Class SecurityIndexManager

java.lang.Object
org.elasticsearch.xpack.security.support.SecurityIndexManager
All Implemented Interfaces:
ClusterStateListener

public class SecurityIndexManager extends Object implements ClusterStateListener
Manages the lifecycle, mapping and data upgrades/migrations of the RestrictedIndicesNames#SECURITY_MAIN_ALIAS and RestrictedIndicesNames#SECURITY_MAIN_ALIAS alias-index pair.
  • Field Details

  • Method Details

    • buildSecurityIndexManager

      public static SecurityIndexManager buildSecurityIndexManager(Client client, ClusterService clusterService, FeatureService featureService, SystemIndexDescriptor descriptor)
    • defensiveCopy

      public SecurityIndexManager defensiveCopy()
      Creates a defensive to protect against the underlying state changes. Should be called prior to making decisions and that same copy should be reused for multiple checks in the same workflow.
    • aliasName

      public String aliasName()
    • indexExists

      public boolean indexExists()
    • indexIsClosed

      public boolean indexIsClosed()
    • getCreationTime

      public Instant getCreationTime()
    • isIndexUpToDate

      public boolean isIndexUpToDate()
      Returns whether the index is on the current format if it exists. If the index does not exist we treat the index as up to date as we expect it to be created with the current format.
    • isAvailable

      public boolean isAvailable(SecurityIndexManager.Availability availability)
      Optimization to avoid making unnecessary calls when we know the underlying shard state. This call will check that the index exists, is discoverable from the alias, is not closed, and will determine if available based on the SecurityIndexManager.Availability parameter.
      Parameters:
      availability - Check availability for search or write/update/real time get workflows. Write/update/realtime get workflows should check for availability of primary shards. Search workflows should check availability of search shards (which may or may not also be the primary shards).
      Returns:
      when checking for search: true if all searchable shards for the security index are available when checking for primary: true if all primary shards for the security index are available
    • isMappingUpToDate

      public boolean isMappingUpToDate()
    • isStateRecovered

      public boolean isStateRecovered()
    • isMigrationsVersionAtLeast

      public boolean isMigrationsVersionAtLeast(Integer expectedMigrationsVersion)
    • getUnavailableReason

      public ElasticsearchException getUnavailableReason(SecurityIndexManager.Availability availability)
    • addStateListener

      public void addStateListener(BiConsumer<SecurityIndexManager.State,SecurityIndexManager.State> listener)
      Add a listener for notifications on state changes to the configured index. The previous and current state are provided.
    • removeStateListener

      public void removeStateListener(BiConsumer<SecurityIndexManager.State,SecurityIndexManager.State> listener)
      Remove a listener from notifications on state changes to the configured index.
    • getRoleMappingsCleanupMigrationStatus

      public SecurityIndexManager.RoleMappingsCleanupMigrationStatus getRoleMappingsCleanupMigrationStatus()
    • clusterChanged

      public void clusterChanged(ClusterChangedEvent event)
      Specified by:
      clusterChanged in interface ClusterStateListener
    • getMigrationVersionFromIndexMetadata

      public static int getMigrationVersionFromIndexMetadata(IndexMetadata indexMetadata)
    • onStateRecovered

      public void onStateRecovered(Consumer<SecurityIndexManager.State> recoveredStateConsumer)
    • onIndexAvailableForSearch

      public void onIndexAvailableForSearch(ActionListener<Void> listener, org.elasticsearch.core.TimeValue timeout)
      Waits up to timeout for the security index to become available for search, based on cluster state updates. Notifies listener once the security index is available, or calls onFailure on timeout.
    • isEligibleSecurityMigration

      public boolean isEligibleSecurityMigration(SecurityMigrations.SecurityMigration securityMigration)
    • isReadyForSecurityMigration

      public boolean isReadyForSecurityMigration(SecurityMigrations.SecurityMigration securityMigration)
    • resolveConcreteIndex

      public static IndexMetadata resolveConcreteIndex(String indexOrAliasName, Metadata metadata)
      Resolves a concrete index name or alias to a IndexMetadata instance. Requires that if supplied with an alias, the alias resolves to at most one concrete index.
    • checkIndexVersionThenExecute

      public void checkIndexVersionThenExecute(Consumer<Exception> consumer, Runnable andThen)
      Validates that the index is up to date and does not need to be migrated. If it is not, the consumer is called with an exception. If the index is up to date, the runnable will be executed. NOTE: this method does not check the availability of the index; this check is left to the caller so that this condition can be handled appropriately.
    • getConcreteIndexName

      public String getConcreteIndexName()
    • prepareIndexIfNeededThenExecute

      public void prepareIndexIfNeededThenExecute(Consumer<Exception> consumer, Runnable andThen)
      Prepares the index by creating it if it doesn't exist, then executes the runnable.
      Parameters:
      consumer - a handler for any exceptions that are raised either during preparation or execution
      andThen - executed if the index exists or after preparation is performed successfully
    • isCreatedOnLatestVersion

      public boolean isCreatedOnLatestVersion()
    • isMoveFromRedToNonRed

      public static boolean isMoveFromRedToNonRed(SecurityIndexManager.State previousState, SecurityIndexManager.State currentState)
      Return true if the state moves from an unhealthy ("RED") index state to a healthy ("non-RED") state.
    • isIndexDeleted

      public static boolean isIndexDeleted(SecurityIndexManager.State previousState, SecurityIndexManager.State currentState)
      Return true if the state moves from the index existing to the index not existing.