[BUG]Upgrade APIs not working as expected

[kumjiten]

What is the bug?
The user created a role with the same name as the predefined one, and when the user runs the upgrade API, it will override the user-defined role. Furthermore, upgrade APIs should give users the choice to select which roles to upgrade and also show which permissions are getting removed or added; currently, it just gives add, modify, etc.

How can one reproduce the bug?
Steps to reproduce the behavior:

1. Create a role with the same name as the predefined role (e.g., a role added in a higher version) with permissions different from the predefined role in the higher version.
2. Trigger Upgrade check API to upgrade the role; it will override the user defined permissions instead of adding

What is the expected behavior?

1. Upgrade APIs should not consider roles that are user-defined, even if they are predefined.
2. Upgrade should allow user to pick which role to upgrade instead of updating all

What is your host/environment?

• OS: [Linux]
• Version [OpenSearch 2.15+]
• Plugins [Security plugin]

Do you have any screenshots?
If applicable, add screenshots to help explain your problem.

Do you have any additional context?
Add any other context about the problem.

[cwperks]

The user created a role with the same name as the predefined one, and when the user runs the upgrade API, it will override the user-defined role.

Why re-use the name of a "default" role ("default" meaning either static: true or reserved: true) vs creating a custom role?

"default" roles are not meant to be changed even by admin and require the admin cert to make modifications to.

[kumjiten]

Thanks, @cwperks , for the quick response.

Why re-use the name of a "default" role ("default" meaning either static: true or reserved: true) vs creating a custom role?

IMO, a user running on an older version and upgrading to a new version will be missing new roles, as the security index doesn't get updated, and they may create a similar role to remain consistent.

"default" roles are not meant to be changed even by admin and require the admin cert to make modifications to.

Agree; however, IMO, the upgrade API should consider default roles from the security index and default config.