Add a setting to disable remote cluster connections on a node (#23005)

Today either all nodes in the cluster connect to remote clusters of only nodes that have remote clusters configured in their node config. To allow global remote cluster configuration but restrict connections to a set of nodes in the cluster this change adds a new setting `search.remote.connect` (defaults to `true`) to allow to disable remote cluster connections on a per node basis.
elastic · Feb 7, 2017 · 962f365 · 962f365
1 parent 61d95ff
commit 962f365
Show file tree

Hide file tree

Showing 5 changed files with 29 additions and 5 deletions.
diff --git a/core/src/main/java/org/elasticsearch/action/search/RemoteClusterService.java b/core/src/main/java/org/elasticsearch/action/search/RemoteClusterService.java
@@ -98,6 +98,14 @@ public final class RemoteClusterService extends AbstractComponent implements Clo
     public static final Setting<String> REMOTE_NODE_ATTRIBUTE = Setting.simpleString("search.remote.node.attr",
         Setting.Property.NodeScope);
 
+    /**
+     * If <code>true</code> connecting to remote clusters is supported on this node. If <code>false</code> this node will not establish
+     * connections to any remote clusters configured. Search requests executed against this node (where this node is the coordinating node)
+     * will fail if remote cluster syntax is used as an index pattern. The default is <code>true</code>
+     */
+    public static final Setting<Boolean> ENABLE_REMOTE_CLUSTERS = Setting.boolSetting("search.remote.connect", true,
+        Setting.Property.NodeScope);
+
     private static final char REMOTE_CLUSTER_INDEX_SEPARATOR = ':';
 
     private final TransportService transportService;

diff --git a/core/src/main/java/org/elasticsearch/action/search/SearchTransportService.java b/core/src/main/java/org/elasticsearch/action/search/SearchTransportService.java
@@ -79,13 +79,18 @@ public class SearchTransportService extends AbstractLifecycleComponent {
 
     private final TransportService transportService;
     private final RemoteClusterService remoteClusterService;
+    private final boolean connectToRemote;
 
     public SearchTransportService(Settings settings, ClusterSettings clusterSettings, TransportService transportService) {
         super(settings);
+        this.connectToRemote = RemoteClusterService.ENABLE_REMOTE_CLUSTERS.get(settings);
         this.transportService = transportService;
         this.remoteClusterService = new RemoteClusterService(settings, transportService);
-        clusterSettings.addAffixUpdateConsumer(RemoteClusterService.REMOTE_CLUSTERS_SEEDS, remoteClusterService::updateRemoteCluster,
-            (namespace, value) -> {});
+        if (connectToRemote) {
+            clusterSettings.addAffixUpdateConsumer(RemoteClusterService.REMOTE_CLUSTERS_SEEDS, remoteClusterService::updateRemoteCluster,
+                (namespace, value) -> {
+                });
+        }
     }
 
     public void sendFreeContext(Transport.Connection connection, final long contextId, SearchRequest request) {
@@ -390,8 +395,10 @@ Transport.Connection getConnection(DiscoveryNode node) {
 
     @Override
     protected void doStart() {
-        // here we start to connect to the remote clusters
-        remoteClusterService.initializeRemoteClusters();
+        if (connectToRemote) {
+            // here we start to connect to the remote clusters
+            remoteClusterService.initializeRemoteClusters();
+        }
     }
 
     @Override

diff --git a/core/src/main/java/org/elasticsearch/common/settings/ClusterSettings.java b/core/src/main/java/org/elasticsearch/common/settings/ClusterSettings.java
@@ -266,6 +266,7 @@ public void apply(Settings value, Settings current, Settings previous) {
                     RemoteClusterService.REMOTE_CONNECTIONS_PER_CLUSTER,
                     RemoteClusterService.REMOTE_INITIAL_CONNECTION_TIMEOUT_SETTING,
                     RemoteClusterService.REMOTE_NODE_ATTRIBUTE,
+                    RemoteClusterService.ENABLE_REMOTE_CLUSTERS,
                     TransportService.TRACE_LOG_EXCLUDE_SETTING,
                     TransportService.TRACE_LOG_INCLUDE_SETTING,
                     TransportCloseIndexAction.CLUSTER_INDICES_CLOSE_ENABLE_SETTING,

diff --git a/docs/reference/modules/cross-cluster-search.asciidoc b/docs/reference/modules/cross-cluster-search.asciidoc
@@ -128,3 +128,10 @@ will be prefixed with their remote cluster name:
   `node.attr.gateway: true` such that only nodes with this attribute will be
   connected to if `search.remote.node.attr` is set to `gateway`.
 
+`search.remote.connect`::
+ By default, any node in the cluster can act as a cross-cluster client and connect to remote clusters.
+ The `search.remote.connect` setting can be set to `false` (defaults to `true`) to prevent certain nodes from
+ connecting to remote clusters. Cross-cluster search requests must be sent to a node that is allowed to act as a
+ cross-cluster client.
+
+
diff --git a/qa/multi-cluster-search/build.gradle b/qa/multi-cluster-search/build.gradle
@@ -27,6 +27,7 @@ task remoteClusterTest(type: RestIntegTestTask) {
     distribution = 'zip'
     numNodes = 2
     clusterName = 'remote-cluster'
+    setting 'search.remote.connect', false
   }
   systemProperty 'tests.rest.suite', 'remote_cluster'
 }
@@ -37,7 +38,7 @@ task mixedClusterTest(type: RestIntegTestTask) {
     distribution = 'zip'
     setting 'search.remote.my_remote_cluster.seeds', "\"${-> remoteClusterTest.nodes.get(0).transportUri()}\""
     setting 'search.remote.connections_per_cluster', 1
-
+    setting 'search.remote.connect', true
   }
   systemProperty 'tests.rest.suite', 'multi_cluster'
   finalizedBy 'remoteClusterTest#node0.stop','remoteClusterTest#node1.stop'