Add plugin system indices to the default restorable list (#6691)

Signed-off-by: Sharath Kanaka <sharatcr@amazon.com>
Co-authored-by: Sharath Kanaka <sharatcr@amazon.com>

Author: sharathkanaka

README.md

@@ -134,11 +134,17 @@ The Security plugin protects system indices registered by OpenSearch plugins. Th
 indices through `SystemIndexPlugin.getSystemIndexDescriptors`.
 
 Users whose mapped roles are listed in `plugins.security.restapi.roles_enabled` can restore only the system indices matched by
-`plugins.security.system_indices.restore.indices`. The default list is empty today. System indices will be added to it as their
-plugin owners confirm they restore safely. An operator sets the list in `opensearch.yml`. To also allow changing it at runtime
-with `PUT _cluster/settings`, set `plugins.security.system_indices.restore.dynamic.enabled: true` in `opensearch.yml`; the runtime
-value then takes precedence over the file. A configured value replaces the default list and is not merged
-with it. The Security configuration index can never be restored this way:
+`plugins.security.system_indices.restore.indices`. By default it holds plugin system indices that restore correctly onto a new
+cluster. To see the default list, run:
+
+```
+GET _cluster/settings?include_defaults=true&filter_path=defaults.plugins.security.system_indices.restore.indices
+```
+
+An operator can override the list in `opensearch.yml`, and a configured value replaces the default list rather than adding to
+it. To also allow changing it at runtime with `PUT _cluster/settings`, set `plugins.security.system_indices.restore.dynamic.enabled: true`
+in `opensearch.yml`; the runtime value then takes precedence over the file. The Security configuration index can never be
+restored this way:
 
 ```
 plugins.security.system_indices.restore.indices:

src/integrationTest/java/org/opensearch/security/privileges/int_tests/SystemIndexRestoreDefaultIntTests.java

@@ -26,18 +26,19 @@
 
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.containsString;
-import static org.hamcrest.Matchers.not;
 import static org.opensearch.security.privileges.int_tests.SystemIndexRestoreIntTests.ELIGIBLE;
+import static org.opensearch.security.privileges.int_tests.SystemIndexRestoreIntTests.NOT_ELIGIBLE;
 import static org.opensearch.security.privileges.int_tests.SystemIndexRestoreIntTests.REST_ADMIN;
 import static org.opensearch.security.privileges.int_tests.SystemIndexRestoreIntTests.cleanup;
 import static org.opensearch.security.privileges.int_tests.SystemIndexRestoreIntTests.createIndicesAndSnapshot;
 import static org.opensearch.security.privileges.int_tests.SystemIndexRestoreIntTests.restorePath;
 import static org.opensearch.test.framework.cluster.TestRestClient.json;
 import static org.opensearch.test.framework.matcher.RestMatchers.isForbidden;
+import static org.opensearch.test.framework.matcher.RestMatchers.isOk;
 
 /**
- * With {@code plugins.security.system_indices.restore.indices} left at its empty default, a REST admin cannot
- * restore any system index, for both the legacy and the V4 privilege evaluation.
+ * With {@code plugins.security.system_indices.restore.indices} left at its default, a REST admin can restore the system
+ * indices in the default list and no others, for both the legacy and the V4 privilege evaluation.
  */
 @RunWith(Parameterized.class)
 public class SystemIndexRestoreDefaultIntTests {
@@ -50,18 +51,29 @@ public class SystemIndexRestoreDefaultIntTests {
     final LocalCluster cluster;
 
     @Test
-    public void restAdmin_cannotRestoreSystemIndexWhenNoneConfigured() {
+    public void restAdmin_restoresSystemIndicesInDefaultList() {
         createIndicesAndSnapshot(cluster, "snap_default", ELIGIBLE);
         try (TestRestClient client = cluster.getRestClient(REST_ADMIN)) {
             TestRestClient.HttpResponse response = client.post(restorePath("snap_default"), json("indices", List.of(ELIGIBLE)));
-            assertThat(response, isForbidden());
-            assertThat(response.getBody(), containsString("[" + ELIGIBLE + "] are not eligible for restore."));
-            assertThat(response.getBody(), not(containsString("Restorable system indices")));
+            assertThat(response, isOk());
         } finally {
             cleanup(cluster, "snap_default", ELIGIBLE);
         }
     }
 
+    @Test
+    public void restAdmin_cannotRestoreSystemIndexOutsideDefaultList() {
+        createIndicesAndSnapshot(cluster, "snap_not_in_default", NOT_ELIGIBLE);
+        try (TestRestClient client = cluster.getRestClient(REST_ADMIN)) {
+            TestRestClient.HttpResponse response = client.post(restorePath("snap_not_in_default"), json("indices", List.of(NOT_ELIGIBLE)));
+            assertThat(response, isForbidden());
+            assertThat(response.getBody(), containsString("[" + NOT_ELIGIBLE + "] are not eligible for restore."));
+            assertThat(response.getBody(), containsString("Restorable system indices: [" + ELIGIBLE));
+        } finally {
+            cleanup(cluster, "snap_not_in_default", NOT_ELIGIBLE);
+        }
+    }
+
     @Parameters(name = "{0}")
     public static Collection<Object[]> params() {
         List<Object[]> result = new ArrayList<>();

src/integrationTest/java/org/opensearch/security/privileges/int_tests/SystemIndexRestoreIntTests.java

@@ -52,7 +52,7 @@
 public class SystemIndexRestoreIntTests {
 
     static final String ELIGIBLE = ".opendistro-alerting-config";
-    static final String NOT_ELIGIBLE = ".opendistro-alerting-alerts";
+    static final String NOT_ELIGIBLE = ".opensearch-alerting-queries";
     static final String HISTORY_PATTERN = ".opendistro-alerting-alert-history-*";
     static final String HISTORY_1 = ".opendistro-alerting-alert-history-2026.10.27-1";
     static final String HISTORY_2 = ".opendistro-alerting-alert-history-2026.10.28-000002";
@@ -92,7 +92,7 @@ static LocalCluster.Builder dynamicClusterBuilder() {
     }
 
     /**
-     * Cluster with {@code plugins.security.system_indices.restore.indices} left at its empty default.
+     * Cluster with {@code plugins.security.system_indices.restore.indices} left at its default.
      */
     static LocalCluster.Builder defaultClusterBuilder() {
         return new LocalCluster.Builder().clusterManager(ClusterManager.SINGLENODE)

src/main/java/org/opensearch/security/support/ConfigConstants.java

@@ -415,7 +415,17 @@ public class ConfigConstants {
     public static final String SECURITY_SYSTEM_INDICES_KEY = SECURITY_SETTINGS_PREFIX + "system_indices.indices";
     public static final List<String> SECURITY_SYSTEM_INDICES_DEFAULT = Collections.emptyList();
     public static final String SECURITY_SYSTEM_INDICES_RESTORE_INDICES_KEY = SECURITY_SETTINGS_PREFIX + "system_indices.restore.indices";
-    public static final List<String> SECURITY_SYSTEM_INDICES_RESTORE_INDICES_DEFAULT = Collections.emptyList();
+    /**
+     * System indices that restore correctly onto a new cluster, covered by restore tests in each plugin's repo
+     * (same OpenSearch version).
+     */
+    public static final List<String> SECURITY_SYSTEM_INDICES_RESTORE_INDICES_DEFAULT = List.of(
+        ".opendistro-alerting-config",
+        ".opendistro-alerting-alerts",
+        ".opendistro-alerting-alert-history-*",
+        ".opendistro-ism-config",
+        ".ltrstore*"
+    );
     public static final String SECURITY_SYSTEM_INDICES_RESTORE_DYNAMIC_ENABLED_KEY = SECURITY_SETTINGS_PREFIX
         + "system_indices.restore.dynamic.enabled";
     public static final boolean SECURITY_SYSTEM_INDICES_RESTORE_DYNAMIC_ENABLED_DEFAULT = false;

src/test/java/org/opensearch/security/privileges/SystemIndexRestoreEligibilityHelperTest.java

@@ -112,9 +112,12 @@ public void isEligible_matchesConfiguredIndicesAndPatterns() {
     }
 
     @Test
-    public void isEligible_nothingByDefault() {
-        assertThat(helperWithDefaults.isEligible(ALERTING_CONFIG), is(false));
+    public void isEligible_defaultListCoversConfirmedPluginIndices() {
+        for (final String index : ConfigConstants.SECURITY_SYSTEM_INDICES_RESTORE_INDICES_DEFAULT) {
+            assertThat(index, helperWithDefaults.isEligible(index), is(true));
+        }
         assertThat(helperWithDefaults.isEligible(REPORTS_DEFINITIONS), is(false));
+        assertThat(helperWithDefaults.isEligible(SECURITY_INDEX), is(false));
     }
 
     @Test
@@ -140,7 +143,10 @@ public void denialReason_listsNonEligibleAndTheRestorableIndices() {
 
     @Test
     public void denialReason_omitsRestorableIndicesWhenNoneConfigured() {
-        Optional<String> reason = helperWithDefaults.denialReason(restore(ALERTING_CONFIG), Set.of(ALERTING_CONFIG));
+        SystemIndexRestoreEligibilityHelper noneConfigured = helper(
+            Settings.builder().putList(ConfigConstants.SECURITY_SYSTEM_INDICES_RESTORE_INDICES_KEY, List.of()).build()
+        );
+        Optional<String> reason = noneConfigured.denialReason(restore(ALERTING_CONFIG), Set.of(ALERTING_CONFIG));
         assertThat(
             reason.get(),
             equalTo("System index restore denied: System indices [" + ALERTING_CONFIG + "] are not eligible for restore.")