Skip to content

[9.0] [Entitlements] Uniform server and plugins policy patching (#125011) #125078

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Mar 18, 2025
Merged

[9.0] [Entitlements] Uniform server and plugins policy patching (#125011) #125078

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d2f57f6
[Entitlements] Uniform server and plugins policy patching (#125011)
ldematte Mar 18, 2025
4bbb748
Merge branch '9.0' into backport/9.0/pr-125011
ldematte Mar 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 17 additions & 12 deletions libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,29 +49,34 @@ public record PluginData(Path pluginPath, boolean isModular, boolean isExternalP

private static final String POLICY_FILE_NAME = "entitlement-policy.yaml";

public static Map<String, Policy> createPluginPolicies(Collection<PluginData> pluginData, Map<String, String> overrides, String version)
throws IOException {
public static Map<String, Policy> createPluginPolicies(
Collection<PluginData> pluginData,
Map<String, String> pluginPolicyPatches,
String version
) throws IOException {
Map<String, Policy> pluginPolicies = new HashMap<>(pluginData.size());
for (var entry : pluginData) {
Path pluginRoot = entry.pluginPath();
Path policyFile = pluginRoot.resolve(POLICY_FILE_NAME);
String pluginName = pluginRoot.getFileName().toString();
final Set<String> moduleNames = getModuleNames(pluginRoot, entry.isModular());

var overriddenPolicy = parseEncodedPolicyIfExists(
overrides.get(pluginName),
var pluginPolicyPatch = parseEncodedPolicyIfExists(
pluginPolicyPatches.get(pluginName),
version,
entry.isExternalPlugin(),
pluginName,
moduleNames
);
if (overriddenPolicy != null) {
pluginPolicies.put(pluginName, overriddenPolicy);
} else {
Path policyFile = pluginRoot.resolve(POLICY_FILE_NAME);
var policy = parsePolicyIfExists(pluginName, policyFile, entry.isExternalPlugin());
validatePolicyScopes(pluginName, policy, moduleNames, policyFile.toString());
pluginPolicies.put(pluginName, policy);
}
var pluginPolicy = parsePolicyIfExists(pluginName, policyFile, entry.isExternalPlugin());
validatePolicyScopes(pluginName, pluginPolicy, moduleNames, policyFile.toString());

pluginPolicies.put(
pluginName,
pluginPolicyPatch == null
? pluginPolicy
: new Policy(pluginPolicy.name(), PolicyUtils.mergeScopes(pluginPolicy.scopes(), pluginPolicyPatch.scopes()))
);
}
return pluginPolicies;
}
Expand Down
31 changes: 17 additions & 14 deletions server/src/main/java/org/elasticsearch/bootstrap/Elasticsearch.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,8 +85,8 @@
*/
class Elasticsearch {

private static final String PLUGIN_POLICY_OVERRIDE_PREFIX = "es.entitlements.policy.";
private static final String SERVER_POLICY_OVERRIDE = "es.entitlements.server_policy";
private static final String POLICY_PATCH_PREFIX = "es.entitlements.policy.";
private static final String SERVER_POLICY_PATCH_NAME = POLICY_PATCH_PREFIX + "server";

/**
* Main entry point for starting elasticsearch.
Expand Down Expand Up @@ -251,10 +251,10 @@ private static void initPhase2(Bootstrap bootstrap) throws IOException {
.map(bundle -> new PolicyUtils.PluginData(bundle.getDir(), bundle.pluginDescriptor().isModular(), true))
).toList();

var pluginPolicyOverrides = collectPluginPolicyOverrides(modulesBundles, pluginsBundles, logger);
var pluginPolicies = PolicyUtils.createPluginPolicies(pluginData, pluginPolicyOverrides, Build.current().version());
var pluginPolicyPatches = collectPluginPolicyPatches(modulesBundles, pluginsBundles, logger);
var pluginPolicies = PolicyUtils.createPluginPolicies(pluginData, pluginPolicyPatches, Build.current().version());
var serverPolicyPatch = PolicyUtils.parseEncodedPolicyIfExists(
System.getProperty(SERVER_POLICY_OVERRIDE),
System.getProperty(SERVER_POLICY_PATCH_NAME),
Build.current().version(),
false,
"server",
Expand Down Expand Up @@ -329,33 +329,36 @@ private static void logSystemInfo() {
}
}

private static Map<String, String> collectPluginPolicyOverrides(
private static Map<String, String> collectPluginPolicyPatches(
Set<PluginBundle> modulesBundles,
Set<PluginBundle> pluginsBundles,
Logger logger
) {
var policyOverrides = new HashMap<String, String>();
var policyPatches = new HashMap<String, String>();
var systemProperties = BootstrapInfo.getSystemProperties();
systemProperties.keys().asIterator().forEachRemaining(key -> {
var value = systemProperties.get(key);
if (key instanceof String k && k.startsWith(PLUGIN_POLICY_OVERRIDE_PREFIX) && value instanceof String v) {
policyOverrides.put(k.substring(PLUGIN_POLICY_OVERRIDE_PREFIX.length()), v);
if (key instanceof String k
&& value instanceof String v
&& k.startsWith(POLICY_PATCH_PREFIX)
&& k.equals(SERVER_POLICY_PATCH_NAME) == false) {
policyPatches.put(k.substring(POLICY_PATCH_PREFIX.length()), v);
}
});
var pluginNames = Stream.concat(modulesBundles.stream(), pluginsBundles.stream())
.map(bundle -> bundle.pluginDescriptor().getName())
.collect(Collectors.toUnmodifiableSet());

for (var overriddenPluginName : policyOverrides.keySet()) {
if (pluginNames.contains(overriddenPluginName) == false) {
for (var patchedPluginName : policyPatches.keySet()) {
if (pluginNames.contains(patchedPluginName) == false) {
logger.warn(
"Found command-line override for unknown plugin [{}] (available plugins: [{}])",
overriddenPluginName,
"Found command-line policy patch for unknown plugin [{}] (available plugins: [{}])",
patchedPluginName,
String.join(", ", pluginNames)
);
}
}
return policyOverrides;
return policyPatches;
}

private static class EntitlementSelfTester {
Expand Down