Skip to content
This repository was archived by the owner on Aug 2, 2022. It is now read-only.

Commit 91a457d

Browse files
bowenlan-amznbowenlan-amzn
authored
Revert security changes (#408)
* Revert "ISM security (#360)" This reverts commit 3968342 * resolve issues after revert * Revert "rollup security (#394)" This reverts commit e29e3de * resolve issues after revert * self review
1 parent e29e3de commit 91a457d

File tree

52 files changed

+441
-1260
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

52 files changed

+441
-1260
lines changed

‎src/main/kotlin/com/amazon/opendistroforelasticsearch/indexmanagement/IndexManagementPlugin.kt‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -224,7 +224,6 @@ internal class IndexManagementPlugin : JobSchedulerExtension, NetworkPlugin, Act
224224
.registerNamedXContentRegistry(xContentRegistry)
225225
.registerScriptService(scriptService)
226226
.registerSettings(settings)
227-
.registerThreadPool(threadPool)
228227
.registerConsumers() // registerConsumers must happen after registerSettings/clusterService
229228
val rollupRunner = RollupRunner
230229
.registerClient(client)

‎src/main/kotlin/com/amazon/opendistroforelasticsearch/indexmanagement/elasticapi/ElasticExtensions.kt‎

Lines changed: 0 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -17,17 +17,11 @@
1717

1818
package com.amazon.opendistroforelasticsearch.indexmanagement.elasticapi
1919

20-
import com.amazon.opendistroforelasticsearch.commons.InjectSecurity
21-
import com.amazon.opendistroforelasticsearch.commons.authuser.User
2220
import com.amazon.opendistroforelasticsearch.indexmanagement.indexstatemanagement.model.ISMTemplate
2321
import com.amazon.opendistroforelasticsearch.indexmanagement.indexstatemanagement.model.Policy
2422
import com.amazon.opendistroforelasticsearch.indexmanagement.util.NO_ID
2523
import com.amazon.opendistroforelasticsearch.jobscheduler.spi.utils.LockService
26-
import kotlinx.coroutines.CoroutineScope
27-
import kotlinx.coroutines.ThreadContextElement
2824
import kotlinx.coroutines.delay
29-
import kotlinx.coroutines.withContext
30-
import org.apache.logging.log4j.LogManager
3125
import org.apache.logging.log4j.Logger
3226
import org.elasticsearch.ElasticsearchException
3327
import org.elasticsearch.ExceptionsHelper
@@ -36,9 +30,7 @@ import org.elasticsearch.action.bulk.BackoffPolicy
3630
import org.elasticsearch.action.support.DefaultShardOperationFailedException
3731
import org.elasticsearch.client.ElasticsearchClient
3832
import org.elasticsearch.common.bytes.BytesReference
39-
import org.elasticsearch.common.settings.Settings
4033
import org.elasticsearch.common.unit.TimeValue
41-
import org.elasticsearch.common.util.concurrent.ThreadContext
4234
import org.elasticsearch.common.xcontent.LoggingDeprecationHandler
4335
import org.elasticsearch.common.xcontent.NamedXContentRegistry
4436
import org.elasticsearch.common.xcontent.ToXContent
@@ -54,7 +46,6 @@ import org.elasticsearch.rest.RestStatus
5446
import org.elasticsearch.transport.RemoteTransportException
5547
import java.io.IOException
5648
import java.time.Instant
57-
import kotlin.coroutines.CoroutineContext
5849
import kotlin.coroutines.resume
5950
import kotlin.coroutines.resumeWithException
6051
import kotlin.coroutines.suspendCoroutine
@@ -89,13 +80,6 @@ fun XContentBuilder.optionalTimeField(name: String, instant: Instant?): XContent
8980
return this.timeField(name, "${name}_in_millis", instant.toEpochMilli())
9081
}
9182

92-
fun XContentBuilder.optionalUserField(name: String, user: User?): XContentBuilder {
93-
if (user == null) {
94-
return nullField(name)
95-
}
96-
return this.field(name, user)
97-
}
98-
9983
fun XContentBuilder.optionalISMTemplateField(name: String, ismTemplate: ISMTemplate?): XContentBuilder {
10084
if (ismTemplate == null) {
10185
return nullField(name)
@@ -203,55 +187,3 @@ fun <T> XContentParser.parseWithType(
203187
ensureExpectedToken(Token.END_OBJECT, this.nextToken(), this)
204188
return parsed
205189
}
206-
207-
val log = LogManager.getLogger("IndexManagementElasticExtention")
208-
const val INDEX_MANAGEMENT_PLUGIN_INTERNAL = "index_management_plugin_internal"
209-
/**
210-
* @param internalReq: used as flag to indicate if the request is from
211-
* outside user or plugin runner. if the value of this element is true
212-
* then we will not update user object.
213-
*/
214-
class InjectorContextElement(
215-
private val id: String,
216-
settings: Settings,
217-
private val threadContext: ThreadContext,
218-
private val roles: List<String>?,
219-
private val internalReq: Boolean = false
220-
) : ThreadContextElement<Unit> {
221-
222-
companion object Key : CoroutineContext.Key<InjectorContextElement>
223-
override val key: CoroutineContext.Key<*>
224-
get() = Key
225-
226-
var rolesInjectorHelper = InjectSecurity(id, settings, threadContext)
227-
228-
override fun updateThreadContext(context: CoroutineContext) {
229-
rolesInjectorHelper.injectRoles(roles)
230-
if (threadContext.getTransient<Boolean>(INDEX_MANAGEMENT_PLUGIN_INTERNAL) != internalReq) {
231-
threadContext.putTransient(INDEX_MANAGEMENT_PLUGIN_INTERNAL, internalReq)
232-
log.debug("Job [$id], rollup internal request: $internalReq;" +
233-
" Thread: ${Thread.currentThread().name}")
234-
} else {
235-
log.error("Job [$id], rollup internal request [$internalReq] not cleaned up;" +
236-
" Thread: ${Thread.currentThread().name}")
237-
}
238-
}
239-
240-
override fun restoreThreadContext(context: CoroutineContext, oldState: Unit) {
241-
rolesInjectorHelper.close()
242-
log.debug("Job [$id], rollup internal request cleaned: " +
243-
"${threadContext.getTransient<Boolean>(INDEX_MANAGEMENT_PLUGIN_INTERNAL)};" +
244-
" Thread: ${Thread.currentThread().name}")
245-
}
246-
}
247-
248-
suspend fun <T> withCloseableContext(
249-
context: CoroutineContext,
250-
block: suspend CoroutineScope.() -> T
251-
): T {
252-
try {
253-
return withContext(context) { block() }
254-
} finally {
255-
(context[InjectorContextElement.Key] as InjectorContextElement).rolesInjectorHelper.close()
256-
}
257-
}

‎src/main/kotlin/com/amazon/opendistroforelasticsearch/indexmanagement/indexstatemanagement/ManagedIndexCoordinator.kt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -290,9 +290,9 @@ class ManagedIndexCoordinator(
290290
val indexUuid = indexMetadatas[index].indexUUID
291291
val ismTemplate = templates[policyID]
292292
if (indexUuid != null && ismTemplate != null) {
293-
logger.info("index [$index] will be managed by policy [$policyID] of roles [${ismTemplate.user?.roles}]")
293+
logger.info("Index [$index] will be managed by policy [$policyID]")
294294
updateManagedIndexReqs.add(
295-
managedIndexConfigIndexRequest(index, indexUuid, policyID, jobInterval, ismTemplate.user)
295+
managedIndexConfigIndexRequest(index, indexUuid, policyID, jobInterval)
296296
)
297297
} else {
298298
logger.warn("Index [$index] has index uuid [$indexUuid] and/or " +

‎src/main/kotlin/com/amazon/opendistroforelasticsearch/indexmanagement/indexstatemanagement/ManagedIndexRunner.kt‎

Lines changed: 1 addition & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@
1616
package com.amazon.opendistroforelasticsearch.indexmanagement.indexstatemanagement
1717

1818
import com.amazon.opendistroforelasticsearch.indexmanagement.IndexManagementPlugin.Companion.INDEX_MANAGEMENT_INDEX
19-
import com.amazon.opendistroforelasticsearch.indexmanagement.elasticapi.InjectorContextElement
2019
import com.amazon.opendistroforelasticsearch.indexmanagement.indexstatemanagement.action.Action
2120
import com.amazon.opendistroforelasticsearch.indexmanagement.elasticapi.convertToMap
2221
import com.amazon.opendistroforelasticsearch.indexmanagement.elasticapi.parseWithType
@@ -26,7 +25,6 @@ import com.amazon.opendistroforelasticsearch.indexmanagement.indexstatemanagemen
2625
import com.amazon.opendistroforelasticsearch.indexmanagement.elasticapi.retry
2726
import com.amazon.opendistroforelasticsearch.indexmanagement.elasticapi.string
2827
import com.amazon.opendistroforelasticsearch.indexmanagement.elasticapi.suspendUntil
29-
import com.amazon.opendistroforelasticsearch.indexmanagement.elasticapi.withCloseableContext
3028
import com.amazon.opendistroforelasticsearch.indexmanagement.indexstatemanagement.model.ManagedIndexConfig
3129
import com.amazon.opendistroforelasticsearch.indexmanagement.indexstatemanagement.model.ManagedIndexMetaData
3230
import com.amazon.opendistroforelasticsearch.indexmanagement.indexstatemanagement.model.Policy
@@ -102,7 +100,6 @@ import org.elasticsearch.rest.RestStatus
102100
import org.elasticsearch.script.Script
103101
import org.elasticsearch.script.ScriptService
104102
import org.elasticsearch.script.TemplateScript
105-
import org.elasticsearch.threadpool.ThreadPool
106103
import java.time.Instant
107104
import java.time.temporal.ChronoUnit
108105

@@ -117,7 +114,6 @@ object ManagedIndexRunner : ScheduledJobRunner,
117114
private lateinit var xContentRegistry: NamedXContentRegistry
118115
private lateinit var scriptService: ScriptService
119116
private lateinit var settings: Settings
120-
private lateinit var threadPool: ThreadPool
121117
private var indexStateManagementEnabled: Boolean = DEFAULT_ISM_ENABLED
122118
@Suppress("MagicNumber")
123119
private val savePolicyRetryPolicy = BackoffPolicy.exponentialBackoff(TimeValue.timeValueMillis(250), 3)
@@ -172,11 +168,6 @@ object ManagedIndexRunner : ScheduledJobRunner,
172168
return this
173169
}
174170

175-
fun registerThreadPool(threadPool: ThreadPool): ManagedIndexRunner {
176-
this.threadPool = threadPool
177-
return this
178-
}
179-
180171
override fun runJob(job: ScheduledJobParameter, context: JobExecutionContext) {
181172
if (job !is ManagedIndexConfig) {
182173
throw IllegalArgumentException("Invalid job type, found ${job.javaClass.simpleName} with id: ${context.jobId}")
@@ -206,17 +197,6 @@ object ManagedIndexRunner : ScheduledJobRunner,
206197
return
207198
}
208199

209-
/*
210-
* We need to handle 3 cases:
211-
* 1. ISM jobs that are created by older versions and never updated wont have User details in the
212-
* job object. `managedIndexConfig.user` will be null. Insert `all_access` role.
213-
* 2. ISM jobs that are created when security plugin is disabled will have empty User object.
214-
* (`managedIndexConfig.user.name`, `managedIndexConfig.user.roles` are empty )
215-
* 3. ISM jobs that are created when security plugin is enabled will have an User object.
216-
*/
217-
val roles = managedIndexConfig.getRoles()
218-
logger.debug("Running ISM job: ${managedIndexConfig.name} with roles: $roles Thread: ${Thread.currentThread().name}")
219-
220200
// Get current IndexMetaData and ManagedIndexMetaData
221201
val indexMetaData = getIndexMetaData(managedIndexConfig.index)
222202
if (indexMetaData == null) {
@@ -303,10 +283,7 @@ object ManagedIndexRunner : ScheduledJobRunner,
303283

304284
if (updateResult && state != null && action != null && step != null && currentActionMetaData != null) {
305285
// Step null check is done in getStartingManagedIndexMetaData
306-
withCloseableContext(InjectorContextElement(managedIndexConfig.id, settings, threadPool.threadContext, roles)) {
307-
step.preExecute(logger).execute().postExecute(logger)
308-
}
309-
286+
step.preExecute(logger).execute().postExecute(logger)
310287
var executedManagedIndexMetaData = startingManagedIndexMetaData.getCompletedManagedIndexMetaData(action, step)
311288

312289
if (executedManagedIndexMetaData.isFailed) {

‎src/main/kotlin/com/amazon/opendistroforelasticsearch/indexmanagement/indexstatemanagement/model/ISMTemplate.kt‎

Lines changed: 3 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,8 @@
1515

1616
package com.amazon.opendistroforelasticsearch.indexmanagement.indexstatemanagement.model
1717

18-
import com.amazon.opendistroforelasticsearch.commons.authuser.User
1918
import com.amazon.opendistroforelasticsearch.indexmanagement.elasticapi.instant
2019
import com.amazon.opendistroforelasticsearch.indexmanagement.elasticapi.optionalTimeField
21-
import com.amazon.opendistroforelasticsearch.indexmanagement.elasticapi.optionalUserField
2220
import org.apache.logging.log4j.LogManager
2321
import org.elasticsearch.common.io.stream.StreamInput
2422
import org.elasticsearch.common.io.stream.StreamOutput
@@ -38,8 +36,7 @@ private val log = LogManager.getLogger(ISMTemplate::class.java)
3836
data class ISMTemplate(
3937
val indexPatterns: List<String>,
4038
val priority: Int,
41-
val lastUpdatedTime: Instant,
42-
val user: User?
39+
val lastUpdatedTime: Instant
4340
) : ToXContentObject, Writeable {
4441

4542
init {
@@ -52,39 +49,34 @@ data class ISMTemplate(
5249
.field(INDEX_PATTERN, indexPatterns)
5350
.field(PRIORITY, priority)
5451
.optionalTimeField(LAST_UPDATED_TIME_FIELD, lastUpdatedTime)
55-
.optionalUserField(USER_FIELD, user)
5652
.endObject()
5753
}
5854

5955
@Throws(IOException::class)
6056
constructor(sin: StreamInput) : this(
6157
sin.readStringList(),
6258
sin.readInt(),
63-
sin.readInstant(),
64-
sin.readOptionalWriteable(::User)
59+
sin.readInstant()
6560
)
6661

6762
@Throws(IOException::class)
6863
override fun writeTo(out: StreamOutput) {
6964
out.writeStringCollection(indexPatterns)
7065
out.writeInt(priority)
7166
out.writeInstant(lastUpdatedTime)
72-
out.writeOptionalWriteable(user)
7367
}
7468

7569
companion object {
7670
const val ISM_TEMPLATE_TYPE = "ism_template"
7771
const val INDEX_PATTERN = "index_patterns"
7872
const val PRIORITY = "priority"
7973
const val LAST_UPDATED_TIME_FIELD = "last_updated_time"
80-
const val USER_FIELD = "user"
8174

8275
@Suppress("ComplexMethod")
8376
fun parse(xcp: XContentParser): ISMTemplate {
8477
val indexPatterns: MutableList<String> = mutableListOf()
8578
var priority = 0
8679
var lastUpdatedTime: Instant? = null
87-
var user: User? = null
8880

8981
ensureExpectedToken(Token.START_OBJECT, xcp.currentToken(), xcp)
9082
while (xcp.nextToken() != Token.END_OBJECT) {
@@ -100,16 +92,14 @@ data class ISMTemplate(
10092
}
10193
PRIORITY -> priority = if (xcp.currentToken() == Token.VALUE_NULL) 0 else xcp.intValue()
10294
LAST_UPDATED_TIME_FIELD -> lastUpdatedTime = xcp.instant()
103-
USER_FIELD -> user = if (xcp.currentToken() == Token.VALUE_NULL) null else User.parse(xcp)
10495
else -> throw IllegalArgumentException("Invalid field: [$fieldName] found in ISMTemplate.")
10596
}
10697
}
10798

10899
return ISMTemplate(
109100
indexPatterns = indexPatterns,
110101
priority = priority,
111-
lastUpdatedTime = lastUpdatedTime ?: Instant.now(),
112-
user = user
102+
lastUpdatedTime = lastUpdatedTime ?: Instant.now()
113103
)
114104
}
115105
}

‎src/main/kotlin/com/amazon/opendistroforelasticsearch/indexmanagement/indexstatemanagement/model/ManagedIndexConfig.kt‎

Lines changed: 2 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,9 @@
1515

1616
package com.amazon.opendistroforelasticsearch.indexmanagement.indexstatemanagement.model
1717

18-
import com.amazon.opendistroforelasticsearch.commons.authuser.User
1918
import com.amazon.opendistroforelasticsearch.indexmanagement.elasticapi.instant
2019
import com.amazon.opendistroforelasticsearch.indexmanagement.elasticapi.optionalTimeField
21-
import com.amazon.opendistroforelasticsearch.indexmanagement.elasticapi.optionalUserField
2220
import com.amazon.opendistroforelasticsearch.indexmanagement.indexstatemanagement.util.XCONTENT_WITHOUT_TYPE
23-
import com.amazon.opendistroforelasticsearch.indexmanagement.util.ALL_ACCESS_ROLE
2421
import com.amazon.opendistroforelasticsearch.jobscheduler.spi.ScheduledJobParameter
2522
import com.amazon.opendistroforelasticsearch.jobscheduler.spi.schedule.Schedule
2623
import com.amazon.opendistroforelasticsearch.jobscheduler.spi.schedule.ScheduleParser
@@ -48,8 +45,7 @@ data class ManagedIndexConfig(
4845
val policySeqNo: Long?,
4946
val policyPrimaryTerm: Long?,
5047
val policy: Policy?,
51-
val changePolicy: ChangePolicy?,
52-
val user: User?
48+
val changePolicy: ChangePolicy?
5349
) : ScheduledJobParameter {
5450

5551
init {
@@ -88,18 +84,11 @@ data class ManagedIndexConfig(
8884
.field(POLICY_PRIMARY_TERM_FIELD, policyPrimaryTerm)
8985
.field(POLICY_FIELD, policy, XCONTENT_WITHOUT_TYPE)
9086
.field(CHANGE_POLICY_FIELD, changePolicy)
91-
.optionalUserField(USER_FIELD, user)
9287
.endObject()
9388
.endObject()
9489
return builder
9590
}
9691

97-
fun getRoles(): List<String> {
98-
return if (user == null) {
99-
ALL_ACCESS_ROLE
100-
} else user.roles
101-
}
102-
10392
companion object {
10493
const val MANAGED_INDEX_TYPE = "managed_index"
10594
const val NO_ID = ""
@@ -115,7 +104,6 @@ data class ManagedIndexConfig(
115104
const val POLICY_SEQ_NO_FIELD = "policy_seq_no"
116105
const val POLICY_PRIMARY_TERM_FIELD = "policy_primary_term"
117106
const val CHANGE_POLICY_FIELD = "change_policy"
118-
const val USER_FIELD = "user"
119107

120108
@Suppress("ComplexMethod", "LongMethod")
121109
@JvmStatic
@@ -139,7 +127,6 @@ data class ManagedIndexConfig(
139127
var enabled = true
140128
var policyPrimaryTerm: Long? = SequenceNumbers.UNASSIGNED_PRIMARY_TERM
141129
var policySeqNo: Long? = SequenceNumbers.UNASSIGNED_SEQ_NO
142-
var user: User? = null
143130

144131
ensureExpectedToken(Token.START_OBJECT, xcp.currentToken(), xcp)
145132
while (xcp.nextToken() != Token.END_OBJECT) {
@@ -167,7 +154,6 @@ data class ManagedIndexConfig(
167154
CHANGE_POLICY_FIELD -> {
168155
changePolicy = if (xcp.currentToken() == Token.VALUE_NULL) null else ChangePolicy.parse(xcp)
169156
}
170-
USER_FIELD -> user = if (xcp.currentToken() == Token.VALUE_NULL) null else User.parse(xcp)
171157
else -> throw IllegalArgumentException("Invalid field: [$fieldName] found in ManagedIndexConfig.")
172158
}
173159
}
@@ -193,8 +179,7 @@ data class ManagedIndexConfig(
193179
policyPrimaryTerm = policyPrimaryTerm,
194180
policy = policy?.copy(seqNo = policySeqNo ?: SequenceNumbers.UNASSIGNED_SEQ_NO,
195181
primaryTerm = policyPrimaryTerm ?: SequenceNumbers.UNASSIGNED_PRIMARY_TERM),
196-
changePolicy = changePolicy,
197-
user = user
182+
changePolicy = changePolicy
198183
)
199184
}
200185
}

0 commit comments

Comments
 (0)