[Backport 2.x] Add query assistant role and new ml system indices (#4142

) Backport 633ff9b from #4141. Signed-off-by: Sicheng Song <[email protected]> Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
opensearch-project · Mar 20, 2024 · 0174adb · 0174adb
1 parent 15f4abe
commit 0174adb
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 0 deletions.
diff --git a/config/roles.yml b/config/roles.yml
@@ -271,6 +271,15 @@ cross_cluster_search_remote_full_access:
         - 'indices:admin/shards/search_shards'
         - 'indices:data/read/search'
 
+# Allow users to operate query assistant
+ml_query_assistant_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster:admin/opensearch/ml/execute'
+    - 'cluster:admin/opensearch/ml/memory/conversation/create'
+    - 'cluster:admin/opensearch/ml/memory/interaction/create'
+    - 'cluster:admin/opensearch/ml/predict'
+
 # Allow users to read ML stats/models/tasks
 ml_read_access:
   reserved: true

diff --git a/src/main/java/org/opensearch/security/tools/democonfig/SecuritySettingsConfigurer.java b/src/main/java/org/opensearch/security/tools/democonfig/SecuritySettingsConfigurer.java
@@ -48,8 +48,10 @@ public class SecuritySettingsConfigurer {
 
     static final List<String> REST_ENABLED_ROLES = List.of("all_access", "security_rest_api_access");
     static final List<String> SYSTEM_INDICES = List.of(
+        ".plugins-ml-agent",
         ".plugins-ml-config",
         ".plugins-ml-connector",
+        ".plugins-ml-controller",
         ".plugins-ml-model-group",
         ".plugins-ml-model",
         ".plugins-ml-task",