opensearch-project
Protected indices are marked for deprecation--they should no longer be marked this way.
I see a comment in ConfigConstants about the deprecation of protected indices.
// Protected indices settings. Marked for deprecation, after all config indices move to System indices.
protected indices, different from system indices, are indices that are given system index protection from the security plugin but are not formally system indices. I have not seen any use of protected indices in the demo configuration that is provided and it appears from the comment that it may have been used historically but has since been supplanted by system indices.
Should the security plugin continue to support protected indices or should these be removed in a future major version?
Task: Remove the message.
[Triage] Hi @cwperks, thank you for filing this issue. For the time being it seems like removing the logging output is the actionable task forward for this item.
@cwperks @scrawfor99 Interested in taking on this issue. What logging output are you referring to specifically? The comment or something else? Also what is this issue asking for, removing the protected indices from the codebase, or the logging that states that they are going to be deprecated since they are no longer marked? Thanks!
Hi @prabhask5, thanks for checking in :). This issue is just about removing the message for now. Since we follow Semver, there are a few things we need to do before we can completely remove the code. For now, you could open a PR to main removing the use since we have released at least one minor version with the deprecation notice. You just won't be able to backport that change since we cannot make breaking changes in minor releases.
The other thing you could do is make sure that there is a clear message logged when a used uses any of the protected index logic that way no one is caught by surprise in the eventual removal.
Hi @cwperks, I think we can remove this functionality starting version 3.x. I'm not sure that it uses broadly in any case. Since there is no documentation about it.
@willyborankin based on this comment from @shikharj05 : https://github.com/opensearch-project/security/pull/4471#discussion_r1655816275, these might still be needed
@willyborankin based on this comment from @shikharj05 : #4471 (comment), these might still be needed
Hm, interesting. We don't provide documentation for it. The old configuration doesn't seem to have it either: https://opendistro.github.io/for-elasticsearch-docs/docs/security/configuration/system-indices/
@willyborankin Agreed, I think we should document it. I found a reference, it's mentioned here- https://github.com/opensearch-project/security/blob/main/config/opensearch.yml.example#L214-L221
I will raise a PR to remove the deprecation notice.
Closing this issue as https://github.com/opensearch-project/security/pull/5056 has been merged