Skip to content

Commit ce008c4

Browse files
authored
Security: Rename IndexLifecycleManager to SecurityIndexManager (#30442)
This commit renames IndexLifecycleManager to SecurityIndexManager as it is not actually a general purpose class, but specific to security. It also removes indirection in code calling the lifecycle service, instead calling the security index manager directly.
1 parent 3acca0b commit ce008c4

27 files changed

+161
-199
lines changed

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/Security.java

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -197,7 +197,7 @@
197197
import org.elasticsearch.xpack.security.rest.action.user.RestHasPrivilegesAction;
198198
import org.elasticsearch.xpack.security.rest.action.user.RestPutUserAction;
199199
import org.elasticsearch.xpack.security.rest.action.user.RestSetEnabledAction;
200-
import org.elasticsearch.xpack.security.support.IndexLifecycleManager;
200+
import org.elasticsearch.xpack.security.support.SecurityIndexManager;
201201
import org.elasticsearch.xpack.security.transport.SecurityServerTransportInterceptor;
202202
import org.elasticsearch.xpack.security.transport.filter.IPFilter;
203203
import org.elasticsearch.xpack.security.transport.netty4.SecurityNetty4HttpServerTransport;
@@ -233,7 +233,7 @@
233233
import static org.elasticsearch.xpack.core.XPackSettings.HTTP_SSL_ENABLED;
234234
import static org.elasticsearch.xpack.core.security.SecurityLifecycleServiceField.SECURITY_TEMPLATE_NAME;
235235
import static org.elasticsearch.xpack.security.SecurityLifecycleService.SECURITY_INDEX_NAME;
236-
import static org.elasticsearch.xpack.security.support.IndexLifecycleManager.INTERNAL_INDEX_FORMAT;
236+
import static org.elasticsearch.xpack.security.support.SecurityIndexManager.INTERNAL_INDEX_FORMAT;
237237

238238
public class Security extends Plugin implements ActionPlugin, IngestPlugin, NetworkPlugin, ClusterPlugin,
239239
DiscoveryPlugin, MapperPlugin, ExtensiblePlugin {
@@ -424,8 +424,8 @@ Collection<Object> createComponents(Client client, ThreadPool threadPool, Cluste
424424
components.add(realms);
425425
components.add(reservedRealm);
426426

427-
securityLifecycleService.addSecurityIndexHealthChangeListener(nativeRoleMappingStore::onSecurityIndexHealthChange);
428-
securityLifecycleService.addSecurityIndexOutOfDateListener(nativeRoleMappingStore::onSecurityIndexOutOfDateChange);
427+
securityLifecycleService.securityIndex().addIndexHealthChangeListener(nativeRoleMappingStore::onSecurityIndexHealthChange);
428+
securityLifecycleService.securityIndex().addIndexOutOfDateListener(nativeRoleMappingStore::onSecurityIndexOutOfDateChange);
429429

430430
AuthenticationFailureHandler failureHandler = null;
431431
String extensionName = null;
@@ -458,8 +458,8 @@ Collection<Object> createComponents(Client client, ThreadPool threadPool, Cluste
458458
}
459459
final CompositeRolesStore allRolesStore = new CompositeRolesStore(settings, fileRolesStore, nativeRolesStore,
460460
reservedRolesStore, rolesProviders, threadPool.getThreadContext(), getLicenseState());
461-
securityLifecycleService.addSecurityIndexHealthChangeListener(allRolesStore::onSecurityIndexHealthChange);
462-
securityLifecycleService.addSecurityIndexOutOfDateListener(allRolesStore::onSecurityIndexOutOfDateChange);
461+
securityLifecycleService.securityIndex().addIndexHealthChangeListener(allRolesStore::onSecurityIndexHealthChange);
462+
securityLifecycleService.securityIndex().addIndexOutOfDateListener(allRolesStore::onSecurityIndexOutOfDateChange);
463463
// to keep things simple, just invalidate all cached entries on license change. this happens so rarely that the impact should be
464464
// minimal
465465
getLicenseState().addListener(allRolesStore::invalidateAll);
@@ -886,7 +886,7 @@ public UnaryOperator<Map<String, IndexTemplateMetaData>> getIndexTemplateMetaDat
886886
templates.remove(SECURITY_TEMPLATE_NAME);
887887
final XContent xContent = XContentFactory.xContent(XContentType.JSON);
888888
final byte[] auditTemplate = TemplateUtils.loadTemplate("/" + IndexAuditTrail.INDEX_TEMPLATE_NAME + ".json",
889-
Version.CURRENT.toString(), IndexLifecycleManager.TEMPLATE_VERSION_PATTERN).getBytes(StandardCharsets.UTF_8);
889+
Version.CURRENT.toString(), SecurityIndexManager.TEMPLATE_VERSION_PATTERN).getBytes(StandardCharsets.UTF_8);
890890

891891
try (XContentParser parser = xContent
892892
.createParser(NamedXContentRegistry.EMPTY, LoggingDeprecationHandler.INSTANCE, auditTemplate)) {

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/SecurityLifecycleService.java

Lines changed: 6 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
import org.elasticsearch.gateway.GatewayService;
2323
import org.elasticsearch.threadpool.ThreadPool;
2424
import org.elasticsearch.xpack.security.audit.index.IndexAuditTrail;
25-
import org.elasticsearch.xpack.security.support.IndexLifecycleManager;
25+
import org.elasticsearch.xpack.security.support.SecurityIndexManager;
2626

2727
import java.util.Arrays;
2828
import java.util.Collections;
@@ -46,7 +46,7 @@
4646
*/
4747
public class SecurityLifecycleService extends AbstractComponent implements ClusterStateListener {
4848

49-
public static final String INTERNAL_SECURITY_INDEX = IndexLifecycleManager.INTERNAL_SECURITY_INDEX;
49+
public static final String INTERNAL_SECURITY_INDEX = SecurityIndexManager.INTERNAL_SECURITY_INDEX;
5050
public static final String SECURITY_INDEX_NAME = ".security";
5151

5252
private static final Version MIN_READ_VERSION = Version.V_5_0_0;
@@ -55,7 +55,7 @@ public class SecurityLifecycleService extends AbstractComponent implements Clust
5555
private final ThreadPool threadPool;
5656
private final IndexAuditTrail indexAuditTrail;
5757

58-
private final IndexLifecycleManager securityIndex;
58+
private final SecurityIndexManager securityIndex;
5959

6060
public SecurityLifecycleService(Settings settings, ClusterService clusterService,
6161
ThreadPool threadPool, Client client,
@@ -64,7 +64,7 @@ public SecurityLifecycleService(Settings settings, ClusterService clusterService
6464
this.settings = settings;
6565
this.threadPool = threadPool;
6666
this.indexAuditTrail = indexAuditTrail;
67-
this.securityIndex = new IndexLifecycleManager(settings, client, SECURITY_INDEX_NAME);
67+
this.securityIndex = new SecurityIndexManager(settings, client, SECURITY_INDEX_NAME);
6868
clusterService.addListener(this);
6969
clusterService.addLifecycleListener(new LifecycleListener() {
7070
@Override
@@ -110,69 +110,10 @@ public void doRun() {
110110
}
111111
}
112112

113-
IndexLifecycleManager securityIndex() {
113+
public SecurityIndexManager securityIndex() {
114114
return securityIndex;
115115
}
116116

117-
/**
118-
* Returns {@code true} if the security index exists
119-
*/
120-
public boolean isSecurityIndexExisting() {
121-
return securityIndex.indexExists();
122-
}
123-
124-
/**
125-
* Returns <code>true</code> if the security index does not exist or it exists and has the current
126-
* value for the <code>index.format</code> index setting
127-
*/
128-
public boolean isSecurityIndexUpToDate() {
129-
return securityIndex.isIndexUpToDate();
130-
}
131-
132-
/**
133-
* Returns <code>true</code> if the security index exists and all primary shards are active
134-
*/
135-
public boolean isSecurityIndexAvailable() {
136-
return securityIndex.isAvailable();
137-
}
138-
139-
/**
140-
* Returns <code>true</code> if the security index does not exist or the mappings are up to date
141-
* based on the version in the <code>_meta</code> field
142-
*/
143-
public boolean isSecurityIndexMappingUpToDate() {
144-
return securityIndex().isMappingUpToDate();
145-
}
146-
147-
/**
148-
* Test whether the effective (active) version of the security mapping meets the
149-
* <code>requiredVersion</code>.
150-
*
151-
* @return <code>true</code> if the effective version passes the predicate, or the security
152-
* mapping does not exist (<code>null</code> version). Otherwise, <code>false</code>.
153-
*/
154-
public boolean checkSecurityMappingVersion(Predicate<Version> requiredVersion) {
155-
return securityIndex.checkMappingVersion(requiredVersion);
156-
}
157-
158-
/**
159-
* Adds a listener which will be notified when the security index health changes. The previous and
160-
* current health will be provided to the listener so that the listener can determine if any action
161-
* needs to be taken.
162-
*/
163-
public void addSecurityIndexHealthChangeListener(BiConsumer<ClusterIndexHealth, ClusterIndexHealth> listener) {
164-
securityIndex.addIndexHealthChangeListener(listener);
165-
}
166-
167-
/**
168-
* Adds a listener which will be notified when the security index out of date value changes. The previous and
169-
* current value will be provided to the listener so that the listener can determine if any action
170-
* needs to be taken.
171-
*/
172-
void addSecurityIndexOutOfDateListener(BiConsumer<Boolean, Boolean> listener) {
173-
securityIndex.addIndexOutOfDateListener(listener);
174-
}
175-
176117
// this is called in a lifecycle listener beforeStop on the cluster service
177118
private void close() {
178119
if (indexAuditTrail != null) {
@@ -193,29 +134,13 @@ static boolean securityIndexMappingUpToDate(ClusterState clusterState, Logger lo
193134
}
194135

195136
private static boolean checkMappingVersions(ClusterState clusterState, Logger logger, Predicate<Version> versionPredicate) {
196-
return IndexLifecycleManager.checkIndexMappingVersionMatches(SECURITY_INDEX_NAME, clusterState, logger, versionPredicate);
137+
return SecurityIndexManager.checkIndexMappingVersionMatches(SECURITY_INDEX_NAME, clusterState, logger, versionPredicate);
197138
}
198139

199140
public static List<String> indexNames() {
200141
return Collections.unmodifiableList(Arrays.asList(SECURITY_INDEX_NAME, INTERNAL_SECURITY_INDEX));
201142
}
202143

203-
/**
204-
* Prepares the security index by creating it if it doesn't exist or updating the mappings if the mappings are
205-
* out of date. After any tasks have been executed, the runnable is then executed.
206-
*/
207-
public void prepareIndexIfNeededThenExecute(final Consumer<Exception> consumer, final Runnable andThen) {
208-
securityIndex.prepareIndexIfNeededThenExecute(consumer, andThen);
209-
}
210-
211-
/**
212-
* Checks if the security index is out of date with the current version. If the index does not exist
213-
* we treat the index as up to date as we expect it to be created with the current format.
214-
*/
215-
public boolean isSecurityIndexOutOfDate() {
216-
return securityIndex.isIndexUpToDate() == false;
217-
}
218-
219144
/**
220145
* Is the move from {@code previousHealth} to {@code currentHealth} a move from an unhealthy ("RED") index state to a healthy
221146
* ("non-RED") state.

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/audit/index/IndexAuditTrail.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@
5757
import org.elasticsearch.xpack.security.audit.AuditLevel;
5858
import org.elasticsearch.xpack.security.audit.AuditTrail;
5959
import org.elasticsearch.xpack.security.rest.RemoteHostHeader;
60-
import org.elasticsearch.xpack.security.support.IndexLifecycleManager;
60+
import org.elasticsearch.xpack.security.support.SecurityIndexManager;
6161
import org.elasticsearch.xpack.security.transport.filter.SecurityIpFilterRule;
6262
import org.joda.time.DateTime;
6363
import org.joda.time.DateTimeZone;
@@ -105,7 +105,7 @@
105105
import static org.elasticsearch.xpack.security.audit.AuditUtil.indices;
106106
import static org.elasticsearch.xpack.security.audit.AuditUtil.restRequestContent;
107107
import static org.elasticsearch.xpack.security.audit.index.IndexNameResolver.resolve;
108-
import static org.elasticsearch.xpack.security.support.IndexLifecycleManager.SECURITY_VERSION_STRING;
108+
import static org.elasticsearch.xpack.security.support.SecurityIndexManager.SECURITY_VERSION_STRING;
109109

110110
/**
111111
* Audit trail implementation that writes events into an index.
@@ -1001,7 +1001,7 @@ private void putTemplate(Settings customSettings, Consumer<Exception> consumer)
10011001

10021002
private PutIndexTemplateRequest getPutIndexTemplateRequest(Settings customSettings) {
10031003
final byte[] template = TemplateUtils.loadTemplate("/" + INDEX_TEMPLATE_NAME + ".json",
1004-
Version.CURRENT.toString(), IndexLifecycleManager.TEMPLATE_VERSION_PATTERN).getBytes(StandardCharsets.UTF_8);
1004+
Version.CURRENT.toString(), SecurityIndexManager.TEMPLATE_VERSION_PATTERN).getBytes(StandardCharsets.UTF_8);
10051005
final PutIndexTemplateRequest request = new PutIndexTemplateRequest(INDEX_TEMPLATE_NAME).source(template, XContentType.JSON);
10061006
if (customSettings != null && customSettings.names().size() > 0) {
10071007
Settings updatedSettings = Settings.builder()

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/InternalRealms.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ public static Map<String, Realm.Factory> getFactories(ThreadPool threadPool, Res
9696
map.put(FileRealmSettings.TYPE, config -> new FileRealm(config, resourceWatcherService));
9797
map.put(NativeRealmSettings.TYPE, config -> {
9898
final NativeRealm nativeRealm = new NativeRealm(config, nativeUsersStore);
99-
securityLifecycleService.addSecurityIndexHealthChangeListener(nativeRealm::onSecurityIndexHealthChange);
99+
securityLifecycleService.securityIndex().addIndexHealthChangeListener(nativeRealm::onSecurityIndexHealthChange);
100100
return nativeRealm;
101101
});
102102
map.put(LdapRealmSettings.AD_TYPE, config -> new LdapRealm(LdapRealmSettings.AD_TYPE, config, sslService,

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -250,7 +250,7 @@ public void createUserToken(Authentication authentication, Authentication origin
250250
.setSource(builder)
251251
.setRefreshPolicy(RefreshPolicy.WAIT_UNTIL)
252252
.request();
253-
lifecycleService.prepareIndexIfNeededThenExecute(listener::onFailure, () ->
253+
lifecycleService.securityIndex().prepareIndexIfNeededThenExecute(listener::onFailure, () ->
254254
executeAsyncWithOrigin(client, SECURITY_ORIGIN, IndexAction.INSTANCE, request,
255255
ActionListener.wrap(indexResponse -> listener.onResponse(new Tuple<>(userToken, refreshToken)),
256256
listener::onFailure))
@@ -354,7 +354,7 @@ void decodeToken(String token, ActionListener<UserToken> listener) throws IOExce
354354
if (version.onOrAfter(Version.V_6_2_0)) {
355355
// we only have the id and need to get the token from the doc!
356356
decryptTokenId(in, cipher, version, ActionListener.wrap(tokenId ->
357-
lifecycleService.prepareIndexIfNeededThenExecute(listener::onFailure, () -> {
357+
lifecycleService.securityIndex().prepareIndexIfNeededThenExecute(listener::onFailure, () -> {
358358
final GetRequest getRequest =
359359
client.prepareGet(SecurityLifecycleService.SECURITY_INDEX_NAME, TYPE,
360360
getTokenDocumentId(tokenId)).request();
@@ -524,7 +524,7 @@ private void indexBwcInvalidation(UserToken userToken, ActionListener<Boolean> l
524524
.request();
525525
final String tokenDocId = getTokenDocumentId(userToken);
526526
final Version version = userToken.getVersion();
527-
lifecycleService.prepareIndexIfNeededThenExecute(listener::onFailure, () ->
527+
lifecycleService.securityIndex().prepareIndexIfNeededThenExecute(listener::onFailure, () ->
528528
executeAsyncWithOrigin(client.threadPool().getThreadContext(), SECURITY_ORIGIN, indexRequest,
529529
ActionListener.<IndexResponse>wrap(indexResponse -> {
530530
ActionListener<Boolean> wrappedListener =
@@ -566,7 +566,7 @@ private void indexInvalidation(String tokenDocId, Version version, ActionListene
566566
.setVersion(documentVersion)
567567
.setRefreshPolicy(RefreshPolicy.WAIT_UNTIL)
568568
.request();
569-
lifecycleService.prepareIndexIfNeededThenExecute(listener::onFailure, () ->
569+
lifecycleService.securityIndex().prepareIndexIfNeededThenExecute(listener::onFailure, () ->
570570
executeAsyncWithOrigin(client.threadPool().getThreadContext(), SECURITY_ORIGIN, request,
571571
ActionListener.<UpdateResponse>wrap(updateResponse -> {
572572
if (updateResponse.getGetResult() != null
@@ -665,7 +665,7 @@ private void findTokenFromRefreshToken(String refreshToken, ActionListener<Tuple
665665
.setVersion(true)
666666
.request();
667667

668-
lifecycleService.prepareIndexIfNeededThenExecute(listener::onFailure, () ->
668+
lifecycleService.securityIndex().prepareIndexIfNeededThenExecute(listener::onFailure, () ->
669669
executeAsyncWithOrigin(client.threadPool().getThreadContext(), SECURITY_ORIGIN, request,
670670
ActionListener.<SearchResponse>wrap(searchResponse -> {
671671
if (searchResponse.isTimedOut()) {
@@ -847,7 +847,7 @@ public void findActiveTokensForRealm(String realmName, ActionListener<Collection
847847
.request();
848848

849849
final Supplier<ThreadContext.StoredContext> supplier = client.threadPool().getThreadContext().newRestorableContext(false);
850-
lifecycleService.prepareIndexIfNeededThenExecute(listener::onFailure, () ->
850+
lifecycleService.securityIndex().prepareIndexIfNeededThenExecute(listener::onFailure, () ->
851851
ScrollHelper.fetchAllByEntity(client, request, new ContextPreservingActionListener<>(supplier, listener), this::parseHit));
852852
}
853853

@@ -914,11 +914,11 @@ private void ensureEnabled() {
914914
* have been explicitly cleared.
915915
*/
916916
private void checkIfTokenIsRevoked(UserToken userToken, ActionListener<UserToken> listener) {
917-
if (lifecycleService.isSecurityIndexExisting() == false) {
917+
if (lifecycleService.securityIndex().indexExists() == false) {
918918
// index doesn't exist so the token is considered valid.
919919
listener.onResponse(userToken);
920920
} else {
921-
lifecycleService.prepareIndexIfNeededThenExecute(listener::onFailure, () -> {
921+
lifecycleService.securityIndex().prepareIndexIfNeededThenExecute(listener::onFailure, () -> {
922922
MultiGetRequest mGetRequest = client.prepareMultiGet()
923923
.add(SecurityLifecycleService.SECURITY_INDEX_NAME, TYPE, getInvalidatedTokenDocumentId(userToken))
924924
.add(SecurityLifecycleService.SECURITY_INDEX_NAME, TYPE, getTokenDocumentId(userToken))
@@ -989,7 +989,7 @@ private Instant getExpirationTime(Instant now) {
989989
}
990990

991991
private void maybeStartTokenRemover() {
992-
if (lifecycleService.isSecurityIndexAvailable()) {
992+
if (lifecycleService.securityIndex().isAvailable()) {
993993
if (client.threadPool().relativeTimeInMillis() - lastExpirationRunMs > deleteInterval.getMillis()) {
994994
expiredTokenRemover.submit(client.threadPool());
995995
lastExpirationRunMs = client.threadPool().relativeTimeInMillis();

0 commit comments

Comments
 (0)