Add query assistant role and new ml system indices (opensearch-projec…

…t#4141) Signed-off-by: Sicheng Song <[email protected]>
willyborankin · Mar 19, 2024 · 633ff9b · 633ff9b
1 parent 91efc3b
commit 633ff9b
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 0 deletions.
diff --git a/config/roles.yml b/config/roles.yml
@@ -271,6 +271,15 @@ cross_cluster_search_remote_full_access:
         - 'indices:admin/shards/search_shards'
         - 'indices:data/read/search'
 
+# Allow users to operate query assistant
+ml_query_assistant_access:
+  reserved: true
+  cluster_permissions:
+    - 'cluster:admin/opensearch/ml/execute'
+    - 'cluster:admin/opensearch/ml/memory/conversation/create'
+    - 'cluster:admin/opensearch/ml/memory/interaction/create'
+    - 'cluster:admin/opensearch/ml/predict'
+
 # Allow users to read ML stats/models/tasks
 ml_read_access:
   reserved: true

diff --git a/src/main/java/org/opensearch/security/tools/democonfig/SecuritySettingsConfigurer.java b/src/main/java/org/opensearch/security/tools/democonfig/SecuritySettingsConfigurer.java
@@ -47,8 +47,10 @@ public class SecuritySettingsConfigurer {
 
     static final List<String> REST_ENABLED_ROLES = List.of("all_access", "security_rest_api_access");
     static final List<String> SYSTEM_INDICES = List.of(
+        ".plugins-ml-agent",
         ".plugins-ml-config",
         ".plugins-ml-connector",
+        ".plugins-ml-controller",
         ".plugins-ml-model-group",
         ".plugins-ml-model",
         ".plugins-ml-task",