github-mirrors/elasticsearch
1
0
Fork 0
mirror of https://github.com/elastic/elasticsearch.git synced 2025-04-24 15:17:30 -04:00
Code Issues Projects Releases Packages Wiki Activity

[ML] correctly validate permissions when retention policy is configured (#85413)

Browse source 
When a transform has a `retention_policy` it needs to be able to delete documents in the destination index. 

`create_index` does not necessitate that we can delete documents from it. So, even if we create the index, we need to verify that we can delete documents given the `retention_policy` definition.

This is not a crucial bug as the transform will simply fail later. Its nicer to fail sooner.

closes https://github.com/elastic/elasticsearch/issues/85409
This commit is contained in:
Benjamin Trent 2022-03-29 07:54:31 -04:00 • committed by GitHub
parent a5452603cc
commit 5f03cab87e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 68 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

29
docs/reference/transform/apis/put-transform.asciidoc
View file

@ -19,36 +19,37 @@ Instantiates a {transform}.
Requires the following privileges:
* cluster: `manage_transform` (the `transform_admin` built-in role grants this
* cluster: `manage_transform` (the `transform_admin` built-in role grants this
privilege)
* source indices: `read`, `view_index_metadata`
* destination index: `read`, `create_index`, `index`.
* destination index: `read`, `create_index`, `index`. If a `retention_policy` is configured, the `delete` privilege is
also required.
[[put-transform-desc]]
== {api-description-title}
This API defines a {transform}, which copies data from source indices,
This API defines a {transform}, which copies data from source indices,
transforms it, and persists it into an entity-centric destination index. If you
choose to use the pivot method for your {transform}, the entities are defined by
the set of `group_by` fields in the `pivot` object. If you choose to use the
latest method, the entities are defined by the `unique_key` field values in the
`latest` object.
You can also think of the destination index as a two-dimensional tabular data
structure (known as a {dataframe}). The ID for each document in the {dataframe}
is generated from a hash of the entity, so there is a unique row per entity. For
You can also think of the destination index as a two-dimensional tabular data
structure (known as a {dataframe}). The ID for each document in the {dataframe}
is generated from a hash of the entity, so there is a unique row per entity. For
more information, see <<transforms>>.
When the {transform} is created, a series of validations occur to ensure its
success. For example, there is a check for the existence of the source indices
and a check that the destination index is not part of the source index pattern.
When the {transform} is created, a series of validations occur to ensure its
success. For example, there is a check for the existence of the source indices
and a check that the destination index is not part of the source index pattern.
You can use the `defer_validation` parameter to skip these checks.
Deferred validations are always run when the {transform} is started, with the
exception of privilege checks. When {es} {security-features} are enabled, the
{transform} remembers which roles the user that created it had at the time of
creation and uses those same roles. If those roles do not have the required
privileges on the source and destination indices, the {transform} fails when it
Deferred validations are always run when the {transform} is started, with the
exception of privilege checks. When {es} {security-features} are enabled, the
{transform} remembers which roles the user that created it had at the time of
creation and uses those same roles. If those roles do not have the required
privileges on the source and destination indices, the {transform} fails when it
attempts unauthorized operations.
IMPORTANT: You must use {kib} or this API to create a {transform}. Do not add a

8
docs/reference/transform/apis/start-transform.asciidoc
View file

@ -19,14 +19,16 @@ Starts a {transform}.
Requires the following privileges:
* cluster: `manage_transform` (the `transform_admin` built-in role grants this
* cluster: `manage_transform` (the `transform_admin` built-in role grants this
privilege)
* source indices: `read`, `view_index_metadata`.
* destination index: `read`, `create_index`, `index`. If a `retention_policy` is configured, the `delete` privilege is
also required.
[[start-transform-desc]]
== {api-description-title}
When you start a {transform}, it creates the destination index if it does not
When you start a {transform}, it creates the destination index if it does not
already exist. The `number_of_shards` is set to `1` and the
`auto_expand_replicas` is set to `0-1`.
@ -66,7 +68,7 @@ Identifier for the {transform}.
(Optional, time)
Period to wait for a response. If no response is received before the timeout
expires, the request fails and returns an error. Defaults to `30s`.
[[start-transform-example]]
== {api-examples-title}