Skip to content

Onboards to centralized resource access control mechanism for ml-model-group #3715

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Draft
wants to merge 16 commits into
base: main
Choose a base branch
from
Draft

Onboards to centralized resource access control mechanism for ml-model-group #3715

wants to merge 16 commits into from
+785 −348

Conversation

DarshitChanpura
Copy link
Member

Description

Implements resource-access-control for ML-Model-Group.
Feature Proposal: opensearch-project/security#4500

Related Issues

TBD

Check List

  • New functionality includes testing.
  • New functionality has been documented.
  • API changes companion pull request created.
  • Commits are signed per the DCO using --signoff.
  • Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

@dhrubo-os
Copy link
Collaborator

Apply spotless: ./gradlew spotlessApply

@DarshitChanpura
Fixes sharing logic
6f8bdd5 
Signed-off-by: Darshit Chanpura <[email protected]>
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 8, 2025 15:57 — with GitHub Actions Failure
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 8, 2025 15:57 — with GitHub Actions Error
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 8, 2025 15:57 — with GitHub Actions Error
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 8, 2025 15:57 — with GitHub Actions Failure
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 8, 2025 17:15 — with GitHub Actions Failure
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 8, 2025 17:15 — with GitHub Actions Failure
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 8, 2025 17:15 — with GitHub Actions Failure
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 8, 2025 17:15 — with GitHub Actions Error
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 10, 2025 21:17 — with GitHub Actions Failure
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 10, 2025 21:17 — with GitHub Actions Error
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 10, 2025 21:17 — with GitHub Actions Failure
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 10, 2025 21:17 — with GitHub Actions Failure
@DarshitChanpura
Fixes implmentation
b5f7efe 
Signed-off-by: Darshit Chanpura <[email protected]>
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 14, 2025 21:27 — with GitHub Actions Error
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 14, 2025 21:27 — with GitHub Actions Failure
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 14, 2025 21:27 — with GitHub Actions Failure
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 14, 2025 21:27 — with GitHub Actions Error
@dhrubo-os
Copy link
Collaborator

Integ tests are failing.

@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 15, 2025 18:11 — with GitHub Actions Failure
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 15, 2025 18:11 — with GitHub Actions Error
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 15, 2025 18:11 — with GitHub Actions Error
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 15, 2025 18:11 — with GitHub Actions Failure
@DarshitChanpura DarshitChanpura force-pushed the intro-resource-permissions branch from bd13cc6 to b5f7efe Compare April 15, 2025 18:23
@DarshitChanpura DarshitChanpura requested a deployment to ml-commons-cicd-env-require-approval April 15, 2025 18:24 — with GitHub Actions Waiting
@DarshitChanpura DarshitChanpura requested a deployment to ml-commons-cicd-env-require-approval April 15, 2025 18:24 — with GitHub Actions Waiting
@dhrubo-os
Copy link
Collaborator

can you please rebase with upstream and resolve the conflicts too?

@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 26, 2025 03:52 — with GitHub Actions Error
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 26, 2025 03:52 — with GitHub Actions Error
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 26, 2025 03:52 — with GitHub Actions Failure
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 26, 2025 03:52 — with GitHub Actions Failure
@DarshitChanpura
Copy link
Member Author

@dhrubo-os Can you trigger CI please?

@DarshitChanpura
Fix missed reference
05e09d5 
Signed-off-by: Darshit Chanpura <[email protected]>
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 26, 2025 22:08 — with GitHub Actions Failure
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 26, 2025 22:08 — with GitHub Actions Failure
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 26, 2025 22:08 — with GitHub Actions Error
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 26, 2025 22:08 — with GitHub Actions Error
@DarshitChanpura
Fix compilation errors
638d381 
Signed-off-by: Darshit Chanpura <[email protected]>
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 28, 2025 18:09 — with GitHub Actions Error
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 28, 2025 18:09 — with GitHub Actions Failure
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 28, 2025 18:09 — with GitHub Actions Error
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 28, 2025 18:09 — with GitHub Actions Failure
@DarshitChanpura
Fix compileTestsJava
40c7c81 
Signed-off-by: Darshit Chanpura <[email protected]>
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 29, 2025 01:17 — with GitHub Actions Failure
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 29, 2025 01:17 — with GitHub Actions Error
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 29, 2025 01:17 — with GitHub Actions Error
@DarshitChanpura DarshitChanpura had a problem deploying to ml-commons-cicd-env-require-approval April 29, 2025 01:17 — with GitHub Actions Failure
rbhavna
rbhavna reviewed May 7, 2025
View reviewed changes
plugin/src/main/java/org/opensearch/ml/action/model_group/TransportUpdateModelGroupAction.java
}
// For backwards compatibility we still allow storing backend_roles data in ml_model_group
// index
updateModelGroup(modelGroupId, r.source(), updateModelGroupInput, wrappedListener, user);
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So if user wants to update resource sharing fields through update model group API, how do we allow it?

@dhrubo-os dhrubo-os had a problem deploying to ml-commons-cicd-env-require-approval May 7, 2025 19:04 — with GitHub Actions Error
@dhrubo-os dhrubo-os had a problem deploying to ml-commons-cicd-env-require-approval May 7, 2025 19:04 — with GitHub Actions Failure
@dhrubo-os dhrubo-os had a problem deploying to ml-commons-cicd-env-require-approval May 7, 2025 19:04 — with GitHub Actions Error
@dhrubo-os dhrubo-os had a problem deploying to ml-commons-cicd-env-require-approval May 7, 2025 19:04 — with GitHub Actions Failure
rbhavna
rbhavna reviewed May 7, 2025
View reviewed changes
plugin/src/main/java/org/opensearch/ml/model/MLModelGroupManager.java
.getResourceSharingClient();

resourceSharingClient
.share(
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Once onboarded and ml access framework is deprecated, what happens to the already existing resources with access controls defined by ml-plugin

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@rbhavna rbhavna rbhavna left review comments

@b4sjoo b4sjoo Awaiting requested review from b4sjoo b4sjoo will be requested when the pull request is marked ready for review b4sjoo is a code owner

@dhrubo-os dhrubo-os Awaiting requested review from dhrubo-os dhrubo-os will be requested when the pull request is marked ready for review dhrubo-os is a code owner

@mingshl mingshl Awaiting requested review from mingshl mingshl will be requested when the pull request is marked ready for review mingshl is a code owner

@jngz-es jngz-es Awaiting requested review from jngz-es jngz-es will be requested when the pull request is marked ready for review jngz-es is a code owner

@model-collapse model-collapse Awaiting requested review from model-collapse model-collapse will be requested when the pull request is marked ready for review model-collapse is a code owner

@ylwu-amzn ylwu-amzn Awaiting requested review from ylwu-amzn ylwu-amzn will be requested when the pull request is marked ready for review ylwu-amzn is a code owner

@zane-neo zane-neo Awaiting requested review from zane-neo zane-neo will be requested when the pull request is marked ready for review zane-neo is a code owner

@Zhangxunmt Zhangxunmt Awaiting requested review from Zhangxunmt Zhangxunmt will be requested when the pull request is marked ready for review Zhangxunmt is a code owner

@austintlee austintlee Awaiting requested review from austintlee austintlee will be requested when the pull request is marked ready for review austintlee is a code owner

@HenryL27 HenryL27 Awaiting requested review from HenryL27 HenryL27 will be requested when the pull request is marked ready for review HenryL27 is a code owner

@xinyual xinyual Awaiting requested review from xinyual xinyual will be requested when the pull request is marked ready for review xinyual is a code owner

At least 2 approving reviews are required to merge this pull request.

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@DarshitChanpura @dhrubo-os @rbhavna