[DOCS] Reloadable Secure Settings #31713

albertzaharovits · 2018-07-02T04:52:17Z

This is the docs part of the opus on reloadable secure settings for plugins #29135 .

elasticmachine · 2018-07-02T04:54:11Z

Pinging @elastic/es-core-infra

lcawl · 2018-07-03T16:37:39Z

docs/reference/setup/secure-settings.asciidoc

+=== Reloadable secure settings
+
+Just like the settings values in `elasticsearch.yml`, changes to the
+keystore contents will not be automatically applied to the running


Not a big deal, but I'd change "will not be" to "are not"

lcawl · 2018-07-03T16:42:17Z

docs/reference/setup/secure-settings.asciidoc

+settings will not get into effect until the next restart. Once the call returns,
+the reload has been completed, meaning that all internal datastructures dependent
+on these settings have been changed. The reload operation is defined in
+relation with each *reloadable* secure setting.


I'm not sure I understand the last sentence (The reload operation is defined...). What are the implications?

It is an artifact, from back when I was trying to explain too much here instead of going into details on each individual plugin.

lcawl · 2018-07-03T16:46:53Z

docs/plugins/discovery-ec2.asciidoc

@@ -118,6 +117,10 @@ Defaults to `private_ip`.
    How long the list of hosts is cached to prevent further requests to the AWS API.
    Defaults to `10s`.

+*All* secure settings of this plugin are {ref}/secure-settings.html#reloadable-secure-settings[reloadable].
+After the reload call returns, refreshing the transport addresses during discovery,
+will be using an aws sdk client with the latest settings from the keystore.


It seems like there's a word missing here. What will be using an sdk client?

lcawl · 2018-07-03T16:48:33Z

docs/plugins/repository-azure.asciidoc

+
+Both `account` and `key` storage settings are
+{ref}/secure-settings.html#reloadable-secure-settings[reloadable]. After the
+reload call returns, all internal azure clients will use the latest


Unless you follow that "reloadable" link, it's not clear what "the reload call" is. I recommend something like this: "After you reload the settings, all....". Ditto in other pages where this text is used.

lcawl · 2018-07-03T16:51:32Z

docs/plugins/repository-s3.asciidoc

-
-The following are the available client settings. Those that must be stored in the keystore
-are marked as `Secure`.
+to add settings value to the keystore, before starting up the node. Any existing `s3`


I'd suggest moving this sentence fragment up above the code block. e.g. Change to something like this: "For example, before you start the node, run these commands to add AWS access key settings to the keystore:"

albertzaharovits · 2018-07-05T06:17:28Z

Thank you @lcawl . I have addressed the feedback, may you please take another look :)

lcawl

LGTM

jaymode

I left a few suggestions, otherwise LGTM

jaymode · 2018-07-11T14:56:13Z

docs/plugins/discovery-ec2.asciidoc

@@ -122,6 +121,10 @@ Defaults to `private_ip`.
    How long the list of hosts is cached to prevent further requests to the AWS API.
    Defaults to `10s`.

+*All* secure settings of this plugin are {ref}/secure-settings.html#reloadable-secure-settings[reloadable].
+After you reload the settings, the hosts provider, during dynamic nodes refresh,


Maybe After you reload the settings, an aws sdk client with the latest settings from the keystore will be used?

jaymode · 2018-07-11T14:57:56Z

docs/plugins/repository-azure.asciidoc

+
+Both `account` and `key` storage settings are
+{ref}/secure-settings.html#reloadable-secure-settings[reloadable]. After you
+reload the settings, the internal azure clients, used to transfer the snapshot


How about the internal azure clients, which are used to transfer the snapshot, will utilize the latest settings from the keystore

jaymode · 2018-07-11T14:59:41Z

docs/reference/setup/secure-settings.asciidoc

+// CONSOLE
+This API will decrypt and re-read the entire keystore, on every cluster node,
+but only the *reloadable* secure settings will be applied. Changes to other
+settings will not get into effect until the next restart. Once the call returns,


Docs on reloadable secure settings for plugins #29135 .

@throws

* 6.x: Fix scriptdocvalues tests with dates Correct minor typo in explain.asciidoc for HLRC Fix painless whitelist and warnings from backporting #31441 Build: Add elastic maven to repos used by BuildPlugin (#32549) Scripting: Conditionally use java time api in scripting (#31441) [ML] Improve error when no available field exists for rule scope (#32550) [ML] Improve error for functions with limited rule condition support (#32548) [ML] Remove multiple_bucket_spans [ML] Fix thread leak when waiting for job flush (#32196) (#32541) Painless: Clean Up PainlessField (#32525) Add @AwaitsFix for #32554 Remove broken @link in Javadoc Add AwaitsFix to failing test - see #32546 SQL: Added support for string manipulating functions with more than one parameter (#32356) [DOCS] Reloadable Secure Settings (#31713) Fix compilation error introduced by #32339 [Rollup] Remove builders from TermsGroupConfig (#32507) Use hostname instead of IP with SPNEGO test (#32514) Switch x-pack rolling restart to new style Requests (#32339) [DOCS] Small fixes in rule configuration page (#32516) Painless: Clean up PainlessMethod (#32476) SQL: Add test for handling of partial results (#32474) Docs: Add missing migration doc for logging change Build: Remove shadowing from benchmarks (#32475) Docs: Add all JDKs to CONTRIBUTING.md Logging: Make node name consistent in logger (#31588) High-level client: fix clusterAlias parsing in SearchHit (#32465) REST high-level client: parse back _ignored meta field (#32362) backport fix of reduceRandom fix (#32508) Add licensing enforcement for FIPS mode (#32437) INGEST: Clean up Java8 Stream Usage (#32059) (#32485) Improve the error message when an index is incompatible with field aliases. (#32482) Mute testFilterCacheStats Scripting: Fix painless compiler loader to know about context classes (#32385) [ML][DOCS] Fix typo applied_to => applies_to Mute SSLTrustRestrictionsTests on JDK 11 Changed ReindexRequest to use Writeable.Reader (#32401) Increase max chunk size to 256Mb for repo-azure (#32101) Mute KerberosAuthenticationIT fix no=>not typo (#32463) HLRC: Add delete watch action (#32337) Fix calculation of orientation of polygons (#27967) [Kerberos] Add missing javadocs (#32469) Fix missing JavaDoc for @throws in several places in KerberosTicketValidator. Make get all app privs requires "*" permission (#32460) Ensure KeyStoreWrapper decryption exceptions are handled (#32472) update rollover to leverage write-alias semantics (#32216) [Kerberos] Remove Kerberos bootstrap checks (#32451) Switch security to new style Requests (#32290) Switch security spi example to new style Requests (#32341) Painless: Add PainlessConstructor (#32447) Update Fuzzy Query docs to clarify default behavior re max_expansions (#30819) Remove > from Javadoc (fatal with Java 11) Tests: Fix convert error tests to use fixed value (#32415) IndicesClusterStateService should replace an init. replica with an init. primary with the same aId (#32374) auto-interval date histogram - 6.x backport (#32107) [CI] Mute DocumentSubsetReaderTests testSearch [TEST] Mute failing InternalEngineTests#testSeqNoAndCheckpoints TEST: testDocStats should always use forceMerge (#32450) TEST: Avoid deletion in FlushIT AwaitsFix IndexShardTests#testDocStats Painless: Add method type to method. (#32441) Remove reference to non-existent store type (#32418) [TEST] Mute failing FlushIT test Fix ordering of bootstrap checks in docs (#32417) Wrong discovery.type for azure in breaking changes (#32432) Mute ConvertProcessorTests failing tests TESTS: Move netty leak detection to paranoid level (#32354) (#32425) Upgrade to Lucene-7.5.0-snapshot-608f0277b0 (#32390) [Kerberos] Avoid vagrant update on precommit (#32416) TEST: Avoid triggering merges in FlushIT [DOCS] Fixes formatting of scope object in job resource Switch x-pack/plugin to new style Requests (#32327) Release requests in cors handle (#32410) Remove BouncyCastle dependency from runtime (#32402) Copy missing segment attributes in getSegmentInfo (#32396) Rest HL client: Add put license action (#32214) Docs: Correcting a typo in tophits (#32359) Build: Stop double generating buildSrc pom (#32408) Switch x-pack full restart to new style Requests (#32294) Painless: Clean Up PainlessClass Variables (#32380) [ML] Consistent pattern for strict/lenient parser names (#32399) Add Restore Snapshot High Level REST API Update update-settings.asciidoc (#31378) Introduce index store plugins (#32375) Rank-Eval: Reduce scope of an unchecked supression Make sure _forcemerge respects `max_num_segments`. (#32291)

* master: HLRC: Move commercial clients from XPackClient (#32596) Add cluster UUID to Cluster Stats API response (#32206) Security: move User to protocol project (#32367) [TEST] Test for shard failures, add debug to testProfileMatchesRegular Minor fix for javadoc (applicable for java 11). (#32573) Painless: Move Some Lookup Logic to PainlessLookup (#32565) TEST: Avoid merges in testSeqNoAndCheckpoints [Rollup] Remove builders from HistoGroupConfig (#32533) Mutes failing SQL string function tests due to #32589 fixed elements in array of produced terms (#32519) INGEST: Enable default pipelines (#32286) Remove cluster state initial customs (#32501) Mutes LicensingDocumentationIT due to #32580 [ML] Remove multiple_bucket_spans (#32496) [ML] Rename JobProvider to JobResultsProvider (#32551) Correct minor typo in explain.asciidoc for HLRC Build: Add elastic maven to repos used by BuildPlugin (#32549) Clarify the error message when a pipeline agg is used in the 'order' parameter. (#32522) Revert "[test] turn on host io cache for opensuse (#32053)" Enable packaging tests on suse boxes [ML] Improve error when no available field exists for rule scope (#32550) [ML] Improve error for functions with limited rule condition support (#32548) Painless: Clean Up PainlessField (#32525) Add @AwaitsFix for #32554 Remove broken @link in Javadoc Scripting: Conditionally use java time api in scripting (#31441) [ML] Fix thread leak when waiting for job flush (#32196) (#32541) Add AwaitsFix to failing test - see #32546 Core: Minor size reduction for AbstractComponent (#32509) SQL: Added support for string manipulating functions with more than one parameter (#32356) [DOCS] Reloadable Secure Settings (#31713) Watcher: Reenable HttpSecretsIntegrationTests#testWebhookAction test (#32456) [Rollup] Remove builders from TermsGroupConfig (#32507) Use hostname instead of IP with SPNEGO test (#32514) Switch x-pack rolling restart to new style Requests (#32339) NETWORKING: Fix Netty Leaks by upgrading to 4.1.28 (#32511) [DOCS] Small fixes in rule configuration page (#32516) Painless: Clean up PainlessMethod (#32476) Build: Remove shadowing from benchmarks (#32475) Docs: Add all JDKs to CONTRIBUTING.md Add licensing enforcement for FIPS mode (#32437) SQL: Add test for handling of partial results (#32474) Mute testFilterCacheStats [ML][DOCS] Fix typo applied_to => applies_to Scripting: Fix painless compiler loader to know about context classes (#32385)

jasontedor · 2018-08-22T23:26:33Z

@albertzaharovits It looks like this was not backported to 6.4, only committed to master and backported to 6.x. Can you backport these docs (and any other commits relevant commits missing from 6.4) to 6.4?

Docs on reloadable secure settings for plugins #29135 .

albertzaharovits · 2018-08-23T08:55:04Z

@jasontedor it is done, there was only one commit missing. Apologies for the negligence.

[DOCS] for reloadable secure settings

e9c6c47

albertzaharovits self-assigned this Jul 2, 2018

albertzaharovits added >docs General docs changes v7.0.0 v6.4.0 labels Jul 2, 2018

albertzaharovits requested review from rjernst, jaymode and lcawl July 2, 2018 04:54

albertzaharovits added the :Core/Infra/Settings Settings infrastructure and APIs label Jul 2, 2018

albertzaharovits changed the title ~~[DOCS] for reloadable secure settings~~ [DOCS] Reloadable Secure Settings Jul 2, 2018

albertzaharovits added the review label Jul 2, 2018

lcawl reviewed Jul 3, 2018

View reviewed changes

albertzaharovits added 2 commits July 4, 2018 20:53

Merge branch 'master' into docs-reloadable-secure-settings

85b4ff3

Address feedback

49823b3

lcawl approved these changes Jul 5, 2018

View reviewed changes

jaymode approved these changes Jul 11, 2018

View reviewed changes

albertzaharovits added 2 commits July 31, 2018 19:28

Merge branch 'master' into docs-reloadable-secure-settings

eeee21c

Addressed feedback

529af80

albertzaharovits merged commit 2d87287 into elastic:master Aug 1, 2018

albertzaharovits deleted the docs-reloadable-secure-settings branch August 1, 2018 09:07

albertzaharovits added a commit that referenced this pull request Aug 1, 2018

[DOCS] Reloadable Secure Settings (#31713)

89a25a6

Docs on reloadable secure settings for plugins #29135 .

jasontedor added the v6.5.0 label Aug 22, 2018

albertzaharovits added a commit that referenced this pull request Aug 23, 2018

[DOCS] Reloadable Secure Settings (#31713)

e3e69ae

Docs on reloadable secure settings for plugins #29135 .

colings86 added v7.0.0-beta1 and removed v7.0.0 labels Feb 7, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[DOCS] Reloadable Secure Settings #31713

[DOCS] Reloadable Secure Settings #31713

albertzaharovits commented Jul 2, 2018 •

edited

Loading

elasticmachine commented Jul 2, 2018

lcawl Jul 3, 2018

lcawl Jul 3, 2018

albertzaharovits Jul 5, 2018

lcawl Jul 3, 2018

lcawl Jul 3, 2018

lcawl Jul 3, 2018

albertzaharovits commented Jul 5, 2018

lcawl left a comment

jaymode left a comment

jaymode Jul 11, 2018

jaymode Jul 11, 2018

jaymode Jul 11, 2018

jasontedor commented Aug 22, 2018 •

edited

Loading

albertzaharovits commented Aug 23, 2018

[DOCS] Reloadable Secure Settings #31713

[DOCS] Reloadable Secure Settings #31713

Conversation

albertzaharovits commented Jul 2, 2018 • edited Loading

elasticmachine commented Jul 2, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

albertzaharovits commented Jul 5, 2018

lcawl left a comment

Choose a reason for hiding this comment

jaymode left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jasontedor commented Aug 22, 2018 • edited Loading

albertzaharovits commented Aug 23, 2018

albertzaharovits commented Jul 2, 2018 •

edited

Loading

jasontedor commented Aug 22, 2018 •

edited

Loading