Lazy compute the index access control #88708
Conversation
This commit is separating authorization check from computation of index access control. The change is simply a preparation for allowing the access control to be computed lazily.
…y-compute-access-control
slobodanadamovic
added
>non-issue
:Security/Authorization
|
This PR is still a draft as it depends on changes made in #88662. |
…rization-performance
github.com:slobodanadamovic/elasticsearch into sa-lazy-compute-access-control # Conflicts: # x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/IndicesPermission.java
…movic/elasticsearch into sa-lazy-compute-access-control
…movic/elasticsearch into sa-lazy-compute-access-control
…movic/elasticsearch into sa-lazy-compute-access-control
…rization-performance
…movic/elasticsearch into sa-lazy-compute-access-control
|
The |
|
@elasticmachine run elasticsearch-ci/part-2 |
…compute-access-control # Conflicts: # x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/IndicesPermission.java
…compute-access-control
...g/elasticsearch/xpack/security/authz/interceptor/SearchRequestCacheDisablingInterceptor.java
Outdated
Show resolved
Hide resolved
...k/security/authz/accesscontrol/wrapper/DlsFlsFeatureTrackingIndicesAccessControlWrapper.java
Outdated
Show resolved
Hide resolved
...search/xpack/security/authz/interceptor/FieldAndDocumentLevelSecurityRequestInterceptor.java
Outdated
Show resolved
Hide resolved
|
@ycombinator We discussed some time ago that I'll ping you when we get ready to merge this change so that you can validate on the cloud side that all is well. This change makes DLS/FLS feature tracking not report usage on the coordinating-only nodes, in most cases (when the feature is licensed). It will continue to report usage on the data nodes, as usual. |
Thanks for the ping, @albertzaharovits. I want to make sure I understand the impact of the change correctly. Before this change DLS/FLS feature tracking (if the feature was licensed) was being reported by all nodes? And after this change this will only be reported by data nodes? |
That is correct. With this change, the DLS/FLS feature usage will be reported by data nodes (as it did before), with just a small exception that it might not be reported by coordinating only nodes in some cases. Hence, I think it's fine to assume that coordinating-only nodes will not report the feature usage anymore and only data nodes will report it. |
…compute-access-control
Thanks for clarifying, @slobodanadamovic. Just to confirm, this change will not impact the results of DLS/FLS feature usage for a cluster, right? Meaning, whatever DLS/FLS feature usage the cluster was reporting before, it will report after this change as well --- the only difference is what nodes may report that usage now, yes? |
Correct. |
Perfect, thanks @slobodanadamovic. That means this change is a no-op from a Billing perspective, given that our process gets feature usage data from every ES node and then aggregates the results downstream. cc: @blfrantz as an FYI. |
…compute-access-control
…compute-access-control
|
@elasticmachine run elasticsearch-ci/part-3-fips |
1 similar comment
|
@elasticmachine run elasticsearch-ci/part-3-fips |
|
@elasticmachine update branch |
The access control was always computed eagerly, even in cases when
it was not necessary (e.g. shard is not accessed on the node doing
the authorization or in cases when authorization is denied).
This commit defers the computation to when it's really needed and tries
to avoid that the actual work is done on the network worker thread.