[FEATURE] Make `opensearch_security.multitenancy.tenants.preferred` dynamic via Security config (similar to 2.7 multitenancy)

[cwperks]

Summary

Today, the opensearch_security.multitenancy.tenants.preferred setting is configured statically in opensearch_dashboards.yml. In order to change the value of this setting requires OSD node reboots unlike other dynamic security dashboards settings.

In OpenSearch 2.7, we made a change to make multi-tenancy dynamic, allowing it to be managed via the Security config and updated without requiring a Dashboards restart:

• Backend: Dynamic tenancy configurations #2607
• Frontend: Dynamic tenancy configurations security-dashboards-plugin#1394

This issue proposes making opensearch_security.multitenancy.tenants.preferred configurable dynamically via the Security configuration API in OpenSearch, instead of being solely controlled via opensearch_dashboards.yml.

---

Problem Statement

Currently:

opensearch_security.multitenancy.tenants.preferred: ["Private", "Global"]

• This setting is defined statically in opensearch_dashboards.yml
• Changes require a Dashboards restart

---

Proposed Design

Backend (Security plugin)

1. Extend Security Config

• Extend securityconfig to include a preferred_tenants setting under kibana.

Example (illustrative):

{
  "dynamic": {
    "kibana": {
      ...
      "multitenancy_enabled": true,
      "preferred_tenants": ["Private", "Global"]
    }
  }
}

2. Expose via /_plugins/_security/dashboardsinfo

The value should be returned by the /_plugins/_security/dashboardsinfo endpoint.

This keeps Dashboards configuration fetch centralized and consistent.

Example (illustrative):

{
  ...
  "multitenancy_enabled": true,
  "preferred_tenants": ["Private", "Global"]
}

Frontend (Security Dashboards Plugin)

• Similar pattern to:

  • Dynamic tenancy configurations security-dashboards-plugin#1394

• Fetch preferred tenants from the Security config instead of only reading from opensearch_dashboards.yml.

• Maintain backward compatibility:

  • If dynamic config is absent → fallback to opensearch_dashboards.yml
  • If both exist → dynamic config takes precedence

---

Backward Compatibility

• Default behavior remains unchanged if no dynamic setting is defined.
• Static opensearch_dashboards.yml continues to work.
• No breaking changes to existing configurations.

Related Work

• Dynamic multitenancy (2.7)

  • Backend: Dynamic tenancy configurations #2607
  • Frontend: Dynamic tenancy configurations security-dashboards-plugin#1394