Proof of concept for extension reserved indices #5
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Craig Perkins <[email protected]>
This was referenced Jul 14, 2023
…ect#3003) * Update imports for files refactored in core PR #8157 Signed-off-by: Craig Perkins <[email protected]> * Update references to old packages in test files Signed-off-by: Craig Perkins <[email protected]> * Get remaining bad imports in integrationTest Signed-off-by: Craig Perkins <[email protected]> * Update log4j in bwc build.gradle Signed-off-by: Craig Perkins <[email protected]> * Use versions.log4j Signed-off-by: Craig Perkins <[email protected]> * Also reference guava version Signed-off-by: Craig Perkins <[email protected]> * Update integtest.sh Signed-off-by: Craig Perkins <[email protected]> * Update tests that expect certain amount of headers in a response Signed-off-by: Craig Perkins <[email protected]> * Empty commit Signed-off-by: Craig Perkins <[email protected]> --------- Signed-off-by: Craig Perkins <[email protected]>
…h-project#3024) * Add -SNAPSHOT Signed-off-by: Craig Perkins <[email protected]> * Build SNAPSHOT for security plugin in bwc tests Signed-off-by: Craig Perkins <[email protected]> * Add -SNAPSHOT Signed-off-by: Craig Perkins <[email protected]> --------- Signed-off-by: Craig Perkins <[email protected]>
* Add release notes for 2.9.0.0 Signed-off-by: Craig Perkins <[email protected]> * Add new item to release notes Signed-off-by: Craig Perkins <[email protected]> --------- Signed-off-by: Craig Perkins <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This is a proof of concept of strong ownership between an extension identity (its service account) and indices that it requested to reserve on the first initialization request. The payload of the REST initialization request would look like:
The primary crux of this is that that SecurityIndexAccessEvaluator is knowledgable of the extensions registry (ExtensionsManager) and checks to see if requested system indices are owned by the extension when evaluating the permissions of a request that interact with a system index.
This strong level of ownership means that extensions cannot meddle with system indices owned by other extensions and there does not need to exist a role in the internal role list that is not intended to be mapped to regular users. By having the configuration in a single place it is also less configuration to get started with an extension since it is a one stop shop in the payload of the initialization request.
Companion PRs:
Core - cwperks/OpenSearch#93
SDK - cwperks/opensearch-sdk-java#1