Add documentation for dynamic configuration of tenancy in Dashboards #3694

cwillum · 2023-04-06T00:23:17Z

Description

This adds documentation for dynamic configuration of certain tenancy features including enabling or disabling tenancy, disabling or enabling private tenants, and setting the default tenant for all users. The documentation also includes new APIs that provide another option for configuring the same dynamic settings.

Issues Resolved

Fixes #2562

Checklist

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and subject to the Developers Certificate of Origin.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: cwillum <[email protected]>

_security/multi-tenancy/dynamic-config.md

abhivka7 · 2023-04-19T05:13:16Z

_security/multi-tenancy/mt-agg-view.md

-* Finally, once the feature has been enabled and used in a test cluster, the feature cannot be disabled for the cluster. Disabling the feature once it has been used to work with tenants and saved objects can result in the loss of saved objects and have an impact on tenant-to-tenant functionality. 
+* Finally, once the feature has been enabled and used in a test cluster, the feature cannot be disabled for the cluster. Disabling the feature once it has been used to work with tenants and saved objects can result in the loss of saved objects and can have an impact on tenant-to-tenant functionality.
+
+  While aggregate view is enabled, a loss of saved objects and impact to tenant-to-tenant functionality can also occur when the larger multi-tenancy feature is disabled. This includes disabling multi-tenancy in the security `config.yml` file settings or by using dynamic configuration. Keep this in mind before enabling aggregate view for your test cluster.


@RyanL1997 I don't think there will be a loss of saved objects with respect to Aggregation view feature when multi-tenancy is disabled. Can you confirm?

@abhivka7 @RyanL1997 I understood that some changes needed to be made so that aggregate view was compatible with dynamic configuration. The result of those changes was that disabling multi-tenancy would also disable the aggregate view feature. And once both were disabled, it made the last bullet above a concern:
"Finally, once the feature has been enabled and used in a test cluster, the feature cannot be disabled for the cluster. ..."
Let's clarify this so I can make changes to the warning note if necessary. Thanks.

@cwillum Basically aggregation view is only shown when multitenancy is enabled. If we disable multitenancy then there is no point in showing aggregation view. So aggregation view as a feature in itself can not be disabled once it has been enabled. But it still needs multitenancy to be enabled as a pre-requisite.

Hi @abhivka7 and @cwillum . I will just move some of our conversation over here for references:

This potential risk / known limitation existed since the launch of the aggregation view feature, referencing to the previous documentation here (https://opensearch.org/docs/latest/security/multi-tenancy/mt-agg-view/#known-limitations):

Finally, once the feature has been enabled and used in a test cluster, the feature cannot be disabled for the cluster. Disabling the feature once it has been used to work with tenants and saved objects can result in the loss of saved objects and have an impact on tenant-to-tenant functionality.

According to the new feature of Dynamically Configurable Multi-tenancy, it didn't change any previous technical design of both aggregation view feature and tenancy feature. However, it does change some accessibility of multi-tenancy configuration. That's reason of @cwillum is helping us to summarizing and emphasizing some specific details of these potential user behaviors, so that we can warn user about the above risks even with a non-production environment

All in all, big thanks to both of you for the follow-ups. I think we have sorted everything clear.

Signed-off-by: cwillum <[email protected]>

RyanL1997

Hi @cwillum, thanks for putting this together! Your summary of these potential behaviors is clear and accurate.

RyanL1997 · 2023-04-20T21:05:26Z

_security/multi-tenancy/mt-agg-view.md

@@ -36,7 +36,7 @@ In this first experimental phase of development, there are some limitations that

 * The feature can only be used in a new cluster. At this time, the feature is not suported by clusters already in use.
 * Also, the feature should be used only in a test environment, not in production. 
-* Finally, once the feature has been enabled and used in a test cluster, the feature cannot be disabled for the cluster. Disabling the feature once it has been used to work with tenants and saved objects can result in the loss of saved objects and have an impact on tenant-to-tenant functionality. 
+* Finally, once the feature has been enabled and used in a test cluster, the feature cannot be disabled for the cluster. Disabling the feature once it has been used to work with tenants and saved objects can result in the loss of saved objects and can have an impact on tenant-to-tenant functionality. This can occur when disabling the feature in any one of three ways: disabling the aggregate view feature with the [feature flag]({{site.url}}{{site.baseurl}}/security/multi-tenancy/mt-agg-view/#enabling-aggregate-view-for-saved-objects/); disabling multi-tenancy with the traditional [multi-tenancy configuration]({{site.url}}{{site.baseurl}}/security/multi-tenancy/multi-tenancy-config/) setting; or disabling multi-tenancy with [dynamic configuration]({{site.url}}{{site.baseurl}}/security/multi-tenancy/dynamic-config/) settings.


This is correct! Thanks for summarizing this up! @cwillum

hdhalter

Looks good, Chris, with a couple of suggestions. Thanks!

hdhalter · 2023-04-20T21:29:44Z

_security/multi-tenancy/dynamic-config.md

+
+# Dynamic configuration in OpenSearch Dashboards
+
+Dynamic configuration of multi-tenancy in OpenSearch Dashboards provides options to make common settings for tenancy without having to make changes to the configuration YAML files on each node and then restart the cluster. You can take advantage of this functionality by using the Dashboards interface or the REST API. The following list includes description of the options currently covered by dynamic configuration:


Can we avoid making this into a feature by calling out the functionality? For example, "You can dynamically configure your multi-tenancy settings in OpenSearch Dashboards without making changes to the configuration YAML files on each note and then restarting the cluster."

I see your point. But I don't want to lead out a new section with "You can...". How about ...
"Multi-tenancy includes dynamic configuration options in OpenSearch Dashboards so you can make common settings for tenancy without having to make changes to the configuration YAML files on each node and then restart the cluster."
I've revised the sentence like so.

_security/multi-tenancy/dynamic-config.md

Signed-off-by: cwillum <[email protected]>

natebower

@cwillum Please see my comments and changes and let me know if you have any questions. Thanks!

_security/multi-tenancy/dynamic-config.md

_security/multi-tenancy/tenant-index.md

_security/multi-tenancy/multi-tenancy-config.md

Signed-off-by: cwillum <[email protected]>

cwillum

Thanks for the quick review.

_security/multi-tenancy/dynamic-config.md

_security/multi-tenancy/tenant-index.md

…3694) * fix#2562 start for dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 start for dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> --------- Signed-off-by: cwillum <[email protected]>

…hboards (#3694)" This reverts commit c490b20.

…3694) * fix#2562 start for dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 start for dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> --------- Signed-off-by: cwillum <[email protected]>

…hboards (#3694)" This reverts commit 144f668.

…pensearch-project#3694) * fix#2562 start for dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 start for dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> * fix#2562 dynamic config Signed-off-by: cwillum <[email protected]> --------- Signed-off-by: cwillum <[email protected]>

fix#2562 start for dynamic config

1473e58

Signed-off-by: cwillum <[email protected]>

cwillum added dashboards API 2 - In progress Issue/PR: The issue or PR is in progress. security release-notes PR: Include this PR in the automated release notes v2.7.0 labels Apr 6, 2023

cwillum requested a review from a team as a code owner April 6, 2023 00:23

cwillum self-assigned this Apr 6, 2023

cwillum added 6 commits April 7, 2023 14:05

fix#2562 start for dynamic config

f7cdb21

Signed-off-by: cwillum <[email protected]>

Merge branch 'main' into fix#2562-dynamic-config-tenants

90dbcf9

fix#2562 dynamic config

b4ca353

Signed-off-by: cwillum <[email protected]>

fix#2562 dynamic config

c13e4a7

Signed-off-by: cwillum <[email protected]>

fix#2562 dynamic config

4002722

Signed-off-by: cwillum <[email protected]>

fix#2562 dynamic config

5ee3cf7

Signed-off-by: cwillum <[email protected]>

abhivka7 reviewed Apr 19, 2023

View reviewed changes

_security/multi-tenancy/dynamic-config.md Outdated Show resolved Hide resolved

abhivka7 reviewed Apr 19, 2023

View reviewed changes

_security/multi-tenancy/dynamic-config.md Outdated Show resolved Hide resolved

abhivka7 reviewed Apr 19, 2023

View reviewed changes

cwillum added 5 commits April 19, 2023 18:58

fix#2562 dynamic config

831a8e4

Signed-off-by: cwillum <[email protected]>

fix#2562 dynamic config

74685ed

Signed-off-by: cwillum <[email protected]>

fix#2562 dynamic config

b0283d8

Signed-off-by: cwillum <[email protected]>

fix#2562 dynamic config

ba61e63

Signed-off-by: cwillum <[email protected]>

fix#2562 dynamic config

5187687

Signed-off-by: cwillum <[email protected]>

RyanL1997 approved these changes Apr 20, 2023

View reviewed changes

hdhalter approved these changes Apr 20, 2023

View reviewed changes

fix#2562 dynamic config

b6ad513

Signed-off-by: cwillum <[email protected]>

ariamarble approved these changes Apr 21, 2023

View reviewed changes

cwillum added 3 commits April 21, 2023 09:06

fix#2562 dynamic config

045e310

Signed-off-by: cwillum <[email protected]>

fix#2562 dynamic config

f9f31e1

Signed-off-by: cwillum <[email protected]>

fix#2562 dynamic config

37b0e37

Signed-off-by: cwillum <[email protected]>

natebower reviewed Apr 21, 2023

View reviewed changes

cwillum added 2 commits April 21, 2023 12:45

fix#2562 dynamic config

966668f

Signed-off-by: cwillum <[email protected]>

fix#2562 dynamic config

31224bb

Signed-off-by: cwillum <[email protected]>

cwillum commented Apr 21, 2023

View reviewed changes

cwillum removed the 2 - In progress Issue/PR: The issue or PR is in progress. label Apr 21, 2023

cwillum merged commit e3c6bbd into main Apr 21, 2023

vagimeli added a commit that referenced this pull request Apr 25, 2023

Revert "Add documentation for dynamic configuration of tenancy in Das…

1a46c3b

…hboards (#3694)" This reverts commit c490b20.

vagimeli added a commit that referenced this pull request May 4, 2023

Revert "Add documentation for dynamic configuration of tenancy in Das…

9cd5947

…hboards (#3694)" This reverts commit 144f668.

hdhalter deleted the fix#2562-dynamic-config-tenants branch March 28, 2024 21:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add documentation for dynamic configuration of tenancy in Dashboards #3694

Add documentation for dynamic configuration of tenancy in Dashboards #3694

cwillum commented Apr 6, 2023 •

edited

Loading

abhivka7 Apr 19, 2023

cwillum Apr 20, 2023

abhivka7 Apr 20, 2023

RyanL1997 Apr 20, 2023

RyanL1997 left a comment

RyanL1997 Apr 20, 2023

hdhalter left a comment

hdhalter Apr 20, 2023

cwillum Apr 20, 2023

natebower left a comment

cwillum left a comment


		# Dynamic configuration in OpenSearch Dashboards

		Dynamic configuration of multi-tenancy in OpenSearch Dashboards provides options to make common settings for tenancy without having to make changes to the configuration YAML files on each node and then restart the cluster. You can take advantage of this functionality by using the Dashboards interface or the REST API. The following list includes description of the options currently covered by dynamic configuration:

Add documentation for dynamic configuration of tenancy in Dashboards #3694

Add documentation for dynamic configuration of tenancy in Dashboards #3694

Conversation

cwillum commented Apr 6, 2023 • edited Loading

Description

Issues Resolved

Checklist

abhivka7 Apr 19, 2023

Choose a reason for hiding this comment

cwillum Apr 20, 2023

Choose a reason for hiding this comment

abhivka7 Apr 20, 2023

Choose a reason for hiding this comment

RyanL1997 Apr 20, 2023

Choose a reason for hiding this comment

RyanL1997 left a comment

Choose a reason for hiding this comment

RyanL1997 Apr 20, 2023

Choose a reason for hiding this comment

hdhalter left a comment

Choose a reason for hiding this comment

hdhalter Apr 20, 2023

Choose a reason for hiding this comment

cwillum Apr 20, 2023

Choose a reason for hiding this comment

natebower left a comment

Choose a reason for hiding this comment

cwillum left a comment

Choose a reason for hiding this comment

cwillum commented Apr 6, 2023 •

edited

Loading