Merge branch '2.x' into backport/backport-5429-to-2.x

.github/CODEOWNERS

@@ -1 +1 @@
-*   @ananzh @kavilla @seanneumann @AMoo-Miki @ashwin-pc @joshuarrrr @abbyhu2000 @zengyan-amazon @kristenTian @zhongnansu @manasvinibs @ZilongX @Flyingliuhub @BSFishy
+*   @ananzh @kavilla @seanneumann @AMoo-Miki @ashwin-pc @joshuarrrr @abbyhu2000 @zengyan-amazon @kristenTian @zhongnansu @manasvinibs @ZilongX @Flyingliuhub @BSFishy @curq @bandinib-amzn @SuZhou-Joe

.github/workflows/build_and_test_workflow.yml

@@ -47,6 +47,14 @@ jobs:
         run: |
           git config --global core.autocrlf false
 
+      - name: Configure pagefile size (Windows only)
+        if: matrix.os == 'windows-latest'
+        uses: al-cheb/configure-pagefile-action@v1.3
+        with:
+          minimum-size: 16GB
+          maximum-size: 64GB
+          disk-root: "C:"
+
       - name: Checkout code
         uses: actions/checkout@v3
 
@@ -146,6 +154,14 @@ jobs:
         run: |
           git config --global core.autocrlf false
 
+      - name: Configure pagefile size (Windows only)
+        if: matrix.os == 'windows-latest'
+        uses: al-cheb/configure-pagefile-action@v1.3
+        with:
+          minimum-size: 16GB
+          maximum-size: 64GB
+          disk-root: "C:"
+
       - name: Checkout code
         uses: actions/checkout@v3
 
@@ -232,6 +248,14 @@ jobs:
         run: |
           git config --global core.autocrlf false
 
+      - name: Configure pagefile size (Windows only)
+        if: matrix.os == 'windows-latest'
+        uses: al-cheb/configure-pagefile-action@v1.3
+        with:
+          minimum-size: 16GB
+          maximum-size: 64GB
+          disk-root: "C:"
+
       - name: Checkout code
         uses: actions/checkout@v3
 
@@ -334,6 +358,14 @@ jobs:
           git config --global core.autocrlf false
         working-directory: .
 
+      - name: Configure pagefile size (Windows only)
+        if: matrix.os == 'windows-latest'
+        uses: al-cheb/configure-pagefile-action@v1.3
+        with:
+          minimum-size: 16GB
+          maximum-size: 64GB
+          disk-root: "C:"
+
       - name: Checkout code
         uses: actions/checkout@v3
         with:

DEVELOPER_GUIDE.md

@@ -244,12 +244,19 @@ Options:
       -E                Additional key=value settings to pass to OpenSearch
       --download-only   Download the snapshot but don't actually start it
       --ssl             Sets up SSL on OpenSearch
+      --security        Installs and sets up OpenSearch Security plugin on the cluster
       --P               OpenSearch plugin artifact URL to install it on the cluster.
 
 ```bash
-$ yarn opensearch snapshot --version 2.2.0 -E cluster.name=test -E path.data=/tmp/opensearch-data --P org.opensearch.plugin:test-plugin:2.2.0.0 --P file:/home/user/opensearch-test-plugin-2.2.0.0.zip
+$ yarn opensearch snapshot --version 2.2.0 -E cluster.name=test -E path.data=/tmp/opensearch-data --P org.opensearch.plugin:test-plugin:2.2.0.0 --P file:/home/user/opensearch-test-plugin-2.2.0.0.zip --security
 ```
 
+#### Read Only capabilities
+
+_This feature will only work if you have the [`security` plugin](https://github.com/opensearch-project/security) installed on your OpenSearch cluster with https/authentication enabled._
+
+Please follow the design described in [the docs](https://github.com/opensearch-project/OpenSearch/blob/main/docs/capabilities/read_only_mode.md#design)
+
 ### Alternative - Run OpenSearch from tarball
 
 If you would like to run OpenSearch from the tarball, you'll need to download the minimal distribution, install it, and then run the executable. (You'll also need Java installed and the `JAVA_HOME` environmental variable set - see [OpenSearch developer guide](https://github.com/opensearch-project/OpenSearch/blob/main/DEVELOPER_GUIDE.md#install-prerequisites) for details).
@@ -267,6 +274,18 @@ This method can also be used to develop against the [full distribution of OpenSe
 
 _This step is only mandatory if you have the [`security` plugin](https://github.com/opensearch-project/security) installed on your OpenSearch cluster with https/authentication enabled._
 
+> 1. Run `export initialAdminPassword=<initial admin password>` since it's needed by the configuration script
+> 2. Run `yarn opensearch snapshot --security`
+> 3. Wait a few seconds while the plugin is installed, configured, and OpenSearch starts up.
+
+Then within another window. You can start:
+
+> 1. Run `export OPENSEARCH_USERNAME=admin`
+> 2. Run `export OPENSEARCH_PASSWORD=<initial admin password>`
+> 3. Optional: Run `export OPENSEARCH_SECURITY_READONLY_ROLE=<read only role>`
+> 4. Run `yarn start:security`
+> 5. Navigate to OpenSearch Dashboards and login with the above username and password.
+
 Once the bootstrap of OpenSearch Dashboards is finished, you need to apply some
 changes to the default [`opensearch_dashboards.yml`](https://github.com/opensearch-project/OpenSearch-Dashboards/blob/main/config/opensearch_dashboards.yml#L25-L72) in order to connect to OpenSearch.
 

MAINTAINERS.md

@@ -20,6 +20,9 @@ This document contains a list of maintainers in this repo. See [opensearch-proje
 | Tao Liu                   | [Flyingliuhub](https://github.com/Flyingliuhub)     | Amazon      |
 | Zilong Xia                | [ZilongX](https://github.com/ZilongX)               | Amazon      |
 | Matt Provost              | [BSFishy](https://github.com/BSFishy)               | Amazon      |
+| Sirazh Gabdullin          | [curq](https://github.com/curq)                     | External contributor |
+| Bandini Bhopi             | [bandinib-amzn](https://github.com/bandinib-amzn)   | Amazon      |
+| Su Zhou                   | [SuZhou-Joe](https://github.com/SuZhou-Joe)         | Amazon      |
 
 ## Emeritus
 

README.md

@@ -14,7 +14,7 @@ We aim to be an exceptional community-driven platform and to foster open partici
 
 You can [contribute to this project](https://github.com/opensearch-project/OpenSearch-Dashboards/issues/CONTRIBUTING.md) by [opening issues](https://github.com/opensearch-project/OpenSearch-Dashboards/issues/new/choose) to give feedback, share ideas, identify bugs, and contribute code.
 
-Set up your [OpenSearch Dashboards development environment](ttps://github.com/opensearch-project/OpenSearch-Dashboards/blob/main/DEVELOPER_GUIDE.md#getting-started-guide) today! The project team looks forward to your contributions.
+Set up your [OpenSearch Dashboards development environment](https://github.com/opensearch-project/OpenSearch-Dashboards/blob/main/DEVELOPER_GUIDE.md#getting-started-guide) today! The project team looks forward to your contributions.
 
 ## Code Summary
 

docs/capabilities/read_only_mode.md

@@ -0,0 +1,80 @@
+# Read-only Mode
+
+There are two distinct functionalities for "read-only" access in Dashboards. One of them is associated with roles and one is associated with tenants. Regarding the first one, the Dashboards Security plugin contains a feature of hiding all plugin navigation links except Dashboards and Visualizations when the logged-in user has a certain role (more about it in [Read-only Role](#read-only-role)).
+
+The second one is limiting Dashboards access rights via assigning a specific role to a tenant (therefore, making a tenant read-only). Due to past issues and the deprecation of the first functionality, using read-only tenants is now the recommended way to limit users' access to Dashboards.
+
+## Design
+
+Whenever a plugin registers capabilities that should be limited (in other words, set to false) for read-only tenants, such capabilities should be registered through `registerSwitcher` with using method `core.security.readonlyService().hideForReadonly()`
+
+### Example
+
+```ts
+public setup(core: CoreSetup) {
+  core.capabilities.registerProvider({
+    myAwesomePlugin: {
+      show: true,
+      save: true,
+      delete: true,
+    }
+  });
+
+  core.capabilities.registerSwitcher(async (request, capabilites) => {
+    return await core.security.readonlyService().hideForReadonly(request, capabilites, {
+      myAwesomePlugin: {
+        save: false,
+        delete: false,
+      },
+    });
+  });
+}
+```
+
+In this case, we might assume that a plugin relies on the `save` and `delete` capabilities to limit changes somewhere in the UI. Therefore, those capabilities are processed through `registerSwitcher`, they will be set to `false` whenever a read-only tenant is accessed.
+
+If `registerSwitcher` will try to provide or remove capabilites when invoking the switcher will be ignored.
+
+*In case of a disabled / not installed `security` plugin changes will be never applied to a capabilites.*
+
+## Requirements
+
+This feature will only work if you have the [`security` plugin](https://github.com/opensearch-project/security) installed on your OpenSearch cluster with https/authentication enabled.
+
+## Read-only Role
+
+The role is called `kibana_read_only` by default, but the name can be changed using the dashboard config option `opensearch_security.readonly_mode.roles`. One big issue with this feature is that the backend site of a Dashboard Security plugin is completely unaware of it. Thus, users in this mode still have write access to the Dashboards saved objects via the API as the implementation effectively hides everything except the Dashboards and Visualization plugins.
+
+**We highly do not recommend using it!**
+
+For more context, see [this group issues of problems connected with read-only roles](https://github.com/opensearch-project/security/issues/2701).
+
+### Usage
+
+1. Go to `Management > Security > Internal users`
+2. Create or select an already existing user
+3. Add a new `Backend role` called `kibana_read_only` (or use name used in `opensearch_security.readonly_mode.roles`)
+4. Save changes
+
+## Read-only Tenant (recommended)
+
+Dashboards Security plugin recognizes the selection of read-only tenant after logging in and sets the capabilities associated with write access or showing write controls to false for a variety of plugins. This can be easily checked for example by trying to re-arrange some visualizations on Dashboards. Such action will be resulting in a 403 error due to limited read-only access.
+
+### Usage
+
+1. Prepare tenant:
+    * Use an existing tenant or create a new one in `Management > Security > Tenants`
+2. Prepare role:
+    * Go to `Management > Security > Roles`
+    * Use an existing role or create a new one
+    * Fill **index permissions** with:
+        * `indices:data/read/search`
+        * `indices:data/read/get`
+    * Add new **tenant permission** with:
+        * your name of the tenant
+        * read only
+3. Assign a role to a user:
+    * Go to role
+    * Click the tab `Mapped users`
+    * Click `Manage mapping`
+    * In `Users` select the user that will be affected

package.json

@@ -62,6 +62,7 @@
     "build": "scripts/use_node scripts/build --all-platforms",
     "start": "scripts/use_node scripts/opensearch_dashboards --dev",
     "start:docker": "scripts/use_node scripts/opensearch_dashboards --dev --opensearch.hosts=$OPENSEARCH_HOSTS --opensearch.ignoreVersionMismatch=true --server.host=$SERVER_HOST",
+    "start:security": "scripts/use_node scripts/opensearch_dashboards --dev --security",
     "debug": "scripts/use_node --nolazy --inspect scripts/opensearch_dashboards --dev",
     "debug-break": "scripts/use_node --nolazy --inspect-brk scripts/opensearch_dashboards --dev",
     "lint": "yarn run lint:es && yarn run lint:style",
@@ -128,7 +129,7 @@
   "dependencies": {
     "@aws-crypto/client-node": "^3.1.1",
     "@elastic/datemath": "5.0.3",
-    "@elastic/eui": "npm:@opensearch-project/oui@1.3.0",
+    "@elastic/eui": "npm:@opensearch-project/oui@1.4.0-alpha.2",
     "@elastic/good": "^9.0.1-kibana3",
     "@elastic/numeral": "^2.5.0",
     "@elastic/request-crypto": "2.0.0",

packages/osd-interpreter/package.json

@@ -27,7 +27,7 @@
     "del": "^6.1.1",
     "getopts": "^2.2.5",
     "pegjs": "0.10.0",
-    "sass-loader": "npm:@amoo-miki/sass-loader@10.4.1-node-sass-9.0.0-libsass-3.6.5",
+    "sass-loader": "npm:@amoo-miki/sass-loader@10.4.1-node-sass-9.0.0-libsass-3.6.5-with-sass-embedded.rc1",
     "style-loader": "^1.1.3",
     "supports-color": "^7.0.0",
     "url-loader": "^2.2.0",

packages/osd-opensearch/src/cli_commands/snapshot.js

@@ -49,6 +49,7 @@ exports.help = (defaults = {}) => {
       -E                Additional key=value settings to pass to OpenSearch
       --download-only   Download the snapshot but don't actually start it
       --ssl             Sets up SSL on OpenSearch
+      --security        Installs and sets up the OpenSearch Security plugin on the cluster
       --P               OpenSearch plugin artifact URL to install it on the cluster. We can use the flag multiple times
                         to install multiple plugins on the cluster snapshot. The argument value can be url to zip file, maven coordinates of the plugin 
                         or for local zip files, use file:<followed by the absolute or relative path to the plugin zip file>.
@@ -74,6 +75,8 @@ exports.run = async (defaults = {}) => {
 
     boolean: ['download-only'],
 
+    boolean: ['security'],
+
     default: defaults,
   });
 
@@ -91,6 +94,10 @@ exports.run = async (defaults = {}) => {
       await cluster.installOpenSearchPlugins(installPath, options.opensearchPlugins);
     }
 
+    if (options.security) {
+      await cluster.setupSecurity(installPath, options.version ?? defaults.version);
+    }
+
     options.bundledJDK = true;
 
     await cluster.run(installPath, options);

packages/osd-opensearch/src/cluster.js

@@ -34,14 +34,27 @@ const execa = require('execa');
 const chalk = require('chalk');
 const path = require('path');
 const { downloadSnapshot, installSnapshot, installSource, installArchive } = require('./install');
-const { OPENSEARCH_BIN, OPENSEARCH_PLUGIN } = require('./paths');
+const { OPENSEARCH_BIN, OPENSEARCH_PLUGIN, OPENSEARCH_SECURITY_INSTALL } = require('./paths');
 const { log: defaultLog, parseOpenSearchLog, extractConfigFiles, decompress } = require('./utils');
 const { createCliError } = require('./errors');
 const { promisify } = require('util');
 const treeKillAsync = promisify(require('tree-kill'));
 const { parseSettings, SettingsFilter } = require('./settings');
 const { CA_CERT_PATH, OPENSEARCH_P12_PATH, OPENSEARCH_P12_PASSWORD } = require('@osd/dev-utils');
 const readFile = util.promisify(fs.readFile);
+const chmodAsync = util.promisify(fs.chmod);
+
+const LATEST_ENGINE_PLUGIN_BASE_URL =
+  'https://ci.opensearch.org/ci/dbc/distribution-build-opensearch';
+
+function generateEnginePluginUrl(version, plugin) {
+  const legacyVersion = `${version}.0`;
+  const [platform, type] =
+    process.platform === 'win32' ? ['windows', 'zip'] : [process.platform, 'tar'];
+  const arch = process.arch === 'arm64' ? 'arm64' : 'x64';
+
+  return `${LATEST_ENGINE_PLUGIN_BASE_URL}/${version}/latest/${platform}/${arch}/${type}/builds/opensearch/plugins/${plugin}-${legacyVersion}.zip`;
+}
 
 // listen to data on stream until map returns anything but undefined
 const first = (stream, map) =>
@@ -57,9 +70,10 @@ const first = (stream, map) =>
   });
 
 exports.Cluster = class Cluster {
-  constructor({ log = defaultLog, ssl = false } = {}) {
+  constructor({ log = defaultLog, ssl = false, security = false } = {}) {
     this._log = log;
     this._ssl = ssl;
+    this._security = security;
     this._caCertPromise = ssl ? readFile(CA_CERT_PATH) : undefined;
   }
 
@@ -193,6 +207,23 @@ exports.Cluster = class Cluster {
     }
   }
 
+  /**
+   * Setups cluster with security demo configuration
+   *
+   * @param {string} installPath
+   * @property {String} version - version of OpenSearch
+   */
+  async setupSecurity(installPath, version) {
+    const pluginUrl = generateEnginePluginUrl(version, 'opensearch-security');
+    await this.installOpenSearchPlugins(installPath, pluginUrl);
+    this._log.info('Setting up security');
+    const pluginPath = path.resolve(installPath, OPENSEARCH_SECURITY_INSTALL);
+    if (pluginPath) {
+      await chmodAsync(pluginPath, '755');
+      await execa(OPENSEARCH_SECURITY_INSTALL, ['-y', '-i', '-s'], { cwd: installPath });
+    }
+  }
+
   /**
    * Starts OpenSearch and returns resolved promise once started
    *

packages/osd-opensearch/src/paths.js

@@ -35,6 +35,10 @@ function maybeUseBat(bin) {
   return os.platform().startsWith('win') ? `${bin}.bat` : bin;
 }
 
+function maybeUseBatOrShell(bin) {
+  return os.platform().startsWith('win') ? `${bin}.bat` : `${bin}.sh`;
+}
+
 const tempDir = os.tmpdir();
 
 exports.BASE_PATH = path.resolve(tempDir, 'osd-opensearch');
@@ -45,3 +49,6 @@ exports.OPENSEARCH_CONFIG = 'config/opensearch.yml';
 
 exports.OPENSEARCH_KEYSTORE_BIN = maybeUseBat('./bin/opensearch-keystore');
 exports.OPENSEARCH_PLUGIN = maybeUseBat('./bin/opensearch-plugin');
+exports.OPENSEARCH_SECURITY_INSTALL = maybeUseBatOrShell(
+  './plugins/opensearch-security/tools/install_demo_configuration'
+);

packages/osd-optimizer/package.json

@@ -52,10 +52,10 @@
     "css-loader": "^5.2.7",
     "file-loader": "^6.2.0",
     "loader-utils": "^2.0.4",
-    "node-sass": "npm:@amoo-miki/node-sass@9.0.0-libsass-3.6.5",
+    "sass-embedded": "1.66.1",
     "postcss-loader": "^4.2.0",
     "raw-loader": "^4.0.2",
-    "sass-loader": "npm:@amoo-miki/sass-loader@10.4.1-node-sass-9.0.0-libsass-3.6.5",
+    "sass-loader": "npm:@amoo-miki/sass-loader@10.4.1-node-sass-9.0.0-libsass-3.6.5-with-sass-embedded.rc1",
     "style-loader": "^1.1.3",
     "url-loader": "^2.2.0",
     "val-loader": "^2.1.2",

packages/osd-optimizer/src/worker/webpack.config.ts

@@ -189,9 +189,9 @@ export function getWebpackConfig(bundle: Bundle, bundleRefs: BundleRefs, worker:
                       )};\n${content}`;
                     },
                     webpackImporter: false,
-                    implementation: require('node-sass'),
+                    implementation: require('sass-embedded'),
                     sassOptions: {
-                      outputStyle: 'nested',
+                      outputStyle: 'compressed',
                       includePaths: [Path.resolve(worker.repoRoot, 'node_modules')],
                       sourceMapRoot: `/${bundle.type}:${bundle.id}`,
                     },