update read access to specific indices

[fen-qin]

Description

For AOS 3.3, search relevance workbench will support OpenSearch Dashboards visualization which requires direct access to "search-relevance-experiment-results". Update the read_access to allowlist the index permission.

Issues Resolved

• Use Dashboards to visualize results of Evaluation and Hybrid Experiments dashboards-search-relevance#570

Is this a backport? If so, please add backport PR # and/or commits #, and remove backport-failed label from the original PR.

• no, this change is for AOS 3.3, no backport needed

Do these changes introduce new permission(s) to be displayed in the static dropdown on the front-end? If so, please open a draft PR in the security dashboards plugin and link the draft PR here

Testing

• spin up local cluster with security enabled
• create internal user

curl -k -X PUT "https://localhost:9200/_plugins/_security/api/internalusers/mfenqin_readaccess" \
  -u admin:MyStrongPassword123! \
  -H 'Content-Type: application/json' \
  -d '{
    "password": "ReadAccess123!",
    "backend_roles": [],
    "attributes": {}
  }'

• create a role with updated index permission

curl -k -X PUT "https://localhost:9200/_plugins/_security/api/roles/search_relevance_read_access_enhanced" \
  -u admin:MyStrongPassword123! \
  -H 'Content-Type: application/json' \
  -d '{
    "cluster_permissions": [
      "cluster:admin/opensearch/search_relevance/experiment/get",
      "cluster:admin/opensearch/search_relevance/judgment/get",
      "cluster:admin/opensearch/search_relevance/queryset/get",
      "cluster:admin/opensearch/search_relevance/search_configuration/get"
    ],
    "index_permissions": [
      {
        "index_patterns": ["search-relevance-*"],
        "allowed_actions": [
          "indices:admin/mappings/get",
          "indices:data/read/search*",
          "indices:data/read/get*"
        ]
      }
    ]
  }'

• create role mapping to assign the role to the new user

curl -k -X PUT "https://localhost:9200/_plugins/_security/api/rolesmapping/search_relevance_read_access_enhanced" \
  -u admin:MyStrongPassword123! \
  -H 'Content-Type: application/json' \
  -d '{
    "users": ["mfenqin_readaccess"]
  }'

• screeshot, able to access OpenSearch Dashboards with mfenqin_readaccess role

Check List

• New functionality includes testing
• New functionality has been documented
• New Roles/Permissions have a corresponding security dashboards plugin PR
• API changes companion pull request created
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.07%. Comparing base (ac718cc) to head (d218884).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5590      +/-   ##
==========================================
- Coverage   73.12%   73.07%   -0.05%     
==========================================
  Files         408      408              
  Lines       25262    25262              
  Branches     3843     3843              
==========================================
- Hits        18473    18461      -12     
- Misses       4922     4935      +13     
+ Partials     1867     1866       -1     

see 8 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cwperks]

@fen-qin please fix the code hygiene failures by ensuring that permissions are ordered alphabetically.

[fen-qin]

@fen-qin please fix the code hygiene failures by ensuring that permissions are ordered alphabetically.

@cwperks, tried to fix the style and ordering issue by running the following commands:

• node check-permissions-order.js ./config/roles.yml --fix
• ./gradlew :spotlessApply
  would you like to take a look again ? CI workflows failed but I don't think they are related to config changes.

[RyanL1997]

CI failures are caused by the disabling the old sonatype repo. SQL repo is also facing the same issue.

[RyanL1997]

actually, it looks like the artifact server is unintentionally down

[cwperks]

I'll raise a PR to remove old sonatype from maven repo options