Allow system to perform actions on system indices

Signed-off-by: Craig Perkins <[email protected]>

Author: cwperks

sandbox/modules/system-index-protection/src/main/java/org/opensearch/index/filter/SystemIndexFilter.java

@@ -17,6 +17,7 @@
 import org.opensearch.core.rest.RestStatus;
 import org.opensearch.indices.SystemIndexRegistry;
 import org.opensearch.tasks.Task;
+import org.opensearch.threadpool.ThreadPool;
 
 import java.util.ArrayList;
 import java.util.List;
@@ -27,9 +28,11 @@ public class SystemIndexFilter implements ActionFilter {
 
     private final IndexResolverReplacer indexResolverReplacer;
     private final WildcardMatcher deniedActionsMatcher;
+    private final ThreadPool threadPool;
 
-    public SystemIndexFilter(final IndexResolverReplacer indexResolverReplacer) {
+    public SystemIndexFilter(final IndexResolverReplacer indexResolverReplacer, final ThreadPool threadPool) {
         this.indexResolverReplacer = indexResolverReplacer;
+        this.threadPool = threadPool;
 
         final List<String> deniedActionPatternsList = deniedActionPatterns();
 
@@ -63,6 +66,10 @@ public <Request extends ActionRequest, Response extends ActionResponse> void app
         ActionListener<Response> listener,
         ActionFilterChain<Request, Response> chain
     ) {
+        if (threadPool.getThreadContext().isSystemContext()) {
+            chain.proceed(task, action, request, listener);
+            return;
+        }
         if (deniedActionsMatcher.test(action)) {
             final IndexResolverReplacer.Resolved resolved = indexResolverReplacer.resolveRequest(request);
             final Set<String> allIndices = resolved.getAllIndices();

sandbox/modules/system-index-protection/src/main/java/org/opensearch/plugin/systemindex/SystemIndexProtectionPlugin.java

@@ -86,7 +86,7 @@ public Collection<Object> createComponents(
 
         final IndexNameExpressionResolver resolver = new IndexNameExpressionResolver(threadPool.getThreadContext());
         irr = new IndexResolverReplacer(resolver, clusterService::state, cih);
-        sif = new SystemIndexFilter(irr);
+        sif = new SystemIndexFilter(irr, localClient.threadPool());
         return Collections.emptySet();
     }
 

server/src/main/java/org/opensearch/client/OriginSettingClient.java

@@ -71,6 +71,8 @@ protected <Request extends ActionRequest, Response extends ActionResponse> void
                 () -> in().threadPool().getThreadContext().stashWithOrigin(origin)
             )
         ) {
+            ThreadContext threadContext = in().threadPool().getThreadContext();
+            ThreadContextAccess.doPrivilegedVoid(threadContext::markAsSystemContext);
             super.doExecute(action, request, new ContextPreservingActionListener<>(supplier, listener));
         }
     }