Skip to content

Pass resourceType instead of resourceIndex to resourceSharingClient #4333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 6 commits into from
Nov 6, 2025
Merged

Pass resourceType instead of resourceIndex to resourceSharingClient #4333

merged 6 commits into from
Nov 6, 2025
+34 −11

Conversation

@cwperks
Copy link
Member

@cwperks cwperks commented Oct 21, 2025

Description

This PR is related to the changes in opensearch-project/security#5713 to support multiple resource types in the same index. There's a small change in all ResourceSharingClient methods to accept type in the place of index.

resource type <-> resource index is a many-to-one relationship (think dashboards saved objects where multiple saved object types are in the same index).

On another note, ResourceSharingClient is used in instances where a mechanism doesn't currently exist as in parent<->child relationships (like a detector and results where all results are associated with a detector). Security is working on a mechanism to support this natively to obviate the need for ResourceSharingClient and instead abstract all the logic behind-the-scenes to the security plugin.

Check List

  • New functionality includes testing.
  • New functionality has been documented.
  • API changes companion pull request created.
  • Commits are signed per the DCO using --signoff.
  • Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval October 21, 2025 02:29 — with GitHub Actions Error
@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval October 21, 2025 02:29 — with GitHub Actions Error
@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval October 21, 2025 02:29 — with GitHub Actions Failure
@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval October 21, 2025 02:29 — with GitHub Actions Failure
@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval November 4, 2025 19:46 — with GitHub Actions Failure
@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval November 4, 2025 19:46 — with GitHub Actions Error
@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval November 4, 2025 19:46 — with GitHub Actions Failure
@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval November 4, 2025 19:46 — with GitHub Actions Error
@cwperks
Fix test
ffe3da2 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval November 4, 2025 20:58 — with GitHub Actions Error
@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval November 4, 2025 20:58 — with GitHub Actions Failure
@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval November 4, 2025 20:58 — with GitHub Actions Failure
@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval November 4, 2025 21:58 — with GitHub Actions Failure
@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval November 4, 2025 21:58 — with GitHub Actions Error
@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval November 5, 2025 00:39 — with GitHub Actions Error
@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval November 5, 2025 00:39 — with GitHub Actions Failure
@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval November 5, 2025 00:39 — with GitHub Actions Failure
@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval November 5, 2025 00:39 — with GitHub Actions Error
mingshl
mingshl previously approved these changes Nov 5, 2025
View reviewed changes
@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval November 5, 2025 18:59 — with GitHub Actions Failure
@mingshl
Copy link
Collaborator

mingshl commented Nov 5, 2025

CI failed not related to code changes

Tests with failures:
 - org.opensearch.ml.action.models.SearchModelTransportActionTests.test_RSC_featureEnabled_typeEnabled_callsGetAccessibleIds

> Task :opensearch-ml-plugin:test FAILED

@mingshl
Copy link
Collaborator

mingshl commented Nov 5, 2025

@cwperks can you look at this test and try reproduce locally?

REPRODUCE WITH: ./gradlew ':opensearch-ml-plugin:test' --tests 'org.opensearch.ml.action.models.SearchModelTransportActionTests.test_RSC_featureEnabled_typeEnabled_callsGetAccessibleIds' -Dtests.seed=83E68BE5CBA8AF9D -Dtests.security.manager=false -Dtests.locale=en-AE -Dtests.timezone=America/Argentina/Mendoza -Druntime.java=21

SearchModelTransportActionTests > test_RSC_featureEnabled_typeEnabled_callsGetAccessibleIds FAILED
    Argument(s) are different! Wanted:
    resourceSharingClient.getAccessibleResourceIds(
        ".plugins-ml-model-group",
        <any>
    );
    -> at org.opensearch.ml.action.models.SearchModelTransportActionTests.test_RSC_featureEnabled_typeEnabled_callsGetAccessibleIds(SearchModelTransportActionTests.java:388)
    Actual invocations have different arguments at position [0]:
    resourceSharingClient.isFeatureEnabledForType(
        "ml-model-group"
    );
    -> at org.opensearch.ml.helper.ModelAccessControlHelper.shouldUseResourceAuthz(ModelAccessControlHelper.java:298)
    resourceSharingClient.getAccessibleResourceIds(
        "ml-model-group",
        org.opensearch.core.action.ActionListener$1@5a3247ce
    );
    -> at org.opensearch.ml.action.handler.MLSearchHandler.search(MLSearchHandler.java:158)
        at __randomizedtesting.SeedInfo.seed([83E68BE5CBA8AF9D:447841CA93562BD9]:0)

@cwperks
Copy link
Member Author

cwperks commented Nov 5, 2025

@cwperks can you look at this test and try reproduce locally?

REPRODUCE WITH: ./gradlew ':opensearch-ml-plugin:test' --tests 'org.opensearch.ml.action.models.SearchModelTransportActionTests.test_RSC_featureEnabled_typeEnabled_callsGetAccessibleIds' -Dtests.seed=83E68BE5CBA8AF9D -Dtests.security.manager=false -Dtests.locale=en-AE -Dtests.timezone=America/Argentina/Mendoza -Druntime.java=21

SearchModelTransportActionTests > test_RSC_featureEnabled_typeEnabled_callsGetAccessibleIds FAILED
    Argument(s) are different! Wanted:
    resourceSharingClient.getAccessibleResourceIds(
        ".plugins-ml-model-group",
        <any>
    );
    -> at org.opensearch.ml.action.models.SearchModelTransportActionTests.test_RSC_featureEnabled_typeEnabled_callsGetAccessibleIds(SearchModelTransportActionTests.java:388)
    Actual invocations have different arguments at position [0]:
    resourceSharingClient.isFeatureEnabledForType(
        "ml-model-group"
    );
    -> at org.opensearch.ml.helper.ModelAccessControlHelper.shouldUseResourceAuthz(ModelAccessControlHelper.java:298)
    resourceSharingClient.getAccessibleResourceIds(
        "ml-model-group",
        org.opensearch.core.action.ActionListener$1@5a3247ce
    );
    -> at org.opensearch.ml.action.handler.MLSearchHandler.search(MLSearchHandler.java:158)
        at __randomizedtesting.SeedInfo.seed([83E68BE5CBA8AF9D:447841CA93562BD9]:0)

looking, a few min

@cwperks
Fix test
880c96f 
Signed-off-by: Craig Perkins <[email protected]>
@cwperks
Copy link
Member Author

cwperks commented Nov 5, 2025

@mingshl pushed a commit to fix that test suite..my bad. I missed 2 instances to update.

@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval November 5, 2025 19:09 — with GitHub Actions Failure
@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval November 5, 2025 19:09 — with GitHub Actions Error
@cwperks cwperks temporarily deployed to ml-commons-cicd-env-require-approval November 5, 2025 19:09 — with GitHub Actions Inactive
@cwperks cwperks deployed to ml-commons-cicd-env-require-approval November 5, 2025 19:09 — with GitHub Actions Active
@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval November 5, 2025 20:39 — with GitHub Actions Failure
@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval November 5, 2025 20:39 — with GitHub Actions Error
@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval November 5, 2025 22:41 — with GitHub Actions Error
@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval November 5, 2025 22:41 — with GitHub Actions Failure
@cwperks cwperks mentioned this pull request Nov 5, 2025
Closed
3 tasks
@cwperks cwperks had a problem deploying to ml-commons-cicd-env-require-approval November 5, 2025 23:24 — with GitHub Actions Failure
@dhrubo-os
Copy link
Collaborator

dhrubo-os commented Nov 5, 2025

@peterzhuamazon can we override and merge? Couple integ test suites have passed already. This is blocking development.

@DarshitChanpura DarshitChanpura mentioned this pull request Nov 6, 2025
Open
@cwperks cwperks merged commit 4455206 into opensearch-project:main Nov 6, 2025
26 of 34 checks passed
@cwperks
Copy link
Member Author

cwperks commented Nov 6, 2025

@peterzhuamazon can we override and merge? Couple integ test suites have passed already. This is blocking development.

Merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dhrubo-os dhrubo-os dhrubo-os approved these changes

@pyek-bot pyek-bot pyek-bot approved these changes

@mingshl mingshl mingshl left review comments

@b4sjoo b4sjoo Awaiting requested review from b4sjoo b4sjoo is a code owner

@jngz-es jngz-es Awaiting requested review from jngz-es jngz-es is a code owner

@model-collapse model-collapse Awaiting requested review from model-collapse model-collapse is a code owner

@rbhavna rbhavna Awaiting requested review from rbhavna rbhavna is a code owner

@ylwu-amzn ylwu-amzn Awaiting requested review from ylwu-amzn ylwu-amzn is a code owner

@zane-neo zane-neo Awaiting requested review from zane-neo zane-neo is a code owner

@Zhangxunmt Zhangxunmt Awaiting requested review from Zhangxunmt Zhangxunmt is a code owner

@austintlee austintlee Awaiting requested review from austintlee austintlee is a code owner

@HenryL27 HenryL27 Awaiting requested review from HenryL27 HenryL27 is a code owner

@sam-herman sam-herman Awaiting requested review from sam-herman sam-herman is a code owner

@xinyual xinyual Awaiting requested review from xinyual xinyual is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@cwperks @rithin-pullela-aws @mingshl @dhrubo-os @pyek-bot