[BUG] Several actions cannot be delegated to users and must be run as an admin user

[peternied]

What is the bug?
There are APIs, such as reloadcerts, which are only authorized for full admin users.

What is the expected behavior?
There should be granular permissions that for all actions in OpenSearch to be individually assigned. The large blast radius in production clusters when performing operational tasks goes against common security practices like the least privileged.

Do you have any additional context?

Also, Just noticed this which gets in the way of me having an internal user run the refresh command. This could be it's own permissions group, potentially.

Originally reported by @patcable in #1877

Other APIs that are admin only

• nodesdn
• allowlist
• actiongroup
• user / internalusers
• roles
• rolesmapping
• tenants

[willyborankin]

Hi @davidlago and @peternied Out company is interested in fixing this problem, so I can prepare PR for it. Wdyt?
Besides that some of endpoints do not work with the default security_rest_api_access e.g. it is impossible to get NodesDn but it is possible to change the plugin configuration which is confusing.

[peternied]

@willyborankin That would be awesome, I'd love to see a PR!

[willyborankin]

@peternied ok will try to do it asap

[davidlago]

Closing as #2411 was merged and released in 2.8