[META] Multi-tenancy support in OpenSearch

[ansjcy]

Please describe the end goal of this project

Introduce and enable multi-tenancy as a first class citizen in OpenSearch by associating request traffic with specific users or workloads. This will allow better categorization, management, troubleshooting and analysis of subsets of traffic hitting an OpenSearch cluster.

We can start from the search queries use cases by attaching customized and rule-based labels and building a generic framework/solution for labeling, which can be later extend it to other workflow like indexing and bulk requests.

Note: We are not trying to achieve "full-multitenancy" in OpenSearch with this META issue :), but this could be a good first step towards that.

Supporting References

Related RFC

• [Feature Request][RFC] Multi-tenancy as a construct in OpenSearch #13341
• [Feature Request] Rule Based request labeling to define multi-tenancy  #14425
• [Query Insights] Add user info in top queries results #12740

Potential downstream consumers

• [RFC] Query insights framework  #11429
• [PROPOSAL][Query Sandboxing] Query Sandboxing high level approach. #11173
• [Search Pipelines] Add a processor that provides fine-grained control over what queries are allowed #10938
• [RFC] User Behavior Insights #12084
• Slow logs, we haven't created an issue as mentioned in the RFC, but if we add the labels in the source field slow log will automagically have the labels.

Issues/PRs

Client-side labeling:

• Add X-Opaque-Id to search request metadata for query insights #13374

Rule-based labeling

• [DRAFT] Request labeling service in opensearch #14282
• add request labeling service/framework  #14388
• [FEATURE] Default labeling rule for security based tenancy labeling security#4402
• Add default request labeling rules in security plugin security#4403

POCs:

• This commit 3b6fd30 explores supporting customized labeling in search request headers and basic rule-based labeling service for search requests.
• add multitenant support for search workloads #13713

Related component

Search

[andrross]

[Triage - attendees 1 2 3 4]
@ansjcy Thanks for filing. Looking forward to seeing progress here.

[kaushalmahi12]

Hi @ansjcy thanks for opening this issue. I have an open PR for this for QSB use case(search workloads): #13713

[getsaurabh02]

this looks like a good plan. Thanks @ansjcy