Skip to content

Commit 98e69c8

Browse files
dan-rubinsteinelasticmachine
dan-rubinstein
and
elasticmachine
authored
Adding deprecation warning for data_frame_transforms roles (elastic#117521)
* Adding deprecation warning for data_frame_transforms roles * Updating deprecation warning URL --------- Co-authored-by: Elastic Machine <[email protected]>
1 parent 31678a3 commit 98e69c8

File tree

3 files changed

+119
-4
lines changed

3 files changed

+119
-4
lines changed

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/transform/TransformDeprecations.java‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,5 +27,12 @@ public class TransformDeprecations {
2727

2828
public static final String MAX_PAGE_SEARCH_SIZE_BREAKING_CHANGES_URL = "https://ela.st/es-deprecation-7-transform-max-page-search-size";
2929

30+
public static final String DATA_FRAME_TRANSFORMS_ROLES_BREAKING_CHANGES_URL =
31+
"https://ela.st/es-deprecation-9-data-frame-transforms-roles";
32+
33+
public static final String DATA_FRAME_TRANSFORMS_ROLES_IS_DEPRECATED = "This transform configuration uses one or more obsolete roles "
34+
+ "prefixed with [data_frame_transformers_] which will be unsupported after the next upgrade. Switch to a user with the equivalent "
35+
+ "roles prefixed with [transform_] and use [/_transform/_upgrade] to upgrade all transforms to the latest roles.";;
36+
3037
private TransformDeprecations() {}
3138
}

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/transform/transforms/TransformConfig.java‎

Lines changed: 38 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,13 @@
2424
import org.elasticsearch.xcontent.ToXContentObject;
2525
import org.elasticsearch.xcontent.XContentBuilder;
2626
import org.elasticsearch.xcontent.XContentParser;
27+
import org.elasticsearch.xpack.core.ClientHelper;
2728
import org.elasticsearch.xpack.core.common.time.TimeUtils;
2829
import org.elasticsearch.xpack.core.common.validation.SourceDestValidator;
2930
import org.elasticsearch.xpack.core.common.validation.SourceDestValidator.SourceDestValidation;
3031
import org.elasticsearch.xpack.core.deprecation.DeprecationIssue;
3132
import org.elasticsearch.xpack.core.deprecation.DeprecationIssue.Level;
33+
import org.elasticsearch.xpack.core.security.authc.support.AuthenticationContextSerializer;
3234
import org.elasticsearch.xpack.core.security.xcontent.XContentUtils;
3335
import org.elasticsearch.xpack.core.transform.TransformConfigVersion;
3436
import org.elasticsearch.xpack.core.transform.TransformDeprecations;
@@ -41,6 +43,7 @@
4143
import java.io.IOException;
4244
import java.time.Instant;
4345
import java.util.ArrayList;
46+
import java.util.Arrays;
4447
import java.util.Collections;
4548
import java.util.List;
4649
import java.util.Locale;
@@ -49,6 +52,7 @@
4952

5053
import static org.elasticsearch.xcontent.ConstructingObjectParser.constructorArg;
5154
import static org.elasticsearch.xcontent.ConstructingObjectParser.optionalConstructorArg;
55+
import static org.elasticsearch.xpack.core.security.authc.AuthenticationField.AUTHENTICATION_KEY;
5256

5357
/**
5458
* This class holds the configuration details of a data frame transform
@@ -65,6 +69,10 @@ public final class TransformConfig implements SimpleDiffable<TransformConfig>, W
6569
public static final ParseField HEADERS = new ParseField("headers");
6670
/** Version in which {@code FieldCapabilitiesRequest.runtime_fields} field was introduced. */
6771
private static final TransportVersion FIELD_CAPS_RUNTIME_MAPPINGS_INTRODUCED_TRANSPORT_VERSION = TransportVersions.V_7_12_0;
72+
private static final List<String> DEPRECATED_DATA_FRAME_TRANSFORMS_ROLES = List.of(
73+
"data_frame_transforms_admin",
74+
"data_frame_transforms_user"
75+
);
6876

6977
/** Specifies all the possible transform functions. */
7078
public enum Function {
@@ -374,7 +382,7 @@ public ActionRequestValidationException validate(ActionRequestValidationExceptio
374382
* @param namedXContentRegistry XContent registry required for aggregations and query DSL
375383
* @return The deprecations of this transform
376384
*/
377-
public List<DeprecationIssue> checkForDeprecations(NamedXContentRegistry namedXContentRegistry) {
385+
public List<DeprecationIssue> checkForDeprecations(NamedXContentRegistry namedXContentRegistry) throws IOException {
378386

379387
List<DeprecationIssue> deprecations = new ArrayList<>();
380388

@@ -404,9 +412,38 @@ public List<DeprecationIssue> checkForDeprecations(NamedXContentRegistry namedXC
404412
if (retentionPolicyConfig != null) {
405413
retentionPolicyConfig.checkForDeprecations(getId(), namedXContentRegistry, deprecations::add);
406414
}
415+
416+
var deprecatedTransformRoles = getRolesFromHeaders().stream().filter(DEPRECATED_DATA_FRAME_TRANSFORMS_ROLES::contains).toList();
417+
if (deprecatedTransformRoles.isEmpty() == false) {
418+
deprecations.add(
419+
new DeprecationIssue(
420+
Level.CRITICAL,
421+
"Transform [" + id + "] uses deprecated transform roles " + deprecatedTransformRoles,
422+
TransformDeprecations.DATA_FRAME_TRANSFORMS_ROLES_BREAKING_CHANGES_URL,
423+
TransformDeprecations.DATA_FRAME_TRANSFORMS_ROLES_IS_DEPRECATED,
424+
false,
425+
null
426+
)
427+
);
428+
}
429+
407430
return deprecations;
408431
}
409432

433+
private List<String> getRolesFromHeaders() throws IOException {
434+
if (headers == null) {
435+
return Collections.emptyList();
436+
}
437+
438+
var encodedAuthenticationHeader = ClientHelper.filterSecurityHeaders(headers).getOrDefault(AUTHENTICATION_KEY, "");
439+
if (encodedAuthenticationHeader.isEmpty()) {
440+
return Collections.emptyList();
441+
}
442+
443+
var decodedAuthenticationHeader = AuthenticationContextSerializer.decode(encodedAuthenticationHeader);
444+
return Arrays.asList(decodedAuthenticationHeader.getEffectiveSubject().getUser().roles());
445+
}
446+
410447
@Override
411448
public void writeTo(final StreamOutput out) throws IOException {
412449
out.writeString(id);

‎x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/transform/transforms/TransformConfigTests.java‎

Lines changed: 74 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@
2727
import org.elasticsearch.xpack.core.common.validation.SourceDestValidator.SourceDestValidation;
2828
import org.elasticsearch.xpack.core.deprecation.DeprecationIssue;
2929
import org.elasticsearch.xpack.core.deprecation.DeprecationIssue.Level;
30+
import org.elasticsearch.xpack.core.security.authc.AuthenticationTestHelper;
31+
import org.elasticsearch.xpack.core.security.user.User;
3032
import org.elasticsearch.xpack.core.transform.AbstractSerializingTransformTestCase;
3133
import org.elasticsearch.xpack.core.transform.TransformConfigVersion;
3234
import org.elasticsearch.xpack.core.transform.TransformDeprecations;
@@ -44,6 +46,7 @@
4446
import java.util.Map;
4547

4648
import static org.elasticsearch.test.TestMatchers.matchesPattern;
49+
import static org.elasticsearch.xpack.core.security.authc.AuthenticationField.AUTHENTICATION_KEY;
4750
import static org.elasticsearch.xpack.core.transform.transforms.DestConfigTests.randomDestConfig;
4851
import static org.elasticsearch.xpack.core.transform.transforms.SourceConfigTests.randomInvalidSourceConfig;
4952
import static org.elasticsearch.xpack.core.transform.transforms.SourceConfigTests.randomSourceConfig;
@@ -58,6 +61,8 @@ public class TransformConfigTests extends AbstractSerializingTransformTestCase<T
5861

5962
private String transformId;
6063
private boolean runWithHeaders;
64+
private static final String DATA_FRAME_TRANSFORMS_ADMIN_ROLE = "data_frame_transforms_admin";
65+
private static final String DATA_FRAME_TRANSFORMS_USER_ROLE = "data_frame_transforms_user";
6166

6267
public static TransformConfig randomTransformConfigWithoutHeaders() {
6368
return randomTransformConfigWithoutHeaders(randomAlphaOfLengthBetween(1, 10));
@@ -165,6 +170,25 @@ public static TransformConfig randomTransformConfigWithSettings(SettingsConfig s
165170
);
166171
}
167172

173+
public static TransformConfig randomTransformConfigWithHeaders(Map<String, String> headers) {
174+
return new TransformConfig(
175+
randomAlphaOfLengthBetween(1, 10),
176+
randomSourceConfig(),
177+
randomDestConfig(),
178+
randomBoolean() ? null : TimeValue.timeValueMillis(randomIntBetween(1_000, 3_600_000)),
179+
randomBoolean() ? null : randomSyncConfig(),
180+
headers,
181+
randomBoolean() ? null : PivotConfigTests.randomPivotConfig(),
182+
randomBoolean() ? null : LatestConfigTests.randomLatestConfig(),
183+
randomBoolean() ? null : randomAlphaOfLengthBetween(1, 1000),
184+
randomBoolean() ? null : SettingsConfigTests.randomSettingsConfig(),
185+
randomBoolean() ? null : randomMetadata(),
186+
randomBoolean() ? null : randomRetentionPolicyConfig(),
187+
randomBoolean() ? null : Instant.now(),
188+
TransformConfigVersion.CURRENT.toString()
189+
);
190+
}
191+
168192
public static TransformConfig randomTransformConfig(
169193
String id,
170194
TransformConfigVersion version,
@@ -915,10 +939,13 @@ public void testGroupByStayInOrder() throws IOException {
915939
}
916940
}
917941

918-
public void testCheckForDeprecations() {
942+
public void testCheckForDeprecations_NoDeprecationWarnings() throws IOException {
919943
String id = randomAlphaOfLengthBetween(1, 10);
920944
assertThat(randomTransformConfig(id, TransformConfigVersion.CURRENT).checkForDeprecations(xContentRegistry()), is(empty()));
945+
}
921946

947+
public void testCheckForDeprecations_WithDeprecatedFields_VersionCurrent() throws IOException {
948+
String id = randomAlphaOfLengthBetween(1, 10);
922949
TransformConfig deprecatedConfig = randomTransformConfigWithDeprecatedFields(id, TransformConfigVersion.CURRENT);
923950

924951
// check _and_ clear warnings
@@ -940,8 +967,11 @@ public void testCheckForDeprecations() {
940967
)
941968
)
942969
);
970+
}
943971

944-
deprecatedConfig = randomTransformConfigWithDeprecatedFields(id, TransformConfigVersion.V_7_10_0);
972+
public void testCheckForDeprecations_WithDeprecatedFields_Version_7_10() throws IOException {
973+
String id = randomAlphaOfLengthBetween(1, 10);
974+
TransformConfig deprecatedConfig = randomTransformConfigWithDeprecatedFields(id, TransformConfigVersion.V_7_10_0);
945975

946976
// check _and_ clear warnings
947977
assertWarnings(TransformDeprecations.ACTION_MAX_PAGE_SEARCH_SIZE_IS_DEPRECATED);
@@ -962,8 +992,11 @@ public void testCheckForDeprecations() {
962992
)
963993
)
964994
);
995+
}
965996

966-
deprecatedConfig = randomTransformConfigWithDeprecatedFields(id, TransformConfigVersion.V_7_4_0);
997+
public void testCheckForDeprecations_WithDeprecatedFields_Version_7_4() throws IOException {
998+
String id = randomAlphaOfLengthBetween(1, 10);
999+
TransformConfig deprecatedConfig = randomTransformConfigWithDeprecatedFields(id, TransformConfigVersion.V_7_4_0);
9671000

9681001
// check _and_ clear warnings
9691002
assertWarnings(TransformDeprecations.ACTION_MAX_PAGE_SEARCH_SIZE_IS_DEPRECATED);
@@ -994,6 +1027,44 @@ public void testCheckForDeprecations() {
9941027
);
9951028
}
9961029

1030+
public void testCheckForDeprecations_WithDeprecatedTransformUserAdmin() throws IOException {
1031+
testCheckForDeprecations_WithDeprecatedRoles(List.of(DATA_FRAME_TRANSFORMS_ADMIN_ROLE));
1032+
}
1033+
1034+
public void testCheckForDeprecations_WithDeprecatedTransformUserRole() throws IOException {
1035+
testCheckForDeprecations_WithDeprecatedRoles(List.of(DATA_FRAME_TRANSFORMS_USER_ROLE));
1036+
}
1037+
1038+
public void testCheckForDeprecations_WithDeprecatedTransformRoles() throws IOException {
1039+
testCheckForDeprecations_WithDeprecatedRoles(List.of(DATA_FRAME_TRANSFORMS_ADMIN_ROLE, DATA_FRAME_TRANSFORMS_USER_ROLE));
1040+
}
1041+
1042+
private void testCheckForDeprecations_WithDeprecatedRoles(List<String> roles) throws IOException {
1043+
var authentication = AuthenticationTestHelper.builder()
1044+
.realm()
1045+
.user(new User(randomAlphaOfLength(10), roles.toArray(String[]::new)))
1046+
.build();
1047+
Map<String, String> headers = Map.of(AUTHENTICATION_KEY, authentication.encode());
1048+
TransformConfig deprecatedConfig = randomTransformConfigWithHeaders(headers);
1049+
1050+
// important: checkForDeprecations does _not_ create new deprecation warnings
1051+
assertThat(
1052+
deprecatedConfig.checkForDeprecations(xContentRegistry()),
1053+
equalTo(
1054+
List.of(
1055+
new DeprecationIssue(
1056+
Level.CRITICAL,
1057+
"Transform [" + deprecatedConfig.getId() + "] uses deprecated transform roles " + roles,
1058+
TransformDeprecations.DATA_FRAME_TRANSFORMS_ROLES_BREAKING_CHANGES_URL,
1059+
TransformDeprecations.DATA_FRAME_TRANSFORMS_ROLES_IS_DEPRECATED,
1060+
false,
1061+
null
1062+
)
1063+
)
1064+
)
1065+
);
1066+
}
1067+
9971068
public void testSerializingMetadataPreservesOrder() throws IOException {
9981069
String json = Strings.format("""
9991070
{

0 commit comments

Comments
 (0)