Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add documentation for security config upgrade feature #6634

Merged
merged 24 commits into from
Mar 27, 2024

Conversation

peternied
Copy link
Member

@peternied peternied commented Mar 8, 2024

Description

Adds documentation for the new security feature to upgrade configurations based on the default config files bundled with the security plugin

Issues Resolved

Checklist

  • By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and subject to the Developers Certificate of Origin.
    For more information on following Developer Certificate of Origin and signing off your commits, please check here.

@Naarcha-AWS Naarcha-AWS self-assigned this Mar 8, 2024
@Naarcha-AWS Naarcha-AWS added Blocked PR: Cannot move forward without assistance 4 - Doc review PR: Doc review in progress v-TBD and removed Blocked PR: Cannot move forward without assistance labels Mar 8, 2024
@hdhalter hdhalter added v2.13.0 and removed v-TBD labels Mar 11, 2024
@hdhalter
Copy link
Contributor

Thanks, @peternied! Can you please address the Vale errors prior to the doc review? Thanks.

@hdhalter hdhalter added the release-notes PR: Include this PR in the automated release notes label Mar 13, 2024
Copy link
Member

@cwperks cwperks left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @peternied. Left a few comments.

_security/access-control/api.md Outdated Show resolved Hide resolved
_security/access-control/api.md Outdated Show resolved Hide resolved
_security/access-control/api.md Outdated Show resolved Hide resolved
_security/access-control/api.md Outdated Show resolved Hide resolved
@Naarcha-AWS Naarcha-AWS added 3 - Tech review PR: Tech review in progress and removed 4 - Doc review PR: Doc review in progress labels Mar 21, 2024
Copy link
Member

@cwperks cwperks left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@peternied I left 2 comments, but otherwise this looks good to me and can go for editorial review.

Copy link
Member

@DarshitChanpura DarshitChanpura left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left a couple of comments. Looks good to me otherwise.

_security/access-control/api.md Outdated Show resolved Hide resolved
_security/access-control/api.md Outdated Show resolved Hide resolved
peternied and others added 2 commits March 26, 2024 11:45
@Naarcha-AWS Naarcha-AWS added 4 - Doc review PR: Doc review in progress and removed 3 - Tech review PR: Tech review in progress labels Mar 26, 2024
@Naarcha-AWS Naarcha-AWS added 5 - Editorial review PR: Editorial review in progress and removed 4 - Doc review PR: Doc review in progress labels Mar 26, 2024
Copy link
Collaborator

@natebower natebower left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@peternied @Naarcha-AWS Please see my comments and changes, particularly my comment on line 1305, and let me know if you have any questions. Thanks!

_security/access-control/api.md Outdated Show resolved Hide resolved
Introduced 2.13
{: .label .label-purple }

Checks the cuurent configuration bundled with the host's Security plugin and compares it to the latest Security plugin bundled with OpenSearch. Then, the API returns whether or not can be performed and what resources can be updated.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There appear to be some words missing in the second sentence.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Original text: Checks the configuration bundled with the Security plugin against the existing security configuration, returns if an upgrade can be performed and what resources would be updated.

Here is a diagram of what the actual flow / comparisons are. (Thanks ChatGPT!)

sequenceDiagram
    participant U as User
    participant D as Configuration on Disk
    participant S as SecurityPlugin
    participant M as Configuration in SecurityPlugin Memory
    U->>+S: API Call to Check Configuration
    S->>+D: Retrieve Current Configuration from Disk
    D-->>-S: Current Disk Configuration
    S->>+M: Check Configuration in Memory
    M-->>-S: Current in Memory Configuration
    S->>S: Compare Configurations
    alt Configurations Match
        S-->>U: No Update Needed
    else Configurations Do Not Match
        S->>S: Determine Resources for Update
        S-->>U: Update Can be Performed, List resources to Update
    end

Loading

Copy link
Member Author

@peternied peternied Mar 26, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@natebower I feel like that original text might be a better starting point, but let me know if you'd like me to workshop it more

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@peternied: I think I'm confused as to what you mean by "bundled"? When I hear bundled, I assume the API is checking for upgrades either against the upstream instance (The newest artifact) or the version the artifact the user downloaded. But, if the user has to download a new artifact for the latest Security Plugin information to persist in memory, isn't there a step we're missing in the documentation then?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I mean the version the artifact the user downloaded.

This API is for after an upgrade was performed, such as a Rolling Upgrade.

Note; I think this highlights another part of the documentation that I should include 'now that you've upgraded you can [optionally] upgrade the security configuration via this API' which links to this documentation

_security/access-control/api.md Outdated Show resolved Hide resolved
_security/access-control/api.md Outdated Show resolved Hide resolved
_security/access-control/api.md Outdated Show resolved Hide resolved

Adds and updates resources on a host's existing security configuration from the configuration bundled with the latest version of the Security plugin.

These bundled configuration files can be found in the `<OPENSEARCH_HOME>/security/config` directory. Default configuration files are updated on OpenSearch upgrade, whereas the cluster configuration is only updated by the cluster operators. This endpoint helps cluster operators upgrade missing defaults and stale defaults definitions.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"cluster operator" (singular)?

_security/access-control/api.md Outdated Show resolved Hide resolved
_security/access-control/api.md Outdated Show resolved Hide resolved
_security/access-control/api.md Outdated Show resolved Hide resolved
Co-authored-by: Nathan Bower <[email protected]>
Signed-off-by: Naarcha-AWS <[email protected]>
@Naarcha-AWS Naarcha-AWS merged commit 6f862fa into opensearch-project:main Mar 27, 2024
3 checks passed
@peternied peternied deleted the security-upgrade branch March 27, 2024 20:26
@hdhalter hdhalter added 3 - Done Issue is done/complete and removed 5 - Editorial review PR: Editorial review in progress labels Mar 29, 2024
peternied added a commit to peternied/documentation-website that referenced this pull request Apr 15, 2024
hdhalter pushed a commit that referenced this pull request Apr 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
3 - Done Issue is done/complete release-notes PR: Include this PR in the automated release notes v2.13.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[DOC] Add documentation for security configuration upgrade feature
6 participants