Skip to content

Fixes #35317: check hybrid search with a query, not the stored pipeline (backport 2.0 #35321) - #35325

Merged
manerow merged 1 commit into
2.0from
fix/35317-hybrid-pipeline-health-check-2.0
Oct 13, 2026
Merged

manerow merged 1 commit into
2.0from
fix/35317-hybrid-pipeline-health-check-2.0

Conversation

@manerow

@manerow manerow commented Oct 13, 2026 •

Copy link
Copy Markdown
Contributor

Issue

Cherry-pick of PR #35321 (Fixes #35317)

Shared free-tier clusters run 2.0.x, so this backport is what makes the Semantic search health check stop reporting a false "Forbidden access" failure for them. It ships in 2.0.6.

What this PR changes

The same change as on main: the health check sends a minimal hybrid query with the RRF pipeline inline to the deployment's own chunk index, instead of reading the stored hybrid-rrf pipeline that a prefix-scoped search role is not allowed to read. See PR #35321 for the full explanation.

The cherry-pick had one conflict, in the imports of OpenSearchVectorServiceTest: 2.0 does not have main's context-memory tests, so their imports were dropped and the two Jackson imports the new tests need were added. Every other file applies main's change line for line.

How it was tested

On this branch: OpenSearchVectorServiceTest, SearchRepositoryBehaviorTest, SystemRepositoryEmbeddingsValidationTest and ReindexingOrchestratorTest (170 tests), plus VectorEmbeddingIntegrationIT against OpenSearch 3.4.0 (10 tests), all passing.

@manerow
manerow requested a review from a team as a code owner October 13, 2026 08:41
@manerow manerow added safe to test Add this label to run secure Github workflows on PRs backend skip-pr-checks Bypass PR metadata validation check labels Oct 13, 2026
@manerow manerow self-assigned this Oct 13, 2026
@gitar-bot

gitar-bot Bot commented Oct 13, 2026 •

Copy link
Copy Markdown
Code Review ✅ Approved

🟡 Medium risk · The health check now executes a hybrid query instead of checking pipeline presence, so permission or query errors could incorrectly mark semantic search unavailable.

Health check for semantic search now sends a minimal hybrid query with the RRF pipeline inline to the deployment's own chunk index, instead of reading the stored hybrid-rrf pipeline that prefix-scoped roles cannot access. This backport of #35321 removes the false "Forbidden access" failure on shared free-tier 2.0.x clusters. No issues found.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

Auto-approval Not enabled

Set up

Options

Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Compact
gitar display:verbose         

Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source

@manerow
manerow merged commit f83e4ef into 2.0 Oct 13, 2026
94 of 107 checks passed
@manerow
manerow deleted the fix/35317-hybrid-pipeline-health-check-2.0 branch October 13, 2026 11:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backend safe to test Add this label to run secure Github workflows on PRs skip-pr-checks Bypass PR metadata validation check

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants