[CI] CoreWithSecurityClientYamlTestSuiteIT class failing

[elasticsearchmachine]

Build Scans:

• elasticsearch-periodic-platform-support #9016 / windows-2025_checkpart4_platform-support-windows
• elasticsearch-periodic-platform-support #9012 / windows-2025_checkpart4_platform-support-windows
• elasticsearch-periodic-platform-support #9008 / windows-2025_checkpart4_platform-support-windows
• elasticsearch-periodic-platform-support #9001 / windows-2025_checkpart4_platform-support-windows

Fake news, below scans are for unmerged PRs:

• elasticsearch-pull-request #77899 / part-4
• elasticsearch-pull-request #77684 / part-4
• elasticsearch-pull-request #77674 / part-4
• elasticsearch-pull-request #77585 / part-4
• elasticsearch-pull-request #77427 / part-4
• elasticsearch-pull-request #77362 / part-4

Reproduction Line:

undefined

Applicable branches:
main

Reproduces locally?:
N/A

Failure History:
See dashboard

Failure Message:

undefined

Issue Reasons:

• [main] 4 consecutive failures in step windows-2025_checkpart4_platform-support-windows
• [main] 2 consecutive failures in pipeline elasticsearch-periodic-platform-support
• [main] 11 failures in class org.elasticsearch.xpack.security.CoreWithSecurityClientYamlTestSuiteIT (1.3% fail rate in 824 executions)
• [main] 4 failures in step windows-2025_checkpart4_platform-support-windows (25.0% fail rate in 16 executions)
• [main] 7 failures in step part-4 (1.9% fail rate in 370 executions)
• [main] 4 failures in pipeline elasticsearch-periodic-platform-support (25.0% fail rate in 16 executions)
• [main] 7 failures in pipeline elasticsearch-pull-request (1.9% fail rate in 373 executions)

Note:
This issue was created using new test triage automation. Please report issues or feedback to es-delivery.

[elasticsearchmachine]

Pinging @elastic/es-search-relevance (Team:Search Relevance)

[pmpailis]

All tests under security seem to have failed.

Looking at the first failure, cluster.stats/30_ccs_stats we can see the following in the logs:

[2025-06-26T09:11:38,334][WARN ][o.e.t.TcpTransport       ] [test-cluster-0] exception caught on transport layer [Netty4TcpChannel{localAddress=/127.0.0.1:33123, remoteAddress=/127.0.0.1:56374, profile=default}], closing connection java.lang.Exception: java.lang.AssertionError: child request with action [indices:data/read/search] contains unexpanded wildcards [cluster_one:*, cluster_one:*, cluster_two:*, cluster_two:*]
	at org.elasticsearch.transport.netty4@9.1.0-SNAPSHOT/org.elasticsearch.transport.netty4.Netty4MessageInboundHandler.exceptionCaught(Netty4MessageInboundHandler.java:68)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeExceptionCaught(AbstractChannelHandlerContext.java:346)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:447)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
	at org.elasticsearch.transport.netty4@9.1.0-SNAPSHOT/org.elasticsearch.transport.netty4.NettyByteBufSizer.channelRead(NettyByteBufSizer.java:33)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
	at io.netty.transport@4.1.118.Final/io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1357)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440)
	at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
	at io.netty.transport@4.1.118.Final/io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:868)
	at io.netty.transport@4.1.118.Final/io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166)
	at io.netty.transport@4.1.118.Final/io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:796)
	at io.netty.transport@4.1.118.Final/io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:697)
	at io.netty.transport@4.1.118.Final/io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:660)
	at io.netty.transport@4.1.118.Final/io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562)
	at io.netty.common@4.1.118.Final/io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:998)
	at io.netty.common@4.1.118.Final/io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
	at java.base/java.lang.Thread.run(Thread.java:1447)
Caused by: java.lang.AssertionError: child request with action [indices:data/read/search] contains unexpanded wildcards [cluster_one:*, cluster_one:*, cluster_two:*, cluster_two:*]
	at org.elasticsearch.security@9.1.0-SNAPSHOT/org.elasticsearch.xpack.security.authz.RBACEngine.isChildActionAuthorizedByParentOnLocalNode(RBACEngine.java:541)
	at org.elasticsearch.security@9.1.0-SNAPSHOT/org.elasticsearch.xpack.security.authz.RBACEngine.authorizeIndexAction(RBACEngine.java:405)
	at org.elasticsearch.security@9.1.0-SNAPSHOT/org.elasticsearch.xpack.security.authz.AuthorizationService.authorizeAction(AuthorizationService.java:535)
	at org.elasticsearch.security@9.1.0-SNAPSHOT/org.elasticsearch.xpack.security.authz.AuthorizationService.maybeAuthorizeRunAs(AuthorizationService.java:450)
	at org.elasticsearch.security@9.1.0-SNAPSHOT/org.elasticsearch.xpack.security.authz.AuthorizationService.lambda$authorize$3(AuthorizationService.java:337)
	at org.elasticsearch.server@9.1.0-SNAPSHOT/org.elasticsearch.action.ActionListener$2.onResponse(ActionListener.java:258)
	at org.elasticsearch.server@9.1.0-SNAPSHOT/org.elasticsearch.action.support.ContextPreservingActionListener.onResponse(ContextPreservingActionListener.java:33)
	at org.elasticsearch.security@9.1.0-SNAPSHOT/org.elasticsearch.xpack.security.authz.RBACEngine.lambda$resolveAuthorizationInfo$0(RBACEngine.java:176)
	at org.elasticsearch.server@9.1.0-SNAPSHOT/org.elasticsearch.action.ActionListenerImplementations$ResponseWrappingActionListener.onResponse(ActionListenerImplementations.java:261)

And then all subsequent tests failed as well. Rerouting first to @elastic/es-search-foundations to verify whether something changed around the test.

[elasticsearchmachine]

Pinging @elastic/es-search-foundations (Team:Search Foundations)

[elasticsearchmachine]

Pinging @elastic/es-security (Team:Security)