Add ACL-aware routing processors for multi-tenant document routing

[atris]

Introduces two new processors to enable document routing based on ACL metadata:

• AclRoutingProcessor (ingest pipeline):

  • Extracts ACL field value and generates deterministic routing using MurmurHash3
  • Configurable options: acl_field, target_field (default: _routing),
    ignore_missing, override_existing
  • Ensures documents with same ACL values colocate on same shard

• AclRoutingSearchProcessor (search pipeline):

  • Automatically extracts ACL values from term/terms/bool queries
  • Sets routing on search requests to target specific shards
  • Supports nested bool query traversal (must/filter/should clauses)
  • Configurable extraction with extract_from_query flag

Implementation details:

• Both processors use identical MurmurHash3.hash128() with Base64 encoding
  for consistent routing value generation
• Registered in IngestCommonModulePlugin and SearchPipelineCommonModulePlugin
• Comprehensive unit tests and integration tests for both processors
• Follows existing processor patterns (similar to HierarchicalRoutingProcessor)

Use case: Improves query performance in multi-tenant environments by ensuring
tenant-specific documents are colocated and queries are routed to relevant shards.

Resolves #18829

Signed-off-by: [Atri Sharma] [email protected]

[atris]

@msfroh

[github-actions]

❌ Gradle check result for 3a85104: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

[github-actions]

✅ Gradle check result for 3a85104: SUCCESS

[codecov]

Codecov Report

❌ Patch coverage is 95.06173% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 72.78%. Comparing base (c1dfa6a) to head (684f3cd).
⚠️ Report is 20 commits behind head on main.

Files with missing lines	Patch %	Lines
.../opensearch/ingest/common/AclRoutingProcessor.java	91.42%	1 Missing and 2 partials ⚠️
...rch/pipeline/common/AclRoutingSearchProcessor.java	97.77%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main   #18834      +/-   ##
============================================
+ Coverage     72.75%   72.78%   +0.02%     
- Complexity    68520    68567      +47     
============================================
  Files          5570     5574       +4     
  Lines        314998   315254     +256     
  Branches      45697    45754      +57     
============================================
+ Hits         229185   229449     +264     
+ Misses        67260    67205      -55     
- Partials      18553    18600      +47     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

❌ Gradle check result for fb10eca: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

[github-actions]

❌ Gradle check result for 684f3cd: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

[atris]

Flaky tests #14509

[github-actions]

✅ Gradle check result for 684f3cd: SUCCESS

[msfroh]

Looks good, @atris!

I added a comment on the search processor just to capture my thoughts on the query visitor. The conclusion is that your implementation is good, but I figure if I had to think about it, I should write down those thoughts. (I'll resolve my own comment before merging.)