Skip to content

Give system role permission to invoke shard refresh#143190

Merged
bcully merged 2 commits intoelastic:mainfrom
bcully:reshard/system-permission-for-refresh
Feb 27, 2026
Merged

Give system role permission to invoke shard refresh#143190
bcully merged 2 commits intoelastic:mainfrom
bcully:reshard/system-permission-for-refresh

Conversation

@bcully
Copy link
Copy Markdown
Contributor

@bcully bcully commented Feb 26, 2026

This is needed for resharding because resharding invokes refresh after deleting unowned objects from split shards and flushing the delete to the object store. It invokes refresh in order to confirm that the delete is visible at search nodes before removing the search filters that hide unowned objects while resharding is in progress.

This is needed for resharding because resharding invokes
refresh after deleting unowned objects from split shards and
flushing the delete to the object store. It invokes refresh
in order to confirm that the delete is visible at search nodes
before removing the search filters that hide unowned objects
while resharding is in progress.
@bcully bcully requested a review from a team as a code owner February 26, 2026 22:22
@bcully bcully added >non-issue :Security/Authorization Roles, Privileges, DLS/FLS, RBAC/ABAC v9.4.0 labels Feb 26, 2026
@elasticsearchmachine
Copy link
Copy Markdown
Collaborator

Pinging @elastic/es-security (Team:Security)

@elasticsearchmachine elasticsearchmachine added the Team:Security Meta label for security team label Feb 26, 2026
@bcully bcully force-pushed the reshard/system-permission-for-refresh branch from 2312d96 to 0b71a7e Compare February 26, 2026 22:28
@bcully bcully changed the title Give system role permission to invoke refresh Give system role permission to invoke shard refresh Feb 27, 2026
Copy link
Copy Markdown
Contributor

@slobodanadamovic slobodanadamovic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@bcully bcully merged commit 5c8929e into elastic:main Feb 27, 2026
42 of 43 checks passed
szybia added a commit to szybia/elasticsearch that referenced this pull request Feb 27, 2026
…cations

* upstream/main:
  Warn on API key version mismatch (elastic#143127)
  Fixed wrong malformed value ordering in synthetic source tests (elastic#143187)
  [ML] Fix: required_native_memory_bytes Calculated with Wrong Allocation Count (elastic#143077)
  Add configureBenchmarkLogging calls across the various benchmarks (elastic#143185)
  Mute org.elasticsearch.xpack.esql.CsvIT test {csv-spec:k8s-timeseries-avg-over-time.Avg_over_time_aggregate_metric_double_implicit_casting} elastic#143292
  Give system role permission to invoke shard refresh (elastic#143190)
  Mute testSyntheticSourceWithTranslogSnapshot (elastic#143260)
  Adds ResumeInfo Tests (elastic#142769)
  Use a static method to configure benchmark logging (elastic#143056)
  add connectors release notes (elastic#142884)
  Add CI triage guidance for AI agents (elastic#142994)
  ESQL: Data sources: ZSTD, BZIP2 (elastic#143228)
  [ES|QL] Channels issue when an agg is called with the same field (elastic#142180) (elastic#142269)
  Add support for project routing in reindex requests (elastic#142240)
sidosera pushed a commit to sidosera/elasticsearch that referenced this pull request Feb 27, 2026
Give system role permission to invoke shard refresh

This is needed for resharding because resharding invokes
refresh after deleting unowned objects from split shards and
flushing the delete to the object store. It invokes refresh
in order to confirm that the delete is visible at search nodes
before removing the search filters that hide unowned objects
while resharding is in progress.
tballison pushed a commit to tballison/elasticsearch that referenced this pull request Mar 3, 2026
Give system role permission to invoke shard refresh

This is needed for resharding because resharding invokes
refresh after deleting unowned objects from split shards and
flushing the delete to the object store. It invokes refresh
in order to confirm that the delete is visible at search nodes
before removing the search filters that hide unowned objects
while resharding is in progress.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

>non-issue :Security/Authorization Roles, Privileges, DLS/FLS, RBAC/ABAC Team:Security Meta label for security team v9.4.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants