Skip to content

Add salt generation to demo security configuration#6022

Open
cwperks wants to merge 6 commits intoopensearch-project:mainfrom
cwperks:demo-salt
Open

Add salt generation to demo security configuration#6022
cwperks wants to merge 6 commits intoopensearch-project:mainfrom
cwperks:demo-salt

Conversation

@cwperks
Copy link
Member

@cwperks cwperks commented Mar 19, 2026

Description

The changes in this PR more strongly encourage a cluster administrator to configure all aspects of security including the salt used for Field Masking.

Currently, when using the demo security configuration we log out a warning message when left uncustomized

[WARN ] 2024-01-24 10:56:14.205 [Test worker] Salt - If you plan to use field masking pls configure compliance salt e1ukloTsQlOgPquJ to be a random string of 16 chars length identical on all nodes

Even if plugins.security.allow_unsafe_democertificates is set to false the cluster boots up. This PR introduces code to enforce that this value is customized, but leaves it unwired as it could break existing deployments. I propose that this would be enforced in next major release.

  • Category (Enhancement, New feature, Bug fix, Test fix, Refactoring, Maintenance, Documentation)

Maintenance

Check List

  • New functionality includes testing
  • New functionality has been documented
  • New Roles/Permissions have a corresponding security dashboards plugin PR
  • API changes companion pull request created
  • Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Craig Perkins <cwperx@amazon.com>
cwperks added 5 commits March 19, 2026 09:55
Signed-off-by: Craig Perkins <cwperx@amazon.com>
Signed-off-by: Craig Perkins <cwperx@amazon.com>
Signed-off-by: Craig Perkins <cwperx@amazon.com>
Signed-off-by: Craig Perkins <cwperx@amazon.com>
Signed-off-by: Craig Perkins <cwperx@amazon.com>
@codecov
Copy link

codecov bot commented Mar 19, 2026

Codecov Report

❌ Patch coverage is 91.66667% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 73.84%. Comparing base (3661e7b) to head (d025b26).
⚠️ Report is 3 commits behind head on main.

Files with missing lines Patch % Lines
...va/org/opensearch/security/configuration/Salt.java 80.00% 0 Missing and 1 partial ⚠️
Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main    #6022      +/-   ##
==========================================
+ Coverage   73.82%   73.84%   +0.01%     
==========================================
  Files         439      439              
  Lines       27122    27144      +22     
  Branches     4025     4033       +8     
==========================================
+ Hits        20024    20044      +20     
- Misses       5192     5193       +1     
- Partials     1906     1907       +1     
Files with missing lines Coverage Δ
.../opensearch/security/OpenSearchSecurityPlugin.java 84.95% <ø> (ø)
...earch/security/privileges/dlsfls/FieldMasking.java 86.74% <ø> (-0.08%) ⬇️
.../org/opensearch/security/support/ConfigHelper.java 88.23% <ø> (ø)
...y/tools/democonfig/SecuritySettingsConfigurer.java 72.77% <100.00%> (+1.03%) ⬆️
...va/org/opensearch/security/configuration/Salt.java 96.15% <80.00%> (-3.85%) ⬇️

... and 3 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant