Switch to built-in security transports from core

[reta]

Description

The security plugin does not need to provide the secure transports anymore but SecureSettingsFactory so the core transport modules will be able to configure those.

Issues Resolved

Closes #4118

Is this a backport? If so, please add backport PR # and/or commits #

Testing

[Please provide details of testing done: unit testing, integration testing and manual testing]

Check List

• New functionality includes testing
• New functionality has been documented
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[codecov]

Codecov Report

Attention: Patch coverage is 94.91525% with 3 lines in your changes are missing coverage. Please review.

Project coverage is 65.90%. Comparing base (a731e62) to head (f2e2209).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4119      +/-   ##
==========================================
- Coverage   66.04%   65.90%   -0.14%     
==========================================
  Files         300      298       -2     
  Lines       21554    21425     -129     
  Branches     3488     3475      -13     
==========================================
- Hits        14235    14121     -114     
+ Misses       5571     5563       -8     
+ Partials     1748     1741       -7     

Files	Coverage Δ
.../opensearch/security/OpenSearchSecurityPlugin.java	84.79% <100.00%> (+0.04%)	⬆️
...opensearch/security/filter/SecurityRestFilter.java	70.37% <ø> (ø)
...earch/security/http/NonSslHttpServerTransport.java	100.00% <ø> (ø)
...earch/security/http/SecureHttpServerTransport.java	100.00% <100.00%> (ø)
.../security/ssl/OpenSearchSecureSettingsFactory.java	100.00% <100.00%> (ø)
.../ssl/http/netty/Netty4ConditionalDecompressor.java	100.00% <ø> (ø)
...sl/http/netty/Netty4HttpRequestHeaderVerifier.java	85.71% <ø> (ø)
...arch/security/ssl/OpenSearchSecuritySSLPlugin.java	86.25% <90.32%> (+1.13%)	⬆️

... and 6 files with indirect coverage changes

[reta]

The work is not done :) but this is a first step towards removing secure transport part from the plugin, there are a few gaps that will be covered by opensearch-project/OpenSearch#12903 shortly

[cwperks]

Thank you @reta! The changes look good to me, I just left 2 small cosmetic comments.

I would be interested in seeing bwc tests for switching to secure transport in core while configured from the security plugin and eventually switching all configuration to core.

Have you tested this in a mixed cluster where some nodes are using the transport from core and some from the security plugin?

[reta]

Have you tested this in a mixed cluster where some nodes are using the transport from core and some from the security plugin?

Thanks @cwperks ! No, I have not tested it yet but I test migrations for sure, thank you. The current implementation is cheating a bit since the secure transports are still provided by security plugin (although the implementation moved), but the next iteration (opensearch-project/OpenSearch#12907) should make it 100% fair.

[reta]

@cwperks mind please retaking a look? thank you!

[cwperks]

Looks good to me!

[opensearch-trigger-bot]

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/security/backport-2.x 2.x
# Navigate to the new working tree
pushd ../.worktrees/security/backport-2.x
# Create a new branch
git switch --create backport/backport-4119-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 e2a06f001154d558c4c717c2a2bc54b9f57d1654
# Push it to GitHub
git push --set-upstream origin backport/backport-4119-to-2.x
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/security/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-4119-to-2.x.