[PoC] Support ::failures selector and access to failure store with CCS

[slobodanadamovic]

No description provided.

[slobodanadamovic]

read_failure_store must be granted to cross-cluster API keys

[slobodanadamovic]

This is the key part: making the read_cross_cluster authorize both data and failure selectors for cross cluster search.

[Copilot]

Pull Request Overview

This PR introduces proof-of-concept support for the ::failures selector and failure store access during cross-cluster search. It adds new Java REST tests for both RCS1 and RCS2, updates privilege definitions to recognize failure store access, and extends selector resolution tests.

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
x-pack/plugin/security/qa/multi-cluster/src/javaRestTest/java/org/elasticsearch/xpack/remotecluster/RemoteClusterSecurityRCS2FailureStoreRestIT.java	Adds tests for failure store access with RCS2 using the ::failures selector.
x-pack/plugin/security/qa/multi-cluster/src/javaRestTest/java/org/elasticsearch/xpack/remotecluster/RemoteClusterSecurityRCS1FailureStoreRestIT.java	Introduces tests for RCS1 scenarios including failure store permissions and access cases.
x-pack/plugin/security/qa/multi-cluster/src/javaRestTest/java/org/elasticsearch/xpack/remotecluster/AbstractRemoteClusterSecurityFailureStoreRestIT.java	Provides shared test functionality and setups for failure store based data streams and cluster configurations.
x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/privilege/IndexPrivilege.java	Updates privilege instantiation for READ_CROSS_CLUSTER and adjusts selector resolution logic to include ALL selector privileges.
x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/role/RoleDescriptorRequestValidator.java	Removes explicit failure store privilege validation and relies on the updated privilege resolution.
x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/apikey/CrossClusterApiKeyRoleDescriptorBuilder.java	Expands indices privilege names to include read_failure_store for improved CCS API key role definitions.
server/src/test/java/org/elasticsearch/cluster/metadata/SelectorResolverTests.java	Extends tests to confirm proper resolution of the ::failures selector syntax.

Comments suppressed due to low confidence (2)

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/privilege/IndexPrivilege.java:390

• Please verify that privileges with the selector 'ALL' are intentionally added to both failureSelectorAccessPrivileges and dataSelectorAccessPrivileges, as this change may affect the access control behavior.

else if (indexPrivilege.selectorPredicate == IndexComponentSelectorPredicate.ALL) {

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/apikey/CrossClusterApiKeyRoleDescriptorBuilder.java:33

• [nitpick] Double-check that all downstream consumers of CCS_INDICES_PRIVILEGE_NAMES properly support the newly added 'read_failure_store' privilege to ensure consistent behavior.

public static final String[] CCS_INDICES_PRIVILEGE_NAMES = { "read", "read_cross_cluster", "view_index_metadata", "read_failure_store" };