Graduate resource sharing feature out of experimental by DarshitChanpura · Pull Request #6348 · opensearch-project/security

DarshitChanpura · 2026-07-29T22:58:58Z

Description

Graduates the Resource Sharing & Access Control feature out of experimental.

Breaking change (no deprecated fallback): the feature-flag settings are renamed to drop the .experimental segment:

Before	After
`plugins.security.experimental.resource_sharing.enabled`	`plugins.security.resource_sharing.enabled`
`plugins.security.experimental.resource_sharing.protected_types`	`plugins.security.resource_sharing.protected_types`

Only the string values in ConfigConstants change — the constant names (OPENSEARCH_RESOURCE_SHARING_ENABLED, OPENSEARCH_RESOURCE_SHARING_PROTECTED_TYPES) are unchanged, so downstream Java references are unaffected.

Also:

Removes the @opensearch.experimental javadoc annotations from the resource-sharing SPI and implementation classes (leaves the unrelated SecurityConfigExtension marker in place).
Updates RESOURCE_SHARING_AND_ACCESS_CONTROL.md (setting keys + drops the "experimental" note).

Because the rename is breaking and has no fallback, this must ship in 3.9 together with the downstream references. Coordinated changes are being made to:

documentation-website (setting keys + removal of experimental warning callouts)
plugin CIs that toggle the flag: reporting, anomaly-detection, ml-commons, notifications, alerting, flow-framework, security-analytics

Draft while those companion PRs are prepared and reviewed.

Related Issues

Related to #4500

Check List

New functionality includes testing
New functionality has been documented
Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

github-actions · 2026-07-29T23:00:15Z

PR Reviewer Guide 🔍

(Review updated until commit `dbcb3c0`)

Here are some key observations to aid the review process:

🧪 No relevant tests
🔒 No security concerns identified
✅ No TODO sections
🔀 No multiple PR themes
⚡ No major issues detected

github-actions · 2026-07-29T23:00:37Z

PR Code Suggestions ✨

Latest suggestions up to dbcb3c0

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Provide fallback for renamed settings keys Renaming the settings keys with no fallback is a hard breaking change: existing clusters with `plugins.security.experimental.resource_sharing.*` in `opensearch.yml` will fail to start with an `unknown setting` error, and persistent cluster settings will be archived and silently reset to defaults. Consider registering the old keys as deprecated aliases (or fallback settings) that map to the new names for at least one release, logging a deprecation warning, to enable a safe rolling upgrade. src/main/java/org/opensearch/security/support/ConfigConstants.java [457-462] public static final String OPENSEARCH_RESOURCE_SHARING_ENABLED = "plugins.security.resource_sharing.enabled"; +public static final String OPENSEARCH_RESOURCE_SHARING_ENABLED_LEGACY = "plugins.security.experimental.resource_sharing.enabled"; public static final boolean OPENSEARCH_RESOURCE_SHARING_ENABLED_DEFAULT = false; // Protected resource types // Resource sharing will only apply to these types public static final String OPENSEARCH_RESOURCE_SHARING_PROTECTED_TYPES = "plugins.security.resource_sharing.protected_types"; +public static final String OPENSEARCH_RESOURCE_SHARING_PROTECTED_TYPES_LEGACY = "plugins.security.experimental.resource_sharing.protected_types"; Suggestion importance[1-10]: 7 __ Why: The suggestion correctly identifies a breaking change concern from renaming settings without fallback, which the PR itself acknowledges in the documentation. Adding legacy aliases would ease upgrades, though the PR intentionally makes this a breaking change as the feature graduates from experimental.	Medium

Previous suggestions

Suggestions up to commit 4954a66

Category	Suggestion	Impact
General	Provide deprecated fallback for renamed settings Renaming these settings without providing a fallback/alias is a breaking change that will cause nodes to fail startup with `unknown setting` if the old `plugins.security.experimental.resource_sharing.*` keys are still present in `opensearch.yml`. Consider registering the old keys as deprecated fallbacks (e.g., via `Setting.Property.Deprecated` or a fallback setting) so users can upgrade smoothly, rather than requiring manual config edits before upgrade. src/main/java/org/opensearch/security/support/ConfigConstants.java [433-438] public static final String OPENSEARCH_RESOURCE_SHARING_ENABLED = "plugins.security.resource_sharing.enabled"; +public static final String OPENSEARCH_RESOURCE_SHARING_ENABLED_DEPRECATED = "plugins.security.experimental.resource_sharing.enabled"; public static final boolean OPENSEARCH_RESOURCE_SHARING_ENABLED_DEFAULT = false; // Protected resource types // Resource sharing will only apply to these types public static final String OPENSEARCH_RESOURCE_SHARING_PROTECTED_TYPES = "plugins.security.resource_sharing.protected_types"; +public static final String OPENSEARCH_RESOURCE_SHARING_PROTECTED_TYPES_DEPRECATED = "plugins.security.experimental.resource_sharing.protected_types"; Suggestion importance[1-10]: 7 __ Why: The suggestion raises a valid concern about backward compatibility, as the PR explicitly documents this as a breaking change. Adding deprecated fallback aliases would improve the upgrade experience, though the PR authors intentionally chose to make this a hard break with clear documentation.	Medium

Suggestions up to commit 739106b

Category	Suggestion	Impact
General	Provide backward-compatible fallback for renamed settings Renaming these settings keys is a breaking change for existing users who have already configured the experimental settings. Consider registering the old `plugins.security.experimental.resource_sharing.*` keys as deprecated fallbacks so existing configurations continue to function while emitting a deprecation warning. src/main/java/org/opensearch/security/support/ConfigConstants.java [433-438] public static final String OPENSEARCH_RESOURCE_SHARING_ENABLED = "plugins.security.resource_sharing.enabled"; +public static final String OPENSEARCH_RESOURCE_SHARING_ENABLED_DEPRECATED = "plugins.security.experimental.resource_sharing.enabled"; public static final boolean OPENSEARCH_RESOURCE_SHARING_ENABLED_DEFAULT = false; // Protected resource types // Resource sharing will only apply to these types public static final String OPENSEARCH_RESOURCE_SHARING_PROTECTED_TYPES = "plugins.security.resource_sharing.protected_types"; +public static final String OPENSEARCH_RESOURCE_SHARING_PROTECTED_TYPES_DEPRECATED = "plugins.security.experimental.resource_sharing.protected_types"; Suggestion importance[1-10]: 5 __ Why: Since the feature was marked as experimental, renaming may be acceptable without backward compatibility, but providing a deprecated fallback is a reasonable improvement to avoid breaking existing configurations. Moderate impact.	Low

codecov · 2026-07-29T23:29:17Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.98%. Comparing base (cc0880f) to head (dbcb3c0).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6348      +/-   ##
==========================================
+ Coverage   75.97%   75.98%   +0.01%     
==========================================
  Files         461      461              
  Lines       30920    30920              
  Branches     4668     4668              
==========================================
+ Hits        23492    23496       +4     
+ Misses       5270     5268       -2     
+ Partials     2158     2156       -2

Files with missing lines	Coverage Δ
...earch/security/spi/resources/ResourceProvider.java	`83.33% <ø> (ø)`
...curity/spi/resources/ResourceSharingExtension.java	`100.00% <ø> (ø)`
...ecurity/resources/ResourceAccessControlClient.java	`40.00% <ø> (ø)`
...arch/security/resources/ResourceAccessHandler.java	`76.28% <ø> (ø)`
...arch/security/resources/ResourceIndexListener.java	`87.23% <ø> (-1.07%)`	⬇️
...nsearch/security/resources/ResourcePluginInfo.java	`84.33% <ø> (ø)`
...ecurity/resources/ResourceSharingIndexHandler.java	`71.16% <ø> (+0.73%)`	⬆️
...ensearch/security/resources/sharing/CreatedBy.java	`100.00% <ø> (ø)`
...ensearch/security/resources/sharing/Recipient.java	`100.00% <ø> (ø)`
...nsearch/security/resources/sharing/Recipients.java	`73.68% <ø> (ø)`
... and 3 more

... and 5 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Renames the resource sharing feature-flag settings, dropping the '.experimental' segment (breaking change, no deprecated fallback): plugins.security.experimental.resource_sharing.enabled -> plugins.security.resource_sharing.enabled plugins.security.experimental.resource_sharing.protected_types -> plugins.security.resource_sharing.protected_types Also removes the @opensearch.experimental annotations from the resource-sharing SPI and implementation classes, and updates RESOURCE_SHARING_AND_ACCESS_CONTROL.md accordingly. Related to opensearch-project#4500 Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

github-actions · 2026-07-30T00:18:29Z

Persistent review updated to latest commit 4954a66

cwperks · 2026-07-30T10:29:23Z

@DarshitChanpura until there's a clear path with workspaces like proposed in #6119 I don't think this should be promoted out of experimental.

Let's get a consistent platform level experience for sharing.

I'm very strongly supportive of the ownership model where owner gets to choose sharing and I think the fact that workspaces was developed in a way where workspaces have owners that invite collaborators is testament to that being the desired model.

Workspace collaborators being controlled by the frontend is a problem and we need to figure out the path forward that works with workspaces desire to be supported with MDS (Multiple Data Sources). If that problem can be solved then there's clear line-of-sight to graduating from experimental.

Edit: @DarshitChanpura can we focus the efforts on adding a share button inside a dashboards plugin (like reporting) that at least with multi-tenancy is tenant aware. idk if reporting plugin is workspace aware atm and I know some teams had this notion of workspace acl (how does that work?)

If we can show MDS working with resource sharing where the currently toggled cluster supports resource sharing and share button appears than that would probably be a good place to begin. We certainly are going to want to work backwards from UX so that these share APIs can be conveniently called from the frontend and we should also have something similar to #6107 to power new experiences on Dashboards where we can enable/disable actions based on user permissions.

DarshitChanpura · 2026-07-31T00:06:16Z

@DarshitChanpura can we focus the efforts on adding a share button inside a dashboards plugin (like reporting) that at least with multi-tenancy is tenant aware.

Hahaa, here is the centralized share button PR: opensearch-project/security-dashboards-plugin#2491. I've used AD as example but you get the gist.

@DarshitChanpura until there's a clear path with workspaces

While I agree that workspaces could leverage from the ownership model, I disagree on not taking this feature out of experimental. We should not delay this feature by tying it with workspaces improvement.

cwperks · 2026-07-31T16:54:38Z

While I agree that workspaces could leverage from the ownership model, I disagree on not taking this feature out of experimental. We should not delay this feature by tying it with workspaces improvement.

No they need to be compatible and I would block on that. Let's figure out the path forward.

github-actions · 2026-09-15T21:10:53Z

Persistent review updated to latest commit dbcb3c0

Resource sharing graduates out of experimental in opensearch-project/security#6348, which drops the experimental. segment from the feature-flag settings with no deprecated fallback: plugins.security.experimental.resource_sharing.enabled -> plugins.security.resource_sharing.enabled plugins.security.experimental.resource_sharing.protected_types -> plugins.security.resource_sharing.protected_types Updates the integTest cluster settings to the new keys. Only the setting strings change. The ConfigConstants constant names (OPENSEARCH_RESOURCE_SHARING_ENABLED, OPENSEARCH_RESOURCE_SHARING_PROTECTED_TYPES) are unchanged, so no Java/Kotlin references are affected. The gradle -Dresource_sharing.enabled system property that gates the CI matrix is a separate toggle and is left as is. Verified no occurrence of the old key remains anywhere in the repo. Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

Resource sharing graduates out of experimental in opensearch-project/security#6348, which drops the experimental. segment from the feature-flag settings with no deprecated fallback: plugins.security.experimental.resource_sharing.enabled -> plugins.security.resource_sharing.enabled plugins.security.experimental.resource_sharing.protected_types -> plugins.security.resource_sharing.protected_types - Renames the setting keys across the 12 pages that document them. - Removes the experimental warning callout from the 13 resource sharing pages, including the resource sharing API reference. - Drops the pointers to the experimental feature flags page, which no longer applies to these settings. - Adds an upgrade note on the security resource sharing page: the old keys are not recognized, a node that still has one fails to start, and a persistent cluster setting under an old key is archived on upgrade. The "Introduced 3.3" labels and the 3.3/3.4 static-versus-dynamic notes are left as is; they still describe the feature's history accurately. Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

DarshitChanpura · 2026-09-15T22:18:57Z

Related workspaces PR has been merged and this one is unblocked now

Resource sharing graduates out of experimental in opensearch-project/security#6348, which drops the experimental. segment from the feature-flag settings with no deprecated fallback: plugins.security.experimental.resource_sharing.enabled -> plugins.security.resource_sharing.enabled plugins.security.experimental.resource_sharing.protected_types -> plugins.security.resource_sharing.protected_types Updates the integTest cluster settings to the new keys. Only the setting strings change. The ConfigConstants constant names (OPENSEARCH_RESOURCE_SHARING_ENABLED, OPENSEARCH_RESOURCE_SHARING_PROTECTED_TYPES) are unchanged, so no Java/Kotlin references are affected. The gradle -Dresource_sharing.enabled system property that gates the CI matrix is a separate toggle and is left as is. Verified no occurrence of the old key remains anywhere in the repo. Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

Resource sharing graduates out of experimental in opensearch-project/security#6348, which drops the experimental. segment from the feature-flag settings with no deprecated fallback: plugins.security.experimental.resource_sharing.enabled -> plugins.security.resource_sharing.enabled plugins.security.experimental.resource_sharing.protected_types -> plugins.security.resource_sharing.protected_types Updates the integTest cluster settings and the resource-sharing toggle helper in PluginRestTestCase to the new keys. Only the setting strings change. The ConfigConstants constant names (OPENSEARCH_RESOURCE_SHARING_ENABLED, OPENSEARCH_RESOURCE_SHARING_PROTECTED_TYPES) are unchanged, so no Java/Kotlin references are affected. The gradle -Dresource_sharing.enabled system property that gates the CI matrix is a separate toggle and is left as is. Verified no occurrence of the old key remains anywhere in the repo. Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

Resource sharing graduates out of experimental in opensearch-project/security#6348, which drops the experimental. segment from the feature-flag settings with no deprecated fallback: plugins.security.experimental.resource_sharing.enabled -> plugins.security.resource_sharing.enabled plugins.security.experimental.resource_sharing.protected_types -> plugins.security.resource_sharing.protected_types Updates the integTest cluster settings to the new keys. Only the setting strings change. The ConfigConstants constant names (OPENSEARCH_RESOURCE_SHARING_ENABLED, OPENSEARCH_RESOURCE_SHARING_PROTECTED_TYPES) are unchanged, so no Java/Kotlin references are affected. The gradle -Dresource_sharing.enabled system property that gates the CI matrix is a separate toggle and is left as is. Verified no occurrence of the old key remains anywhere in the repo. Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

Resource sharing graduates out of experimental in opensearch-project/security#6348, which drops the experimental. segment from the feature-flag settings with no deprecated fallback: plugins.security.experimental.resource_sharing.enabled -> plugins.security.resource_sharing.enabled plugins.security.experimental.resource_sharing.protected_types -> plugins.security.resource_sharing.protected_types - Renames the setting keys across the 12 pages that document them. - Removes the experimental warning callout from the 13 resource sharing pages, including the resource sharing API reference. - Drops the pointers to the experimental feature flags page, which no longer applies to these settings. - Adds an upgrade note on the security resource sharing page: the old keys are not recognized, a node that still has one fails to start, and a persistent cluster setting under an old key is archived on upgrade. The "Introduced 3.3" labels and the 3.3/3.4 static-versus-dynamic notes are left as is; they still describe the feature's history accurately. Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

Resource sharing graduates out of experimental in opensearch-project/security#6348, which drops the experimental. segment from the feature-flag settings with no deprecated fallback: plugins.security.experimental.resource_sharing.enabled -> plugins.security.resource_sharing.enabled plugins.security.experimental.resource_sharing.protected_types -> plugins.security.resource_sharing.protected_types Updates the integTest cluster settings and the cluster-setting toggles and javadoc in RscMigrateE2ERestApiIT to the new keys. Only the setting strings change. The ConfigConstants constant names (OPENSEARCH_RESOURCE_SHARING_ENABLED, OPENSEARCH_RESOURCE_SHARING_PROTECTED_TYPES) are unchanged, so no Java/Kotlin references are affected. The gradle -Dresource_sharing.enabled system property that gates the CI matrix is a separate toggle and is left as is. Verified no occurrence of the old key remains anywhere in the repo. Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

…cated Graduating resource sharing out of experimental (opensearch-project#6348) renamed the two feature-flag settings and dropped the old names outright: plugins.security.experimental.resource_sharing.enabled -> plugins.security.resource_sharing.enabled plugins.security.experimental.resource_sharing.protected_types -> plugins.security.resource_sharing.protected_types An existing cluster therefore had to be reconfigured before upgrading. A node whose opensearch.yml still carried an old key would not start, and a persistent cluster setting under an old key was archived on upgrade, silently returning the feature to its default of disabled. Consumers then fall back to their own access control without reporting an error, so shares stop being honored with no signal. This restores the old names as deprecated aliases instead, matching how the plugin already handles the opendistro-to-opensearch rename of ssl_dual_mode_enabled: - Each current setting now declares its pre-graduation setting as a fallback. The fallback resolves at read time against whichever settings instance is supplied, so it covers opensearch.yml, cluster settings and dynamic updates alike. The current name takes precedence when both are set, so a leftover old key cannot override a deliberate new one. - The old settings are registered and marked Property.Deprecated, which is also what lets the upgraders below resolve them. - A setting upgrader per setting rewrites an old key to the current one during cluster-state recovery and on any cluster settings update that still uses it, so an upgraded cluster stops carrying the deprecated key rather than keeping it indefinitely. - Because the deprecation warning core emits does not name a replacement by design, each setting logs an explicit warning naming the current key when the old one is in use. Users keep working through an upgrade, are told the old names are going away, and are pointed at the replacement. Testing: new ResourceSharingSettingMigrationTests covers fallback resolution for both settings, precedence when both keys are set, the upgraders' key mapping, and upgradeSettings rewriting the old keys while leaving current ones untouched. Verified green, then confirmed the fallback tests fail when the fallback wiring is removed. Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

Resource sharing graduates out of experimental in opensearch-project/security#6348, which drops the experimental. segment from the feature-flag settings with no deprecated fallback: plugins.security.experimental.resource_sharing.enabled -> plugins.security.resource_sharing.enabled plugins.security.experimental.resource_sharing.protected_types -> plugins.security.resource_sharing.protected_types Updates the integTest cluster settings to the new keys. Only the setting strings change. The ConfigConstants constant names (OPENSEARCH_RESOURCE_SHARING_ENABLED, OPENSEARCH_RESOURCE_SHARING_PROTECTED_TYPES) are unchanged, so no Java/Kotlin references are affected. The gradle -Dresource_sharing.enabled system property that gates the CI matrix is a separate toggle and is left as is. Verified no occurrence of the old key remains anywhere in the repo. Signed-off-by: Darshit Chanpura <dchanp@amazon.com>

DarshitChanpura force-pushed the graduate/resource-sharing-non-experimental branch from 739106b to 4954a66 Compare July 30, 2026 00:17

DarshitChanpura marked this pull request as ready for review July 30, 2026 18:55

DarshitChanpura requested review from Rishav9852Kumar, RyanL1997, cwperks, derek-ho, finnegancarroll, nibix, reta, shikharj05 and willyborankin as code owners July 30, 2026 18:55

DarshitChanpura mentioned this pull request Sep 1, 2026

Workspace aware sharing records #6374

Merged

5 tasks

Merge branch 'main' into graduate/resource-sharing-non-experimental

dbcb3c0

DarshitChanpura mentioned this pull request Sep 15, 2026

Graduate resource sharing docs out of experimental opensearch-project/documentation-website#13072

Open

1 task

DarshitChanpura mentioned this pull request Sep 15, 2026

Rename resource sharing feature flag in the start-opensearch action opensearch-project/opensearch-build#6473

Merged

1 task

RyanL1997 approved these changes Sep 15, 2026

View reviewed changes

DarshitChanpura merged commit c59f017 into opensearch-project:main Sep 15, 2026
118 of 120 checks passed

DarshitChanpura mentioned this pull request Sep 16, 2026

Keep the pre-graduation resource sharing setting names working, deprecated #6513

Merged

5 tasks

DarshitChanpura mentioned this pull request Sep 16, 2026

Remove the deprecated plugins.security.experimental.resource_sharing.* settings in 4.0 #6514

Open

opensearch-ci-bot mentioned this pull request Sep 16, 2026

[AUTO] Add release notes for 3.9.0 #6515

Merged

Navigation Menu

Uh oh!

Graduate resource sharing feature out of experimental - #6348

Graduate resource sharing feature out of experimental#6348
DarshitChanpura merged 2 commits into
opensearch-project:mainfrom
DarshitChanpura:graduate/resource-sharing-non-experimental

DarshitChanpura commented Jul 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 29, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jul 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 30, 2026

Uh oh!

cwperks commented Jul 30, 2026 •

edited

Loading

Uh oh!

DarshitChanpura commented Jul 31, 2026

Uh oh!

cwperks commented Jul 31, 2026

Uh oh!

github-actions Bot commented Sep 15, 2026

Uh oh!

DarshitChanpura commented Sep 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

DarshitChanpura commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related Issues

Check List

Uh oh!

github-actions Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Reviewer Guide 🔍

(Review updated until commit dbcb3c0)

Uh oh!

github-actions Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Code Suggestions ✨

Previous suggestions

Uh oh!

codecov Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Jul 30, 2026

Uh oh!

cwperks commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

DarshitChanpura commented Jul 31, 2026

Uh oh!

cwperks commented Jul 31, 2026

Uh oh!

github-actions Bot commented Sep 15, 2026

Uh oh!

DarshitChanpura commented Sep 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

DarshitChanpura commented Jul 29, 2026 •

edited

Loading

github-actions Bot commented Jul 29, 2026 •

edited

Loading

(Review updated until commit `dbcb3c0`)

github-actions Bot commented Jul 29, 2026 •

edited

Loading

codecov Bot commented Jul 29, 2026 •

edited

Loading

cwperks commented Jul 30, 2026 •

edited

Loading