peter Nied <petern@amazon.com>

Clean up integration test

f92c510

Signed-off-by: Peter Nied <petern@amazon.com>

Clean up changes around ValidationResult

30d6bfc

Signed-off-by: Peter Nied <petern@amazon.com>

Found out the configuration changes weren't actually pushed

3a1e1ff

Signed-off-by: Peter Nied <petern@amazon.com>

Make sure upgraded configs are commited

0a77c17

Signed-off-by: Peter Nied <petern@amazon.com>

Tests

7bec1f6

Signed-off-by: Peter Nied <petern@amazon.com>

peternied requested review from DarshitChanpura, RyanL1997, cliu123, cwperks, davidlago, reta, stephen-crawford and willyborankin as code owners March 8, 2024 00:21

peternied commented Mar 8, 2024

View reviewed changes

src/main/java/org/opensearch/security/securityconf/impl/CType.java Show resolved Hide resolved

peternied changed the title ~~Check for and perform upgrades on security configurations~~ [Feature] Check for and perform upgrades on security configurations Mar 8, 2024

Clean up tests

ddc04e5

Signed-off-by: Peter Nied <petern@amazon.com>

peternied mentioned this pull request Mar 8, 2024

[DOC] Add documentation for security configuration upgrade feature opensearch-project/documentation-website#6633

Closed

4 tasks

Spotless fix

c906ac1

Signed-off-by: Peter Nied <petern@amazon.com>

cwperks reviewed Mar 14, 2024

View reviewed changes

src/integrationTest/java/org/opensearch/security/DefaultConfigurationTests.java Show resolved Hide resolved

cwperks reviewed Mar 14, 2024

View reviewed changes

src/integrationTest/java/org/opensearch/security/DefaultConfigurationTests.java Show resolved Hide resolved

cwperks reviewed Mar 14, 2024

View reviewed changes

src/integrationTest/java/org/opensearch/security/DefaultConfigurationTests.java Show resolved Hide resolved

cwperks reviewed Mar 14, 2024

View reviewed changes

stephen-crawford previously approved these changes Mar 14, 2024

View reviewed changes

src/integrationTest/resources/roles.yml Show resolved Hide resolved

src/test/java/org/opensearch/security/dlic/rest/api/ConfigUpgradeApiActionUnitTest.java Show resolved Hide resolved

Add comments and validation around the upgrade integration test

c40f46f

Signed-off-by: Peter Nied <petern@amazon.com>

peternied dismissed stephen-crawford’s stale review via c40f46f March 15, 2024 20:46

cwperks previously approved these changes Mar 18, 2024

View reviewed changes

Add comments around ConfigItemChanges methods

b71ee75

Signed-off-by: Peter Nied <petern@amazon.com>

peternied dismissed cwperks’s stale review via b71ee75 March 18, 2024 21:29

Merge remote-tracking branch 'origin/main' into upgrade-roles

4f53ee2

Signed-off-by: Peter Nied <petern@amazon.com>

cwperks approved these changes Mar 19, 2024

View reviewed changes

DarshitChanpura approved these changes Mar 20, 2024

View reviewed changes

DarshitChanpura merged commit fa877ba into opensearch-project:main Mar 20, 2024

DarshitChanpura added backport 2.x v2.13.0 Issues targeting release v2.13.0 backport 2.13 backport to 2.13 branch labels Mar 20, 2024

opensearch-trigger-bot bot added the backport-failed label Mar 20, 2024

willyborankin mentioned this pull request Apr 15, 2024

[Backport 2.x] Check for and perform upgrades on security configurations #4251

Merged

peternied deleted the upgrade-roles branch April 15, 2024 18:02

peternied added v2.14.0 Issues and PRs related to version 2.14.0 and removed v2.13.0 Issues targeting release v2.13.0 backport 2.13 backport to 2.13 branch labels Apr 15, 2024

peternied mentioned this pull request May 2, 2024

[FEATURE] New reserved roles are not sourced to security index on an upgrade #2316

Closed

DarshitChanpura removed the backport-failed label Jul 30, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Feature] Check for and perform upgrades on security configurations#4102

[Feature] Check for and perform upgrades on security configurations#4102
DarshitChanpura merged 23 commits intoopensearch-project:mainfrom
peternied:upgrade-roles

peternied commented Mar 8, 2024 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cwperks left a comment

Uh oh!

stephen-crawford left a comment

Uh oh!

Uh oh!

Uh oh!

cwperks left a comment

Uh oh!

peternied commented Mar 19, 2024

Uh oh!

opensearch-trigger-bot bot commented Mar 20, 2024

Uh oh!

opensearch-trigger-bot bot commented Mar 20, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

peternied commented Mar 8, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Response when no upgrade is available

Response when a new role is available

Response when a new role + existing role were updated

Perform an upgrade

Perform an upgrade when unneeded

Issues Resolved

Testing

Check List

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cwperks left a comment

Choose a reason for hiding this comment

Uh oh!

stephen-crawford left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cwperks left a comment

Choose a reason for hiding this comment

Uh oh!

peternied commented Mar 19, 2024

Uh oh!

opensearch-trigger-bot bot commented Mar 20, 2024

Uh oh!

opensearch-trigger-bot bot commented Mar 20, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

peternied commented Mar 8, 2024 •

edited

Loading