Graduate resource sharing feature out of experimental

[DarshitChanpura]

Description

Graduates the Resource Sharing & Access Control feature out of experimental.

Breaking change (no deprecated fallback): the feature-flag settings are renamed to drop the .experimental segment:

Before	After
plugins.security.experimental.resource_sharing.enabled	plugins.security.resource_sharing.enabled
plugins.security.experimental.resource_sharing.protected_types	plugins.security.resource_sharing.protected_types

Only the string values in ConfigConstants change — the constant names (OPENSEARCH_RESOURCE_SHARING_ENABLED, OPENSEARCH_RESOURCE_SHARING_PROTECTED_TYPES) are unchanged, so downstream Java references are unaffected.

Also:

• Removes the @opensearch.experimental javadoc annotations from the resource-sharing SPI and implementation classes (leaves the unrelated SecurityConfigExtension marker in place).
• Updates RESOURCE_SHARING_AND_ACCESS_CONTROL.md (setting keys + drops the "experimental" note).

Because the rename is breaking and has no fallback, this must ship in 3.8 together with the downstream references. Coordinated changes are being made to:

• documentation-website (setting keys + removal of experimental warning callouts)
• plugin CIs that toggle the flag: reporting, anomaly-detection, ml-commons

Draft while those companion PRs are prepared and reviewed.

Related Issues

Related to #4500

Check List

• New functionality includes testing
• New functionality has been documented
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[github-actions]

PR Reviewer Guide 🔍

(Review updated until commit 4954a66)

Here are some key observations to aid the review process:

🧪 No relevant tests

🔒 No security concerns identified

✅ No TODO sections

🔀 No multiple PR themes

⚡ No major issues detected

[github-actions]

PR Code Suggestions ✨

Latest suggestions up to 4954a66
Explore these optional code suggestions:

Category	Suggestion	Impact
General	Provide deprecated fallback for renamed settings Renaming these settings without providing a fallback/alias is a breaking change that will cause nodes to fail startup with unknown setting if the old plugins.security.experimental.resource_sharing.* keys are still present in opensearch.yml. Consider registering the old keys as deprecated fallbacks (e.g., via Setting.Property.Deprecated or a fallback setting) so users can upgrade smoothly, rather than requiring manual config edits before upgrade. src/main/java/org/opensearch/security/support/ConfigConstants.java [433-438] public static final String OPENSEARCH_RESOURCE_SHARING_ENABLED = "plugins.security.resource_sharing.enabled"; +public static final String OPENSEARCH_RESOURCE_SHARING_ENABLED_DEPRECATED = "plugins.security.experimental.resource_sharing.enabled"; public static final boolean OPENSEARCH_RESOURCE_SHARING_ENABLED_DEFAULT = false; // Protected resource types // Resource sharing will only apply to these types public static final String OPENSEARCH_RESOURCE_SHARING_PROTECTED_TYPES = "plugins.security.resource_sharing.protected_types"; +public static final String OPENSEARCH_RESOURCE_SHARING_PROTECTED_TYPES_DEPRECATED = "plugins.security.experimental.resource_sharing.protected_types"; Suggestion importance[1-10]: 7 __ Why: The suggestion raises a valid concern about backward compatibility, as the PR explicitly documents this as a breaking change. Adding deprecated fallback aliases would improve the upgrade experience, though the PR authors intentionally chose to make this a hard break with clear documentation.	Medium

---

Previous suggestions

Suggestions up to commit 739106b

Category	Suggestion	Impact
General	Provide backward-compatible fallback for renamed settings Renaming these settings keys is a breaking change for existing users who have already configured the experimental settings. Consider registering the old plugins.security.experimental.resource_sharing.* keys as deprecated fallbacks so existing configurations continue to function while emitting a deprecation warning. src/main/java/org/opensearch/security/support/ConfigConstants.java [433-438] public static final String OPENSEARCH_RESOURCE_SHARING_ENABLED = "plugins.security.resource_sharing.enabled"; +public static final String OPENSEARCH_RESOURCE_SHARING_ENABLED_DEPRECATED = "plugins.security.experimental.resource_sharing.enabled"; public static final boolean OPENSEARCH_RESOURCE_SHARING_ENABLED_DEFAULT = false; // Protected resource types // Resource sharing will only apply to these types public static final String OPENSEARCH_RESOURCE_SHARING_PROTECTED_TYPES = "plugins.security.resource_sharing.protected_types"; +public static final String OPENSEARCH_RESOURCE_SHARING_PROTECTED_TYPES_DEPRECATED = "plugins.security.experimental.resource_sharing.protected_types"; Suggestion importance[1-10]: 5 __ Why: Since the feature was marked as experimental, renaming may be acceptable without backward compatibility, but providing a deprecated fallback is a reasonable improvement to avoid breaking existing configurations. Moderate impact.	Low

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.40%. Comparing base (e71c4b1) to head (4954a66).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6348      +/-   ##
==========================================
- Coverage   75.45%   75.40%   -0.05%     
==========================================
  Files         456      456              
  Lines       29924    29924              
  Branches     4530     4530              
==========================================
- Hits        22578    22565      -13     
- Misses       5251     5264      +13     
  Partials     2095     2095              

Files with missing lines	Coverage Δ
...earch/security/spi/resources/ResourceProvider.java	80.00% <ø> (ø)
...ecurity/resources/ResourceAccessControlClient.java	40.00% <ø> (ø)
...arch/security/resources/ResourceAccessHandler.java	73.28% <ø> (ø)
...arch/security/resources/ResourceIndexListener.java	96.77% <ø> (ø)
...nsearch/security/resources/ResourcePluginInfo.java	83.96% <ø> (ø)
...ecurity/resources/ResourceSharingIndexHandler.java	67.59% <ø> (-2.10%)	⬇️
...ensearch/security/resources/sharing/CreatedBy.java	100.00% <ø> (ø)
...ensearch/security/resources/sharing/Recipient.java	100.00% <ø> (ø)
...nsearch/security/resources/sharing/Recipients.java	73.68% <ø> (ø)
...ch/security/resources/sharing/ResourceSharing.java	79.44% <ø> (ø)
... and 2 more

... and 4 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Persistent review updated to latest commit 4954a66

[cwperks]

@DarshitChanpura until there's a clear path with workspaces like proposed in #6119 I don't think this should be promoted out of experimental.

Let's get a consistent platform level experience for sharing.

I'm very strongly supportive of the ownership model where owner gets to choose sharing and I think the fact that workspaces was developed in a way where workspaces have owners that invite collaborators is testament to that being the desired model.

Workspace collaborators being controlled by the frontend is a problem and we need to figure out the path forward that works with workspaces desire to be supported with MDS (Multiple Data Sources). If that problem can be solved then there's clear line-of-sight to graduating from experimental.

Edit: @DarshitChanpura can we focus the efforts on adding a share button inside a dashboards plugin (like reporting) that at least with multi-tenancy is tenant aware. idk if reporting plugin is workspace aware atm and I know some teams had this notion of workspace acl (how does that work?)

If we can show MDS working with resource sharing where the currently toggled cluster supports resource sharing and share button appears than that would probably be a good place to begin. We certainly are going to want to work backwards from UX so that these share APIs can be conveniently called from the frontend and we should also have something similar to #6107 to power new experiences on Dashboards where we can enable/disable actions based on user permissions.

[DarshitChanpura]

@DarshitChanpura can we focus the efforts on adding a share button inside a dashboards plugin (like reporting) that at least with multi-tenancy is tenant aware.

Hahaa, here is the centralized share button PR: opensearch-project/security-dashboards-plugin#2491. I've used AD as example but you get the gist.

@DarshitChanpura until there's a clear path with workspaces

While I agree that workspaces could leverage from the ownership model, I disagree on not taking this feature out of experimental. We should not delay this feature by tying it with workspaces improvement.