Skip to content

Commit f5cffbf

Browse files
dan-rubinsteinelasticmachinen1v0lgprwhelan
authored
Deprecating data_frame_transforms roles (#117519)
* Deprecating data_frame_transforms roles * Update docs/changelog/117519.yaml * Update changelog * Removing deprecation warning * Cleaning up unused role retrieval function * Update docs/changelog/117519.yaml * Update changelog with breaking change details * Revert ClusterPrivilegeResolver * Remove Deprecated Transform Role permissions * Update docs/changelog/117519.yaml Co-authored-by: Nikolaj Volgushev <[email protected]> * Revert "Remove Deprecated Transform Role permissions" This reverts commit 4599256. * Revert docs, update changelog * Revert privilege tests --------- Co-authored-by: Elastic Machine <[email protected]> Co-authored-by: Nikolaj Volgushev <[email protected]> Co-authored-by: Pat Whelan <[email protected]>
1 parent f1ebbfc commit f5cffbf

File tree

7 files changed

+97
-327
lines changed

7 files changed

+97
-327
lines changed

‎docs/changelog/117519.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
pr: 117519
2+
summary: Remove `data_frame_transforms` roles
3+
area: Transform
4+
type: breaking
5+
issues: []
6+
breaking:
7+
title: Remove `data_frame_transforms` roles
8+
area: Transform
9+
details: >-
10+
`data_frame_transforms_admin` and `data_frame_transforms_user` were deprecated in
11+
Elasticsearch 7 and are being removed in Elasticsearch 9.
12+
`data_frame_transforms_admin` is now `transform_admin`.
13+
`data_frame_transforms_user` is now `transform_user`.
14+
Users must call the `_update` API to replace the permissions on the Transform before the
15+
Transform can be started.
16+
impact: >-
17+
Transforms created with either the `data_frame_transforms_admin` or the
18+
`data_frame_transforms_user` role will fail to start. The Transform will remain
19+
in a `stopped` state, and its health will be red while displaying permission failures.
20+
notable: false

‎docs/reference/security/authorization/built-in-roles.asciidoc‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -33,18 +33,6 @@ suitable for writing beats output to {es}.
3333

3434
--
3535

36-
[[built-in-roles-data-frame-transforms-admin]] `data_frame_transforms_admin` ::
37-
Grants `manage_data_frame_transforms` cluster privileges, which enable you to
38-
manage {transforms}. This role also includes all
39-
{kibana-ref}/kibana-privileges.html[Kibana privileges] for the {ml-features}.
40-
deprecated:[7.5.0,"Replaced by <<built-in-roles-transform-admin,`transform_admin`>>"].
41-
42-
[[built-in-roles-data-frame-transforms-user]] `data_frame_transforms_user` ::
43-
Grants `monitor_data_frame_transforms` cluster privileges, which enable you to
44-
use {transforms}. This role also includes all
45-
{kibana-ref}/kibana-privileges.html[Kibana privileges] for the {ml-features}.
46-
deprecated:[7.5.0,"Replaced by <<built-in-roles-transform-user,`transform_user`>>"].
47-
4836
[[built-in-roles-editor]] `editor` ::
4937

5038
Grants full access to all features in {kib} (including Solutions) and read-only access to data indices.

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java‎

Lines changed: 0 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -539,70 +539,6 @@ private static Map<String, RoleDescriptor> initializeReservedRoles() {
539539
+ "and roles that grant access to Kibana."
540540
)
541541
),
542-
// DEPRECATED: to be removed in 9.0.0
543-
entry(
544-
"data_frame_transforms_admin",
545-
new RoleDescriptor(
546-
"data_frame_transforms_admin",
547-
new String[] { "manage_data_frame_transforms" },
548-
new RoleDescriptor.IndicesPrivileges[] {
549-
RoleDescriptor.IndicesPrivileges.builder()
550-
.indices(
551-
TransformInternalIndexConstants.AUDIT_INDEX_PATTERN,
552-
TransformInternalIndexConstants.AUDIT_INDEX_PATTERN_DEPRECATED,
553-
TransformInternalIndexConstants.AUDIT_INDEX_READ_ALIAS
554-
)
555-
.privileges("view_index_metadata", "read")
556-
.build() },
557-
new RoleDescriptor.ApplicationResourcePrivileges[] {
558-
RoleDescriptor.ApplicationResourcePrivileges.builder()
559-
.application("kibana-*")
560-
.resources("*")
561-
.privileges("reserved_ml_user")
562-
.build() },
563-
null,
564-
null,
565-
MetadataUtils.getDeprecatedReservedMetadata("Please use the [transform_admin] role instead"),
566-
null,
567-
null,
568-
null,
569-
null,
570-
"Grants manage_data_frame_transforms cluster privileges, which enable you to manage transforms. "
571-
+ "This role also includes all Kibana privileges for the machine learning features."
572-
)
573-
),
574-
// DEPRECATED: to be removed in 9.0.0
575-
entry(
576-
"data_frame_transforms_user",
577-
new RoleDescriptor(
578-
"data_frame_transforms_user",
579-
new String[] { "monitor_data_frame_transforms" },
580-
new RoleDescriptor.IndicesPrivileges[] {
581-
RoleDescriptor.IndicesPrivileges.builder()
582-
.indices(
583-
TransformInternalIndexConstants.AUDIT_INDEX_PATTERN,
584-
TransformInternalIndexConstants.AUDIT_INDEX_PATTERN_DEPRECATED,
585-
TransformInternalIndexConstants.AUDIT_INDEX_READ_ALIAS
586-
)
587-
.privileges("view_index_metadata", "read")
588-
.build() },
589-
new RoleDescriptor.ApplicationResourcePrivileges[] {
590-
RoleDescriptor.ApplicationResourcePrivileges.builder()
591-
.application("kibana-*")
592-
.resources("*")
593-
.privileges("reserved_ml_user")
594-
.build() },
595-
null,
596-
null,
597-
MetadataUtils.getDeprecatedReservedMetadata("Please use the [transform_user] role instead"),
598-
null,
599-
null,
600-
null,
601-
null,
602-
"Grants monitor_data_frame_transforms cluster privileges, which enable you to use transforms. "
603-
+ "This role also includes all Kibana privileges for the machine learning features. "
604-
)
605-
),
606542
entry(
607543
"transform_admin",
608544
new RoleDescriptor(

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/transform/TransformDeprecations.java‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,5 @@ public class TransformDeprecations {
2727

2828
public static final String MAX_PAGE_SEARCH_SIZE_BREAKING_CHANGES_URL = "https://ela.st/es-deprecation-7-transform-max-page-search-size";
2929

30-
public static final String DATA_FRAME_TRANSFORMS_ROLES_BREAKING_CHANGES_URL =
31-
"https://ela.st/es-deprecation-9-data-frame-transforms-roles";
32-
33-
public static final String DATA_FRAME_TRANSFORMS_ROLES_IS_DEPRECATED = "This transform configuration uses one or more obsolete roles "
34-
+ "prefixed with [data_frame_transformers_] which will be unsupported after the next upgrade. Switch to a user with the equivalent "
35-
+ "roles prefixed with [transform_] and use [/_transform/_upgrade] to upgrade all transforms to the latest roles.";;
36-
3730
private TransformDeprecations() {}
3831
}

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/transform/transforms/TransformConfig.java‎

Lines changed: 0 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -24,13 +24,11 @@
2424
import org.elasticsearch.xcontent.ToXContentObject;
2525
import org.elasticsearch.xcontent.XContentBuilder;
2626
import org.elasticsearch.xcontent.XContentParser;
27-
import org.elasticsearch.xpack.core.ClientHelper;
2827
import org.elasticsearch.xpack.core.common.time.TimeUtils;
2928
import org.elasticsearch.xpack.core.common.validation.SourceDestValidator;
3029
import org.elasticsearch.xpack.core.common.validation.SourceDestValidator.SourceDestValidation;
3130
import org.elasticsearch.xpack.core.deprecation.DeprecationIssue;
3231
import org.elasticsearch.xpack.core.deprecation.DeprecationIssue.Level;
33-
import org.elasticsearch.xpack.core.security.authc.support.AuthenticationContextSerializer;
3432
import org.elasticsearch.xpack.core.security.xcontent.XContentUtils;
3533
import org.elasticsearch.xpack.core.transform.TransformConfigVersion;
3634
import org.elasticsearch.xpack.core.transform.TransformDeprecations;
@@ -43,7 +41,6 @@
4341
import java.io.IOException;
4442
import java.time.Instant;
4543
import java.util.ArrayList;
46-
import java.util.Arrays;
4744
import java.util.Collections;
4845
import java.util.List;
4946
import java.util.Locale;
@@ -52,7 +49,6 @@
5249

5350
import static org.elasticsearch.xcontent.ConstructingObjectParser.constructorArg;
5451
import static org.elasticsearch.xcontent.ConstructingObjectParser.optionalConstructorArg;
55-
import static org.elasticsearch.xpack.core.security.authc.AuthenticationField.AUTHENTICATION_KEY;
5652

5753
/**
5854
* This class holds the configuration details of a data frame transform
@@ -69,10 +65,6 @@ public final class TransformConfig implements SimpleDiffable<TransformConfig>, W
6965
public static final ParseField HEADERS = new ParseField("headers");
7066
/** Version in which {@code FieldCapabilitiesRequest.runtime_fields} field was introduced. */
7167
private static final TransportVersion FIELD_CAPS_RUNTIME_MAPPINGS_INTRODUCED_TRANSPORT_VERSION = TransportVersions.V_7_12_0;
72-
private static final List<String> DEPRECATED_DATA_FRAME_TRANSFORMS_ROLES = List.of(
73-
"data_frame_transforms_admin",
74-
"data_frame_transforms_user"
75-
);
7668

7769
/** Specifies all the possible transform functions. */
7870
public enum Function {
@@ -413,37 +405,9 @@ public List<DeprecationIssue> checkForDeprecations(NamedXContentRegistry namedXC
413405
retentionPolicyConfig.checkForDeprecations(getId(), namedXContentRegistry, deprecations::add);
414406
}
415407

416-
var deprecatedTransformRoles = getRolesFromHeaders().stream().filter(DEPRECATED_DATA_FRAME_TRANSFORMS_ROLES::contains).toList();
417-
if (deprecatedTransformRoles.isEmpty() == false) {
418-
deprecations.add(
419-
new DeprecationIssue(
420-
Level.CRITICAL,
421-
"Transform [" + id + "] uses deprecated transform roles " + deprecatedTransformRoles,
422-
TransformDeprecations.DATA_FRAME_TRANSFORMS_ROLES_BREAKING_CHANGES_URL,
423-
TransformDeprecations.DATA_FRAME_TRANSFORMS_ROLES_IS_DEPRECATED,
424-
false,
425-
null
426-
)
427-
);
428-
}
429-
430408
return deprecations;
431409
}
432410

433-
private List<String> getRolesFromHeaders() throws IOException {
434-
if (headers == null) {
435-
return Collections.emptyList();
436-
}
437-
438-
var encodedAuthenticationHeader = ClientHelper.filterSecurityHeaders(headers).getOrDefault(AUTHENTICATION_KEY, "");
439-
if (encodedAuthenticationHeader.isEmpty()) {
440-
return Collections.emptyList();
441-
}
442-
443-
var decodedAuthenticationHeader = AuthenticationContextSerializer.decode(encodedAuthenticationHeader);
444-
return Arrays.asList(decodedAuthenticationHeader.getEffectiveSubject().getUser().roles());
445-
}
446-
447411
@Override
448412
public void writeTo(final StreamOutput out) throws IOException {
449413
out.writeString(id);

0 commit comments

Comments
 (0)