What
Remove the pre-graduation resource sharing setting names and everything supporting them:
ConfigConstants.OPENSEARCH_LEGACY_RESOURCE_SHARING_ENABLED and OPENSEARCH_LEGACY_RESOURCE_SHARING_PROTECTED_TYPESResourceSharingFeatureFlagSetting.LEGACY_RESOURCE_SHARING_ENABLED and RESOURCE_SHARING_ENABLED_UPGRADERResourceSharingProtectedResourcesSetting.LEGACY_PROTECTED_TYPES and PROTECTED_TYPES_UPGRADER- the two legacy registrations in
OpenSearchSecurityPlugin#getSettings() and the getSettingUpgraders() override
- the
warnIfLegacyKeyInUse helpers in both setting classes
RESOURCE_SHARING_ENABLED and PROTECTED_TYPES then take a plain default value again instead of a fallback setting.
Why
Resource sharing graduated out of experimental in 3.9 (#6348), which renamed both feature-flag settings:
| Deprecated |
Current |
plugins.security.experimental.resource_sharing.enabled |
plugins.security.resource_sharing.enabled |
plugins.security.experimental.resource_sharing.protected_types |
plugins.security.resource_sharing.protected_types |
#6513 kept the pre-graduation names working as deprecated aliases so that a cluster configured before 3.9 could upgrade without a configuration change first. A major version is where deprecated settings get removed, so the aliases should not outlive 3.x.
Effect on users
After removal, an opensearch.yml that still uses a pre-graduation name stops the node from starting with an unknown setting error, and a cluster setting under a pre-graduation name is archived and the feature returns to its default of disabled.
Since 3.9 the deprecation has been surfaced two ways — the standard deprecated-setting warning, plus an explicit log line naming the replacement — and the setting upgraders rewrite stored cluster settings to the current names during cluster-state recovery. A cluster that has restarted at least once on 3.9 or later will therefore already be on the current names, leaving only opensearch.yml to rename by hand.
Also in scope
- Replace the deprecation note in
RESOURCE_SHARING_AND_ACCESS_CONTROL.md with a 4.0 breaking-change entry.
- Open a companion documentation-website change removing the deprecation note from
_security/access-control/resources.md.
ResourceSharingSettingMigrationTests is removed along with the aliases.
What
Remove the pre-graduation resource sharing setting names and everything supporting them:
ConfigConstants.OPENSEARCH_LEGACY_RESOURCE_SHARING_ENABLEDandOPENSEARCH_LEGACY_RESOURCE_SHARING_PROTECTED_TYPESResourceSharingFeatureFlagSetting.LEGACY_RESOURCE_SHARING_ENABLEDandRESOURCE_SHARING_ENABLED_UPGRADERResourceSharingProtectedResourcesSetting.LEGACY_PROTECTED_TYPESandPROTECTED_TYPES_UPGRADEROpenSearchSecurityPlugin#getSettings()and thegetSettingUpgraders()overridewarnIfLegacyKeyInUsehelpers in both setting classesRESOURCE_SHARING_ENABLEDandPROTECTED_TYPESthen take a plain default value again instead of a fallback setting.Why
Resource sharing graduated out of experimental in 3.9 (#6348), which renamed both feature-flag settings:
plugins.security.experimental.resource_sharing.enabledplugins.security.resource_sharing.enabledplugins.security.experimental.resource_sharing.protected_typesplugins.security.resource_sharing.protected_types#6513 kept the pre-graduation names working as deprecated aliases so that a cluster configured before 3.9 could upgrade without a configuration change first. A major version is where deprecated settings get removed, so the aliases should not outlive 3.x.
Effect on users
After removal, an
opensearch.ymlthat still uses a pre-graduation name stops the node from starting with an unknown setting error, and a cluster setting under a pre-graduation name is archived and the feature returns to its default of disabled.Since 3.9 the deprecation has been surfaced two ways — the standard deprecated-setting warning, plus an explicit log line naming the replacement — and the setting upgraders rewrite stored cluster settings to the current names during cluster-state recovery. A cluster that has restarted at least once on 3.9 or later will therefore already be on the current names, leaving only
opensearch.ymlto rename by hand.Also in scope
RESOURCE_SHARING_AND_ACCESS_CONTROL.mdwith a 4.0 breaking-change entry._security/access-control/resources.md.ResourceSharingSettingMigrationTestsis removed along with the aliases.