Skip to content

Decouple API key version from node version#104156

Merged
elasticsearchmachine merged 7 commits intoelastic:mainfrom
AthenaEryma:version/api-key
Apr 29, 2024
Merged

Decouple API key version from node version#104156
elasticsearchmachine merged 7 commits intoelastic:mainfrom
AthenaEryma:version/api-key

Conversation

@AthenaEryma
Copy link
Copy Markdown
Contributor

This commit decouples the version stored in API key documents from the node version, as part of the broader effort to stop relying on node version for product logic. The actual data format does not change - the version is stored as an integer before and after this commit, it's just determined by a manually set ApiKey.Version class rather than being derived from the node version.

This commit decouples the version stored in API key documents from the node version, as
part of the broader effort to stop relying on node version for product logic. The actual
data format does not change - the version is stored as an integer before and after this
commit, it's just determined by a manually set `ApiKey.Version` class rather than being
derived from the node version.
@AthenaEryma AthenaEryma added >non-issue :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) v8.13.0 labels Jan 9, 2024
@elasticsearchmachine elasticsearchmachine added the Team:Security Meta label for security team label Jan 9, 2024
@elasticsearchmachine
Copy link
Copy Markdown
Collaborator

Pinging @elastic/es-security (Team:Security)

# Conflicts:
#	x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/ApiKeyServiceTests.java
Copy link
Copy Markdown
Contributor

@jfreden jfreden left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code looks good! Just a comment on the overall use of version for API keys.

The purpose of the version field in production looks like debugging? So if there is a version change of an API key and we try to update it with an older version (could this happen in mixed clusters or after downgrades?) a debug log will happen but the update is successful.

After this is introduced, the process of bumping the version number for API Keys when breaking changes are introduced will be manual, which makes it easy to forget about and maybe not that useful?

If the case for the: ApiKey.Version(currentVersionedDoc.doc().version); assert currentDocVersion.onOrBefore(targetDocVersion) : "current API key doc version must be on or before target version"; for CI purposes is strong enough, maybe that's enough to keep it around though, but after decoupling that one will also be less useful I think.

}
}

public record Version(int version) {
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure if implementing VersionId would be helpful here. Maybe as a marker?

@thecoop
Copy link
Copy Markdown
Member

thecoop commented Apr 16, 2024

As its introducing a new version number here, it may be helpful to report it as a ComponentVersionNumber for diagnostic purposes. It also needs some docs indicating how you work with the version number - how to increment it, any dependencies, etc

@AthenaEryma
Copy link
Copy Markdown
Contributor Author

@thecoop Thanks, I wasn't aware of those things and I will implement them posthaste!

Some thoughts on the purpose of this/docs indicating how you work with it (which I will add): This is really mostly a precautionary field, because eventually we'll want to make a change to the API key format and we'll need some way to track the version. As far as I can tell, it hasn't been used for anything and we'll know what needs to happen with it when we need to use it.

I'm usually on the side of "if we don't need it, remove it instead of fixing it" but version info is one of those things I consider kind of standard metadata for this kind of document these days, like createdAt/modifiedAt timestamp fields are just assumed for CRUD-type software - we will need it at some point.

@thecoop
Copy link
Copy Markdown
Member

thecoop commented Apr 17, 2024

Sure - these extra things aren't necessary for it to work here, but it helps to have some diagnostics and documented procedures in place around handling the new version numbers

@AthenaEryma AthenaEryma requested review from jfreden and thecoop April 25, 2024 18:46
@AthenaEryma
Copy link
Copy Markdown
Contributor Author

@elasticmachine test this please

@AthenaEryma
Copy link
Copy Markdown
Contributor Author

Failure was a network failure during the build.

Copy link
Copy Markdown
Contributor

@jfreden jfreden left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@AthenaEryma
Copy link
Copy Markdown
Contributor Author

@elasticmachine update branch

@AthenaEryma AthenaEryma added the auto-merge-without-approval Automatically merge pull request when CI checks pass (NB doesn't wait for reviews!) label Apr 29, 2024
@elasticsearchmachine elasticsearchmachine merged commit 32deb7f into elastic:main Apr 29, 2024
@AthenaEryma AthenaEryma deleted the version/api-key branch April 29, 2024 19:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

auto-merge-without-approval Automatically merge pull request when CI checks pass (NB doesn't wait for reviews!) >non-issue :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) Team:Security Meta label for security team v8.15.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants