Repository navigation
Docs: Add OpenSearch FGAC permissions guide - #599
Shahzeb-DataEngineer wants to merge 2 commits into
Conversation
Documents the minimal OpenSearch security permissions the OpenMetadata server backend needs when running against a security-enabled cluster (FGAC / security plugin), scoped to 2.0.x and verified against the 2.0.5 search-client source. Includes index patterns, cluster permissions with 'when needed' guidance, a ready-to-use role example, and the permission changes across releases (1.6.6, 1.13.x, 2.x).
ayush-shah
left a comment
ayush-shah
left a comment
There was a problem hiding this comment.
Potential finding on the reviewed commit; please verify the scenario below.
| { | ||
| "index_patterns": ["openmetadata_*", "openmetadata-di-*"], | ||
| "allowed_actions": [ | ||
| "crud", |
There was a problem hiding this comment.
[Potential P2] Include index creation in the example security role
Copying this ready-to-use role for an OpenMetadata 2.0.5 server denies creation of its entity search indexes: crud grants data reads/writes, but no listed action grants indices:admin/create. The pinned 2.0.5 OpenSearchIndexManager explicitly calls client.indices().create(...), so initializing or rebuilding missing indexes cannot complete with this role alone. Add create_index (or indices:admin/create) on the entity index pattern and verify the complete role on a fresh FGAC deployment.
There was a problem hiding this comment.
Good catch, thanks. Verified against the 2.0.5 OpenSearchIndexManager, which calls client.indices().create(...) when initializing missing indexes, and crud does not grant indices:admin/create. Added the create_index action group to the example role and mentioned index creation in the operations list.
The crud action group does not grant indices:admin/create, but the 2.0.5 OpenSearchIndexManager calls client.indices().create(...) when initializing missing entity search indexes, so a role copied from this example could not create them. Add the create_index action group to the example role and mention index creation in the operations list. Signed-off-by: Shahzeb Ali <126076773+Shahzeb-DataEngineer@users.noreply.github.com>
Related: open-metadata/OpenMetadata#29856
Adds a documentation page listing the minimal OpenSearch security permissions the OpenMetadata server backend needs when running against a security-enabled cluster (FGAC / security plugin).
What the page covers
<prefix>_*,<prefix>-di-*) for entity indexes and Data Insights streamsVerification
Scoped to 2.0.x and checked against the 2.0.5 search-client source (
OpenSearchClient,OpenSearchEntityManager,OpenSearchGenericManager,OpenSearchVectorService,OpenSearchDataInsightsClient). Key deltas vs the issue's 1.13.1 enumeration: ISM policy management was removed in 2.x (only migration-cleanup DELETE remains, socluster:admin/opendistro/ism/policy/*is migration-only), and the hybrid-search pipeline became best-effort (ad-hoc inlined pipelines need no cluster privilege), socluster:admin/search/pipeline/*is now optional.For reviewers — two judgment calls worth confirming:
.ds-<prefix>-di-*backing-index pattern is documented as no longer needed on 2.x (nothing targets.ds-*directly since ISM removal), but this was verified from source, not a live FGAC cluster.Also linked from the EKS deployment page (the reporter's environment) and registered in
menu.md.