Deprecate security implicitly disabled on trial/basic #72339
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| [[migrating-7.14]] | ||
| == Migrating to 7.14 | ||
| ++++ | ||
| <titleabbrev>7.14</titleabbrev> | ||
| ++++ | ||
|
|
||
| This section discusses the changes that you need to be aware of when migrating | ||
| your application to {es} 7.14. | ||
|
|
||
| See also <<release-highlights>> and <<es-release-notes>>. | ||
|
|
||
| // * <<breaking_714_blah_changes>> | ||
| // * <<breaking_714_blah_changes>> | ||
|
|
||
| //NOTE: The notable-breaking-changes tagged regions are re-used in the | ||
| //Installation and Upgrade Guide | ||
|
|
||
| //tag::notable-breaking-changes[] | ||
|
|
||
| [discrete] | ||
| [[breaking-changes-7.14]] | ||
| === Breaking changes | ||
|
|
||
| The following changes in {es} 7.14 might affect your applications | ||
| and prevent them from operating normally. | ||
| Before upgrading to 7.14, review these changes and take the described steps | ||
| to mitigate the impact. | ||
|
|
||
| NOTE: Breaking changes introduced in minor versions are | ||
| normally limited to security and bug fixes. | ||
| Significant changes in behavior are deprecated in a minor release and | ||
| the old behavior is supported until the next major release. | ||
| To find out if you are using any deprecated functionality, | ||
| enable <<deprecation-logging, deprecation logging>>. | ||
|
|
||
| [discrete] | ||
| [[breaking_714_security_changes]] | ||
| ==== Security deprecations | ||
|
|
||
| [[implicitly-disabled-security]] | ||
| Currently, security features are disabled when operating on a basic or trial | ||
| license when `xpack.security.enabled` has not been explicitly set to `true`. | ||
|
|
||
| This behavior is now deprecated. In version 8.0.0, security features will be | ||
| enabled by default for all licenses, unless explicitly disabled (by setting | ||
| `xpack.security.enabled` to `false`). | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -7,6 +7,7 @@ | |||||
|
|
||||||
| package org.elasticsearch.xpack.deprecation; | ||||||
|
|
||||||
| import org.elasticsearch.Version; | ||||||
| import org.elasticsearch.action.admin.cluster.node.info.PluginsAndModules; | ||||||
| import org.elasticsearch.bootstrap.JavaVersion; | ||||||
| import org.elasticsearch.cluster.node.DiscoveryNode; | ||||||
|
|
@@ -18,11 +19,14 @@ | |||||
| import org.elasticsearch.common.util.concurrent.EsExecutors; | ||||||
| import org.elasticsearch.common.util.set.Sets; | ||||||
| import org.elasticsearch.env.Environment; | ||||||
| import org.elasticsearch.license.License; | ||||||
| import org.elasticsearch.license.XPackLicenseState; | ||||||
| import org.elasticsearch.node.Node; | ||||||
| import org.elasticsearch.node.NodeRoleSettings; | ||||||
| import org.elasticsearch.script.ScriptService; | ||||||
| import org.elasticsearch.threadpool.FixedExecutorBuilder; | ||||||
| import org.elasticsearch.transport.RemoteClusterService; | ||||||
| import org.elasticsearch.xpack.core.XPackSettings; | ||||||
| import org.elasticsearch.xpack.core.deprecation.DeprecationIssue; | ||||||
| import org.elasticsearch.xpack.core.security.authc.RealmConfig; | ||||||
| import org.elasticsearch.xpack.core.security.authc.RealmSettings; | ||||||
|
|
@@ -40,7 +44,8 @@ | |||||
|
|
||||||
| class NodeDeprecationChecks { | ||||||
|
|
||||||
| static DeprecationIssue checkPidfile(final Settings settings, final PluginsAndModules pluginsAndModules, | ||||||
| XPackLicenseState licenseState) { | ||||||
| return checkDeprecatedSetting( | ||||||
| settings, | ||||||
| pluginsAndModules, | ||||||
|
|
@@ -49,7 +54,8 @@ static DeprecationIssue checkPidfile(final Settings settings, final PluginsAndMo | |||||
| "https://www.elastic.co/guide/en/elasticsearch/reference/7.4/breaking-changes-7.4.html#deprecate-pidfile"); | ||||||
| } | ||||||
|
|
||||||
| static DeprecationIssue checkProcessors(final Settings settings , final PluginsAndModules pluginsAndModules, | ||||||
| final XPackLicenseState licenseState) { | ||||||
| return checkDeprecatedSetting( | ||||||
| settings, | ||||||
| pluginsAndModules, | ||||||
|
|
@@ -58,7 +64,8 @@ static DeprecationIssue checkProcessors(final Settings settings , final PluginsA | |||||
| "https://www.elastic.co/guide/en/elasticsearch/reference/7.4/breaking-changes-7.4.html#deprecate-processors"); | ||||||
| } | ||||||
|
|
||||||
| static DeprecationIssue checkMissingRealmOrders(final Settings settings, final PluginsAndModules pluginsAndModules, | ||||||
| final XPackLicenseState licenseState) { | ||||||
| final Set<String> orderNotConfiguredRealms = RealmSettings.getRealmSettings(settings).entrySet() | ||||||
| .stream() | ||||||
| .filter(e -> false == e.getValue().hasValue(RealmSettings.ORDER_SETTING_KEY)) | ||||||
|
|
@@ -82,7 +89,8 @@ static DeprecationIssue checkMissingRealmOrders(final Settings settings, final P | |||||
| ); | ||||||
| } | ||||||
|
|
||||||
| static DeprecationIssue checkUniqueRealmOrders(final Settings settings, final PluginsAndModules pluginsAndModules, | ||||||
| final XPackLicenseState licenseState) { | ||||||
| final Map<String, List<String>> orderToRealmSettings = | ||||||
| RealmSettings.getRealmSettings(settings).entrySet() | ||||||
| .stream() | ||||||
|
|
@@ -115,7 +123,28 @@ static DeprecationIssue checkUniqueRealmOrders(final Settings settings, final Pl | |||||
| ); | ||||||
| } | ||||||
|
|
||||||
| static DeprecationIssue checkImplicitlyDisabledSecurityOnBasicAndTrial(final Settings settings, | ||||||
| final PluginsAndModules pluginsAndModules, | ||||||
| final XPackLicenseState licenseState) { | ||||||
| if ( settings.hasValue(XPackSettings.SECURITY_ENABLED.getKey()) == false | ||||||
|
There was a problem hiding this comment. Any reason not to do:
Suggested change
There was a problem hiding this comment. Not really. The former ends up doing a |
||||||
| && (licenseState.getOperationMode().equals(License.OperationMode.BASIC) | ||||||
| || licenseState.getOperationMode().equals(License.OperationMode.TRIAL))) { | ||||||
| String details = "The behavior where the value of [xpack.security.enabled] setting is false for " + | ||||||
| licenseState.getOperationMode() + " licenses is deprecated and will be changed in a future version." + | ||||||
| "See https://www.elastic.co/guide/en/elasticsearch/reference/" + Version.CURRENT.major + "." + | ||||||
| Version.CURRENT.minor + "/security-minimal-setup.html to enable security, or explicitly disable security by " + | ||||||
| "setting [xpack.security.enabled] to false in elasticsearch.yml"; | ||||||
| return new DeprecationIssue( | ||||||
| DeprecationIssue.Level.WARNING, | ||||||
|
There was a problem hiding this comment. Why did we decide On the one hand, people who don't resolve this will have a terrible time during (or immediately after) upgrade. There was a problem hiding this comment. I can be definitely swayed. The way I read It will probably matter a lot how this is surfaced in the upgrade assistant though and if warning is something users are allowed to click through while upgrading, we should make this CRITICAL. Thank for raising this There was a problem hiding this comment. I suspect we can revisit this during the final 8.0 upgrade preparations and make sure it's presenting well to the user. |
||||||
| "Security is enabled by default for all licenses in the next major version.", | ||||||
| "https://www.elastic.co/guide/en/elasticsearch/reference/7.14/deprecated-7.14.html#implicitly-disabled-security", | ||||||
|
There was a problem hiding this comment.
Suggested change
There was a problem hiding this comment. See this preview link for the complete URL: https://elasticsearch_72339.docs-preview.app.elstc.co/guide/en/elasticsearch/reference/7.x/migrating-7.14.html#implicitly-disabled-security |
||||||
| details); | ||||||
| } | ||||||
| return null; | ||||||
| } | ||||||
|
|
||||||
| static DeprecationIssue checkImplicitlyDisabledBasicRealms(final Settings settings, final PluginsAndModules pluginsAndModules, | ||||||
| final XPackLicenseState licenseState) { | ||||||
| final Map<RealmConfig.RealmIdentifier, Settings> realmSettings = RealmSettings.getRealmSettings(settings); | ||||||
| if (realmSettings.isEmpty()) { | ||||||
| return null; | ||||||
|
|
@@ -185,7 +214,8 @@ private static DeprecationIssue checkThreadPoolListenerSetting(final String name | |||||
| "https://www.elastic.co/guide/en/elasticsearch/reference/7.x/breaking-changes-7.7.html#deprecate-listener-thread-pool"); | ||||||
| } | ||||||
|
|
||||||
| public static DeprecationIssue checkClusterRemoteConnectSetting(final Settings settings, final PluginsAndModules pluginsAndModules, | ||||||
| final XPackLicenseState licenseState) { | ||||||
| return checkDeprecatedSetting( | ||||||
| settings, | ||||||
| pluginsAndModules, | ||||||
|
|
@@ -199,7 +229,8 @@ public static DeprecationIssue checkClusterRemoteConnectSetting(final Settings s | |||||
| ); | ||||||
| } | ||||||
|
|
||||||
| public static DeprecationIssue checkNodeLocalStorageSetting(final Settings settings, final PluginsAndModules pluginsAndModules, | ||||||
| final XPackLicenseState licenseState) { | ||||||
| return checkRemovedSetting( | ||||||
| settings, | ||||||
| Node.NODE_LOCAL_STORAGE_SETTING, | ||||||
|
|
@@ -215,7 +246,8 @@ public static DeprecationIssue checkNodeBasicLicenseFeatureEnabledSetting(final | |||||
| ); | ||||||
| } | ||||||
|
|
||||||
| public static DeprecationIssue checkGeneralScriptSizeSetting(final Settings settings, final PluginsAndModules pluginsAndModules, | ||||||
| final XPackLicenseState licenseState) { | ||||||
| return checkDeprecatedSetting( | ||||||
| settings, | ||||||
| pluginsAndModules, | ||||||
|
|
@@ -226,7 +258,8 @@ public static DeprecationIssue checkGeneralScriptSizeSetting(final Settings sett | |||||
| ); | ||||||
| } | ||||||
|
|
||||||
| public static DeprecationIssue checkGeneralScriptExpireSetting(final Settings settings, final PluginsAndModules pluginsAndModules, | ||||||
| final XPackLicenseState licenseState) { | ||||||
| return checkDeprecatedSetting( | ||||||
| settings, | ||||||
| pluginsAndModules, | ||||||
|
|
@@ -237,7 +270,8 @@ public static DeprecationIssue checkGeneralScriptExpireSetting(final Settings se | |||||
| ); | ||||||
| } | ||||||
|
|
||||||
| public static DeprecationIssue checkGeneralScriptCompileSettings(final Settings settings, final PluginsAndModules pluginsAndModules, | ||||||
| final XPackLicenseState licenseState) { | ||||||
| return checkDeprecatedSetting( | ||||||
| settings, | ||||||
| pluginsAndModules, | ||||||
|
|
@@ -365,7 +399,7 @@ static DeprecationIssue checkRemovedSetting(final Settings settings, final Setti | |||||
| return new DeprecationIssue(DeprecationIssue.Level.CRITICAL, message, url, details); | ||||||
| } | ||||||
|
|
||||||
| static DeprecationIssue javaVersionCheck(Settings nodeSettings, PluginsAndModules plugins, final XPackLicenseState licenseState) { | ||||||
| final JavaVersion javaVersion = JavaVersion.current(); | ||||||
|
|
||||||
| if (javaVersion.compareTo(JavaVersion.parse("11")) < 0) { | ||||||
|
|
@@ -379,7 +413,8 @@ static DeprecationIssue javaVersionCheck(Settings nodeSettings, PluginsAndModule | |||||
| return null; | ||||||
| } | ||||||
|
|
||||||
| static DeprecationIssue checkMultipleDataPaths(final Settings nodeSettings, final PluginsAndModules pluginsAndModules, | ||||||
| final XPackLicenseState licenseState) { | ||||||
| List<String> dataPaths = Environment.PATH_DATA_SETTING.get(nodeSettings); | ||||||
| if (dataPaths.size() > 1) { | ||||||
| return new DeprecationIssue(DeprecationIssue.Level.CRITICAL, | ||||||
|
|
@@ -390,7 +425,8 @@ static DeprecationIssue checkMultipleDataPaths(Settings nodeSettings, PluginsAnd | |||||
| return null; | ||||||
| } | ||||||
|
|
||||||
| static DeprecationIssue checkDataPathsList(final Settings nodeSettings, final PluginsAndModules pluginsAndModules, | ||||||
| final XPackLicenseState licenseState) { | ||||||
| if (Environment.dataPathUsesList(nodeSettings)) { | ||||||
| return new DeprecationIssue(DeprecationIssue.Level.CRITICAL, | ||||||
| "[path.data] in a list is deprecated, use a string value", | ||||||
|
|
||||||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This collapsible format isn't required, but I think it's nice to separate the text from the main header, especially when linking to this specific section. See the Mapping changes section in 7.13 for an example of how this formatting renders.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I like this but the title might confuse folks as something we're doing in 7.14( if they don't click to expand the collapsible ). How does "The default behavior of disabling security on basic and trial licenses is deprecated" sound as a title instead @lockewritesdocs ?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
👍 works for me @jkakavas