Skip to content

[3.1 backport] Introduced setting for disabling denormalized privilege data structures#5483

Merged
cwperks merged 1 commit intoopensearch-project:3.1from
nibix:privileges-denormalized-datastructures-switch-3.1
Jul 17, 2025
Merged

[3.1 backport] Introduced setting for disabling denormalized privilege data structures#5483
cwperks merged 1 commit intoopensearch-project:3.1from
nibix:privileges-denormalized-datastructures-switch-3.1

Conversation

@nibix
Copy link
Collaborator

@nibix nibix commented Jul 17, 2025

Description

Backport from #5465

This introduces the setting plugins.security.privileges_evaluation.precomputed_privileges.enabled which can be used to disable the creation of denormalized privilege data structures. It is enabled by default to provide the best action throughput. It can make sense to disable the setting when it is seen that the initialisation process takes so much time/resources that it negatively affects the cluster performance (like observed in #5464) . This come at the price of a reduced action throughput.

  • Category: Enhancement
  • Why these changes are required? Operational safety
  • What is the old behavior before changes and new behavior after changes? No behavioral changes.

Testing

  • Unit testing

Check List

  • New functionality includes testing
  • New functionality has been documented
  • Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

…e data structures

Signed-off-by: Nils Bandener <nils.bandener@eliatra.com>
@nibix nibix force-pushed the privileges-denormalized-datastructures-switch-3.1 branch from b8f131b to 3e5e6a2 Compare July 17, 2025 09:52
@nibix
Copy link
Collaborator Author

nibix commented Jul 17, 2025

The checks are in a weird state ... according to https://github.com/opensearch-project/security/pull/5483/checks all checks are green. Not sure how to proceed. 🤔

@nibix
Copy link
Collaborator Author

nibix commented Jul 17, 2025

@cwperks @shikharj05 I could not find any way to fix the stuck checks, so I filed a replacement PR at #5484

@nibix nibix closed this Jul 17, 2025
@nibix nibix reopened this Jul 17, 2025
@nagarajg17
Copy link
Contributor

@nibix Looks like replacement PR is in similar state #5484

@cwperks
Copy link
Member

cwperks commented Jul 17, 2025

@nibix They are not stuck. We need to update the branch protection rules to remove these required checks in 3.1. We do not run checks against JVM < 21 for 3.x line.

@cwperks cwperks merged commit 3980602 into opensearch-project:3.1 Jul 17, 2025
207 checks passed
@nibix
Copy link
Collaborator Author

nibix commented Jul 17, 2025

Thank you for merging!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants