Add inbound_network entitlement to repository-hdfs plugin (#123907) (#124028)

mark-vieira · web-flow · commit f77b234e756a · 2025-03-05T05:38:05.000+11:00
diff --git a/libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/entitlements/InboundNetworkEntitlement.java b/libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/entitlements/InboundNetworkEntitlement.java
@@ -15,6 +15,6 @@
  * Describes an entitlement for inbound network actions (listen/accept/receive)
  */
 public record InboundNetworkEntitlement() implements Entitlement {
-    @ExternalEntitlement
+    @ExternalEntitlement(esModulesOnly = false)
     public InboundNetworkEntitlement {}
 }
diff --git a/plugins/repository-hdfs/src/main/plugin-metadata/entitlement-policy.yaml b/plugins/repository-hdfs/src/main/plugin-metadata/entitlement-policy.yaml
@@ -1,5 +1,6 @@
 ALL-UNNAMED:
   - manage_threads
+  - inbound_network # required for kerberos principals which specify a host component
   - outbound_network
   - load_native_libraries
   - write_system_properties:

Original file line number	Diff line number	Diff line change
`@@ -15,6 +15,6 @@`
`15`	`15`	`* Describes an entitlement for inbound network actions (listen/accept/receive)`
`16`	`16`	`*/`
`17`	`17`	`public record InboundNetworkEntitlement() implements Entitlement {`
`18`		`- @ExternalEntitlement`
	`18`	`+ @ExternalEntitlement(esModulesOnly = false)`
`19`	`19`	`public InboundNetworkEntitlement {}`
`20`	`20`	`}`