Skip to content

Preserve plugin-managed indices during integration test cleanup#5630

Open
ahkcs wants to merge 1 commit into
opensearch-project:mainfrom
ahkcs:fix/security-cleanup-system-indices
Open

Preserve plugin-managed indices during integration test cleanup#5630
ahkcs wants to merge 1 commit into
opensearch-project:mainfrom
ahkcs:fix/security-cleanup-system-indices

Conversation

@ahkcs

@ahkcs ahkcs commented Jul 15, 2026

Copy link
Copy Markdown
Collaborator

Description

Prevents per-class integration test cleanup from deleting plugin-managed indices.

In release integration test run 11379, the secured SQL suite took 4h44m versus 41m without security. The secured cluster log shows cleanup deleting and forcing recreation of security-auditlog-* 358 times, once per test-class cleanup, along with 575 audit-indexing errors. Many of those errors were generated by attempted deletion of protected ML and geospatial indices.

This change extends the existing system-index filter to preserve the observed plugin-managed prefixes. Ordinary test indices, including unrelated hidden test indices, remain eligible for cleanup.

A representative secured A/B run of SQLCursorPermissionsIT showed:

  • Unmodified main: audit index created, deleted by cleanup, then recreated.
  • This branch: audit index created once and preserved; no audit-index deletion or recreation.

The next distribution integration run will provide the full-suite runtime measurement.

Related Issues

Follow-up to #5620

Testing

  • ./gradlew :integ-test:spotlessJavaCheck :integ-test:compileTestJava --no-daemon
  • ./gradlew :integ-test:integTest --tests "org.opensearch.sql.legacy.OpenSearchSQLRestTestCaseIT" -DignorePrometheus=true --no-daemon
  • ./gradlew :integ-test:integTestWithSecurity --tests "org.opensearch.sql.security.SQLCursorPermissionsIT" --no-daemon

Check List

  • New functionality includes testing.
  • New functionality has been documented.
  • New functionality has javadoc added.
  • New functionality has a user manual doc added.
  • New PPL command checklist all confirmed.
  • API changes companion pull request created.
  • Commits are signed per the DCO using --signoff or -s.
  • Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Signed-off-by: Kai Huang <ahkcs@amazon.com>
@github-actions

Copy link
Copy Markdown
Contributor

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🧪 PR contains tests
🔒 No security concerns identified
📝 TODO sections

🔀 No multiple PR themes
⚡ No major issues detected

@github-actions

Copy link
Copy Markdown
Contributor

PR Code Suggestions ✨

Explore these optional code suggestions:

CategorySuggestion                                                                                                                                    Impact
General
Add null check for parameter

Add null check for indexName parameter to prevent NullPointerException when the
method is called with null. This is a defensive programming practice that prevents
potential runtime errors during index cleanup operations.

integ-test/src/test/java/org/opensearch/sql/legacy/OpenSearchSQLRestTestCase.java [239-241]

 static boolean isPluginManagedIndex(String indexName) {
+  if (indexName == null) {
+    return false;
+  }
   return PLUGIN_MANAGED_INDEX_PREFIXES.stream().anyMatch(indexName::startsWith);
 }
Suggestion importance[1-10]: 3

__

Why: While adding a null check is a defensive programming practice, the indexName is extracted from a JSON response in the calling code (line 223), making null unlikely. The suggestion addresses a minor edge case but doesn't fix a critical issue.

Low

@ahkcs ahkcs marked this pull request as draft July 15, 2026 21:30
@ahkcs ahkcs marked this pull request as ready for review July 15, 2026 22:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

maintenance Improves code quality, but not the product

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant