Module org.elasticsearch.security
Class SecurityIndexManager
java.lang.Object
org.elasticsearch.xpack.security.support.SecurityIndexManager
- All Implemented Interfaces:
ClusterStateListener
Manages the lifecycle, mapping and data upgrades/migrations of the
RestrictedIndicesNames#SECURITY_MAIN_ALIAS
and RestrictedIndicesNames#SECURITY_MAIN_ALIAS alias-index pair.-
Nested Class Summary
Nested ClassesModifier and TypeClassDescriptionstatic enumWhen checking availability, check for availability of search or availability of all primariesstatic enumstatic classState of the security index. -
Field Summary
Fields -
Method Summary
Modifier and TypeMethodDescriptionvoidAdd a listener for notifications on state changes to the configured index.static SecurityIndexManagerbuildSecurityIndexManager(Client client, ClusterService clusterService, FeatureService featureService, SystemIndexDescriptor descriptor) voidcheckIndexVersionThenExecute(Consumer<Exception> consumer, Runnable andThen) Validates that the index is up to date and does not need to be migrated.voidCreates a defensive to protect against the underlying state changes.static intgetMigrationVersionFromIndexMetadata(IndexMetadata indexMetadata) getUnavailableReason(SecurityIndexManager.Availability availability) booleanbooleanbooleanisAvailable(SecurityIndexManager.Availability availability) Optimization to avoid making unnecessary calls when we know the underlying shard state.booleanbooleanisEligibleSecurityMigration(SecurityMigrations.SecurityMigration securityMigration) static booleanisIndexDeleted(SecurityIndexManager.State previousState, SecurityIndexManager.State currentState) Return true if the state moves from the index existing to the index not existing.booleanReturns whether the index is on the current format if it exists.booleanbooleanisMigrationsVersionAtLeast(Integer expectedMigrationsVersion) static booleanisMoveFromRedToNonRed(SecurityIndexManager.State previousState, SecurityIndexManager.State currentState) Return true if the state moves from an unhealthy ("RED") index state to a healthy ("non-RED") state.booleanisReadyForSecurityMigration(SecurityMigrations.SecurityMigration securityMigration) booleanvoidonIndexAvailableForSearch(ActionListener<Void> listener, org.elasticsearch.core.TimeValue timeout) Waits up totimeoutfor the security index to become available for search, based on cluster state updates.voidonStateRecovered(Consumer<SecurityIndexManager.State> recoveredStateConsumer) voidprepareIndexIfNeededThenExecute(Consumer<Exception> consumer, Runnable andThen) Prepares the index by creating it if it doesn't exist, then executes the runnable.voidRemove a listener from notifications on state changes to the configured index.static IndexMetadataresolveConcreteIndex(String indexOrAliasName, Metadata metadata) Resolves a concrete index name or alias to aIndexMetadatainstance.
-
Field Details
-
SECURITY_VERSION_STRING
- See Also:
-
FILE_SETTINGS_METADATA_NAMESPACE
- See Also:
-
-
Method Details
-
buildSecurityIndexManager
public static SecurityIndexManager buildSecurityIndexManager(Client client, ClusterService clusterService, FeatureService featureService, SystemIndexDescriptor descriptor) -
defensiveCopy
Creates a defensive to protect against the underlying state changes. Should be called prior to making decisions and that same copy should be reused for multiple checks in the same workflow. -
aliasName
-
indexExists
public boolean indexExists() -
indexIsClosed
public boolean indexIsClosed() -
getCreationTime
-
isIndexUpToDate
public boolean isIndexUpToDate()Returns whether the index is on the current format if it exists. If the index does not exist we treat the index as up to date as we expect it to be created with the current format. -
isAvailable
Optimization to avoid making unnecessary calls when we know the underlying shard state. This call will check that the index exists, is discoverable from the alias, is not closed, and will determine if available based on theSecurityIndexManager.Availabilityparameter.- Parameters:
availability- Check availability for search or write/update/real time get workflows. Write/update/realtime get workflows should check for availability of primary shards. Search workflows should check availability of search shards (which may or may not also be the primary shards).- Returns:
- when checking for search:
trueif all searchable shards for the security index are available when checking for primary:trueif all primary shards for the security index are available
-
isMappingUpToDate
public boolean isMappingUpToDate() -
isStateRecovered
public boolean isStateRecovered() -
isMigrationsVersionAtLeast
-
addStateListener
public void addStateListener(BiConsumer<SecurityIndexManager.State, SecurityIndexManager.State> listener) Add a listener for notifications on state changes to the configured index. The previous and current state are provided. -
removeStateListener
public void removeStateListener(BiConsumer<SecurityIndexManager.State, SecurityIndexManager.State> listener) Remove a listener from notifications on state changes to the configured index. -
getRoleMappingsCleanupMigrationStatus
public SecurityIndexManager.RoleMappingsCleanupMigrationStatus getRoleMappingsCleanupMigrationStatus() -
clusterChanged
- Specified by:
clusterChangedin interfaceClusterStateListener
-
getMigrationVersionFromIndexMetadata
-
onStateRecovered
-
onIndexAvailableForSearch
public void onIndexAvailableForSearch(ActionListener<Void> listener, org.elasticsearch.core.TimeValue timeout) Waits up totimeoutfor the security index to become available for search, based on cluster state updates. Notifieslisteneronce the security index is available, or callsonFailureontimeout. -
isEligibleSecurityMigration
-
isReadyForSecurityMigration
-
resolveConcreteIndex
Resolves a concrete index name or alias to aIndexMetadatainstance. Requires that if supplied with an alias, the alias resolves to at most one concrete index. -
checkIndexVersionThenExecute
Validates that the index is up to date and does not need to be migrated. If it is not, the consumer is called with an exception. If the index is up to date, the runnable will be executed. NOTE: this method does not check the availability of the index; this check is left to the caller so that this condition can be handled appropriately. -
getConcreteIndexName
-
prepareIndexIfNeededThenExecute
Prepares the index by creating it if it doesn't exist, then executes the runnable.- Parameters:
consumer- a handler for any exceptions that are raised either during preparation or executionandThen- executed if the index exists or after preparation is performed successfully
-
isCreatedOnLatestVersion
public boolean isCreatedOnLatestVersion() -
isMoveFromRedToNonRed
public static boolean isMoveFromRedToNonRed(SecurityIndexManager.State previousState, SecurityIndexManager.State currentState) Return true if the state moves from an unhealthy ("RED") index state to a healthy ("non-RED") state. -
isIndexDeleted
public static boolean isIndexDeleted(SecurityIndexManager.State previousState, SecurityIndexManager.State currentState) Return true if the state moves from the index existing to the index not existing.
-