Grant indices:admin/get to kibana_server role

[MdTanwer]

Summary

• Add indices:admin/get to the kibana_server static role catch-all (*) index pattern so OpenSearch Dashboards can probe .kibana before saved-objects bootstrap on a fresh cluster.

Fixes #6103

[github-actions]

PR Reviewer Guide 🔍

(Review updated until commit 23e07d9)

Here are some key observations to aid the review process:

🧪 No relevant tests

🔒 Security concerns Broad metadata exposure: Adding indices:admin/get to the * index pattern in the kibana_server role grants the ability to read mappings, settings, and aliases for all indices in the cluster. This is a privilege expansion for a reserved system role. If the Kibana server account is compromised, it could be used to enumerate all indices and their schemas. Scoping to .kibana* (or whichever indices Dashboards actually probes during bootstrap) would follow least-privilege principles.

✅ No TODO sections

🔀 No multiple PR themes

⚡ Recommended focus areas for review Broad Permission Grant Granting indices:admin/get on the catch-all * index pattern allows the kibana_server role to retrieve index metadata (mappings, settings, aliases) for every index in the cluster, not just .kibana* or .management-beats*. While indices:admin/get is read-only metadata, exposing it cluster-wide on a reserved role may leak information about index names, mappings, and settings that the Kibana server account would not otherwise need. Consider scoping this permission to a narrower pattern (e.g., .kibana*) if the bootstrap probe targets specific indices. - index_patterns: - "*" allowed_actions: - "indices:admin/aliases*" - "indices:admin/get"

[github-actions]

Persistent review updated to latest commit 4cbc4b1

[github-actions]

Persistent review updated to latest commit 80eadfd

[github-actions]

Persistent review updated to latest commit 23e07d9

[github-actions]

Persistent review updated to latest commit 23e07d9

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.04%. Comparing base (69772f0) to head (23e07d9).
⚠️ Report is 18 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6254      +/-   ##
==========================================
- Coverage   75.09%   75.04%   -0.06%     
==========================================
  Files         451      451              
  Lines       29248    29248              
  Branches     4407     4407              
==========================================
- Hits        21965    21949      -16     
- Misses       5247     5264      +17     
+ Partials     2036     2035       -1     

see 5 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.