joe comments

Author: szybia

server/src/main/java/org/elasticsearch/TransportVersions.java

@@ -334,6 +334,7 @@ static TransportVersion def(int id) {
     public static final TransportVersion INFERENCE_REQUEST_ADAPTIVE_RATE_LIMITING_REMOVED = def(9_164_0_00);
     public static final TransportVersion SEARCH_SOURCE_EXCLUDE_INFERENCE_FIELDS_PARAM = def(9_165_0_00);
     public static final TransportVersion INFERENCE_RESULTS_MAP_WITH_CLUSTER_ALIAS = def(9_166_0_00);
+    public static final TransportVersion SECURITY_STATS_ENDPOINT = def(9_167_0_00);
 
     /*
      * STOP! READ THIS FIRST! No, really,

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/stats/GetSecurityStatsNodeRequest.java

@@ -7,6 +7,7 @@
 
 package org.elasticsearch.xpack.core.security.action.stats;
 
+import org.elasticsearch.TransportVersions;
 import org.elasticsearch.common.io.stream.StreamInput;
 import org.elasticsearch.common.io.stream.StreamOutput;
 import org.elasticsearch.transport.AbstractTransportRequest;
@@ -23,6 +24,9 @@ public GetSecurityStatsNodeRequest(final StreamInput in) throws IOException {
 
     @Override
     public void writeTo(final StreamOutput out) throws IOException {
+        if (out.getTransportVersion().before(TransportVersions.SECURITY_STATS_ENDPOINT)) { // shouldn't happen
+            throw new UnsupportedOperationException("node doesn't support security stats endpoint");
+        }
         super.writeTo(out);
     }
 }

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/Security.java

@@ -1828,7 +1828,7 @@ public List<RestHandler> getRestHandlers(
             new RestDisableProfileAction(settings, getLicenseState()),
             new RestGetSecuritySettingsAction(settings, getLicenseState()),
             new RestUpdateSecuritySettingsAction(settings, getLicenseState()),
-            new RestSecurityStatsAction(settings, getLicenseState())
+            new RestSecurityStatsAction(settings, getLicenseState(), clusterSupportsFeature)
         ).filter(Objects::nonNull).toList();
     }
 

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/SecurityFeatures.java

@@ -16,7 +16,7 @@
 
 public class SecurityFeatures implements FeatureSpecification {
 
-    private static final NodeFeature SECURITY_STATS_ENDPOINT = new NodeFeature("security_stats_endpoint");
+    public static final NodeFeature SECURITY_STATS_ENDPOINT = new NodeFeature("security_stats_endpoint");
 
     @Override
     public Set<NodeFeature> getFeatures() {

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/rest/action/stats/RestSecurityStatsAction.java

@@ -8,24 +8,32 @@
 
 import org.elasticsearch.client.internal.node.NodeClient;
 import org.elasticsearch.common.settings.Settings;
+import org.elasticsearch.features.NodeFeature;
 import org.elasticsearch.license.XPackLicenseState;
 import org.elasticsearch.rest.RestRequest;
 import org.elasticsearch.rest.Scope;
 import org.elasticsearch.rest.ServerlessScope;
 import org.elasticsearch.rest.action.RestToXContentListener;
 import org.elasticsearch.xpack.core.security.action.stats.GetSecurityStatsAction;
 import org.elasticsearch.xpack.core.security.action.stats.GetSecurityStatsNodesRequest;
+import org.elasticsearch.xpack.security.SecurityFeatures;
 import org.elasticsearch.xpack.security.rest.action.SecurityBaseRestHandler;
 
 import java.util.List;
+import java.util.function.Predicate;
 
 import static org.elasticsearch.rest.RestRequest.Method.GET;
 
 @ServerlessScope(Scope.INTERNAL)
 public class RestSecurityStatsAction extends SecurityBaseRestHandler {
 
-    public RestSecurityStatsAction(final Settings settings, final XPackLicenseState licenseState) {
+    private final Predicate<NodeFeature> clusterSupportsFeature;
+
+    public RestSecurityStatsAction(final Settings settings,
+                                   final XPackLicenseState licenseState,
+                                   final Predicate<NodeFeature> clusterSupportsFeature) {
         super(settings, licenseState);
+        this.clusterSupportsFeature = clusterSupportsFeature;
     }
 
     @Override
@@ -40,6 +48,9 @@ public String getName() {
 
     @Override
     public RestChannelConsumer innerPrepareRequest(final RestRequest request, final NodeClient client) {
+        if (clusterSupportsFeature.test(SecurityFeatures.SECURITY_STATS_ENDPOINT) == false) {
+            throw new IllegalArgumentException("endpoint not supported on all nodes in the cluster");
+        }
         final var req = new GetSecurityStatsNodesRequest();
         return channel -> client.execute(GetSecurityStatsAction.INSTANCE, req, new RestToXContentListener<>(channel));
     }