• Create ticket/issue

Follow the guide to enable codebase context checks.

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status:
Insufficient auditing: The change adds informational logging for node failures but does not constitute
comprehensive audit logging of critical actions with user context, which may be outside
this component’s scope.

    logger.atInfo().withThrowable(failure).log("node {} failed to run deprecation checks", failure.nodeId());
}

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status:
Exception exposure: Logging at info with the throwable for node failures may include stack traces or internal
details that could leak if logs are user-visible, though likely intended for internal
logs.

    logger.atInfo().withThrowable(failure).log("node {} failed to run deprecation checks", failure.nodeId());
}

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status:
Throwable logging: The new structured log includes the full throwable which could contain sensitive internal
details; no evidence of redaction is shown in the diff.

    logger.atInfo().withThrowable(failure).log("node {} failed to run deprecation checks", failure.nodeId());
}

Learn more about managing compliance generic rules or creating your own custom rules

The PR's fix overcorrects by passing unfiltered node settings to all deprecation
checks, thereby ignoring the skip_deprecations configuration. This reintroduces
previously suppressed warnings, causing a functional regression.

Examples:

        List<DeprecationIssue> issues = new ArrayList<>();
        for (NodeDeprecationChecks.NodeDeprecationCheck<
            Settings,
            PluginsAndModules,
            ClusterState,
            XPackLicenseState,
            DeprecationIssue> c : nodeSettingsChecks) {
            DeprecationIssue deprecationIssue = c.apply(settings, pluginsService.info(), filteredClusterState, licenseState);
            if (deprecationIssue != null) {
                issues.add(deprecationIssue);

 ... (clipped 2 lines)

Solution Walkthrough:

Before:

class TransportNodeDeprecationCheckAction {
    NodeResponse nodeOperation(...) {
        // Settings are filtered based on 'skip_deprecations'
        Settings filteredNodeSettings = settings.filter(...);
        
        // All checks use the filtered settings
        List<DeprecationIssue> issues = nodeSettingsChecks.stream()
            .map(c -> c.apply(filteredNodeSettings, ...))
            .toList();

        // Watermark check also uses filtered settings, which was the bug
        DeprecationIssue watermarkIssue = checkDiskLowWatermark(
            filteredNodeSettings, ...
        );
        ...
    }
}

After:

class TransportNodeDeprecationCheckAction {
    NodeResponse nodeOperation(...) {
        // 'filteredNodeSettings' is calculated but no longer used for checks
        Settings filteredNodeSettings = settings.filter(...);

        // All checks now incorrectly use the original, unfiltered settings
        for (NodeDeprecationCheck c : nodeSettingsChecks) {
            DeprecationIssue issue = c.apply(settings, ...); // BUG: should use filtered settings
            ...
        }

        // Watermark check correctly uses unfiltered settings
        DeprecationIssue watermarkIssue = checkDiskLowWatermark(
            settings, ...
        );
        ...
    }
}

Use the unfiltered clusterService.state() instead of filteredClusterState for
deprecation checks to ensure all cluster-level deprecations are detected.
Filtering of skipped deprecations should be performed on the resulting list of
issues.

x-pack/plugin/deprecation/src/main/java/org/elasticsearch/xpack/deprecation/TransportNodeDeprecationCheckAction.java [124-144]

-Metadata metadata = clusterService.state().metadata();
-Settings transientSettings = metadata.transientSettings()
-    .filter(setting -> Regex.simpleMatch(skipTheseDeprecations, setting) == false);
-Settings persistentSettings = metadata.persistentSettings()
-    .filter(setting -> Regex.simpleMatch(skipTheseDeprecations, setting) == false);
-ClusterState filteredClusterState = ClusterState.builder(clusterService.state())
-    .metadata(Metadata.builder(metadata).transientSettings(transientSettings).persistentSettings(persistentSettings).build())
-    .build();
-
 List<DeprecationIssue> issues = new ArrayList<>();
 for (NodeDeprecationChecks.NodeDeprecationCheck<
     Settings,
     PluginsAndModules,
     ClusterState,
     XPackLicenseState,
     DeprecationIssue> c : nodeSettingsChecks) {
-    DeprecationIssue deprecationIssue = c.apply(settings, pluginsService.info(), filteredClusterState, licenseState);
+    DeprecationIssue deprecationIssue = c.apply(settings, pluginsService.info(), clusterService.state(), licenseState);
     if (deprecationIssue != null) {
         issues.add(deprecationIssue);
     }
 }
+issues.removeIf(issue -> Regex.simpleMatch(skipTheseDeprecations, issue.getDetails()));

[To ensure code accuracy, apply this suggestion manually]

Consolidate redundant failure logging by removing the summary WARN log and the
loop of INFO logs. Instead, log each failure once at the WARN level with its
stack trace.

x-pack/plugin/deprecation/src/main/java/org/elasticsearch/xpack/deprecation/NodeDeprecationChecker.java [48-56]

 if (response.hasFailures()) {
-    List<String> failedNodeIds = response.failures()
-        .stream()
-        .map(failure -> failure.nodeId() + ": " + failure.getMessage())
-        .collect(Collectors.toList());
-    logger.warn("nodes failed to run deprecation checks: {}", failedNodeIds);
     for (FailedNodeException failure : response.failures()) {
-        logger.atInfo().withThrowable(failure).log("node {} failed to run deprecation checks", failure.nodeId());
+        logger.atWarn()
+            .withThrowable(failure)
+            .log("node {} failed to run deprecation checks", failure.nodeId());
     }
 }

[To ensure code accuracy, apply this suggestion manually]