From c0d5ec87e13fce9e85e7cb20ff3e1e99ded61b0a Mon Sep 17 00:00:00 2001
From: James Baiera <james.baiera@gmail.com>
Date: Mon, 24 Jun 2019 13:54:43 -0400
Subject: [PATCH] Set enrich indices to be read only before swapping their
 aliases (#42874)

---
 .../xpack/enrich/EnrichPolicyRunner.java      | 19 +++++++++++++
 .../xpack/enrich/EnrichPolicyRunnerTests.java | 28 +++++++++++++++++++
 2 files changed, 47 insertions(+)

diff --git a/x-pack/plugin/enrich/src/main/java/org/elasticsearch/xpack/enrich/EnrichPolicyRunner.java b/x-pack/plugin/enrich/src/main/java/org/elasticsearch/xpack/enrich/EnrichPolicyRunner.java
index fc3b7e540a0..0abceb4b8cc 100644
--- a/x-pack/plugin/enrich/src/main/java/org/elasticsearch/xpack/enrich/EnrichPolicyRunner.java
+++ b/x-pack/plugin/enrich/src/main/java/org/elasticsearch/xpack/enrich/EnrichPolicyRunner.java
@@ -27,6 +27,7 @@ import org.elasticsearch.action.admin.indices.get.GetIndexRequest;
 import org.elasticsearch.action.admin.indices.get.GetIndexResponse;
 import org.elasticsearch.action.admin.indices.refresh.RefreshRequest;
 import org.elasticsearch.action.admin.indices.refresh.RefreshResponse;
+import org.elasticsearch.action.admin.indices.settings.put.UpdateSettingsRequest;
 import org.elasticsearch.action.support.master.AcknowledgedResponse;
 import org.elasticsearch.client.Client;
 import org.elasticsearch.cluster.metadata.AliasMetaData;
@@ -304,6 +305,24 @@ public class EnrichPolicyRunner implements Runnable {
         client.admin().indices().refresh(new RefreshRequest(destinationIndexName), new ActionListener<RefreshResponse>() {
             @Override
             public void onResponse(RefreshResponse refreshResponse) {
+                setIndexReadOnly(destinationIndexName);
+            }
+
+            @Override
+            public void onFailure(Exception e) {
+                listener.onFailure(e);
+            }
+        });
+    }
+
+    private void setIndexReadOnly(final String destinationIndexName) {
+        logger.debug("Policy [{}]: Setting new enrich index [{}] to be read only", policyName, destinationIndexName);
+        UpdateSettingsRequest request = new UpdateSettingsRequest(destinationIndexName)
+            .setPreserveExisting(true)
+            .settings(Settings.builder().put("index.blocks.write", "true"));
+        client.admin().indices().updateSettings(request, new ActionListener<AcknowledgedResponse>() {
+            @Override
+            public void onResponse(AcknowledgedResponse acknowledgedResponse) {
                 updateEnrichPolicyAlias(destinationIndexName);
             }
 
diff --git a/x-pack/plugin/enrich/src/test/java/org/elasticsearch/xpack/enrich/EnrichPolicyRunnerTests.java b/x-pack/plugin/enrich/src/test/java/org/elasticsearch/xpack/enrich/EnrichPolicyRunnerTests.java
index ce18b3260a1..bb6bb901925 100644
--- a/x-pack/plugin/enrich/src/test/java/org/elasticsearch/xpack/enrich/EnrichPolicyRunnerTests.java
+++ b/x-pack/plugin/enrich/src/test/java/org/elasticsearch/xpack/enrich/EnrichPolicyRunnerTests.java
@@ -147,6 +147,9 @@ public class EnrichPolicyRunnerTests extends ESSingleNodeTestCase {
 
         // Validate segments
         validateSegments(createdEnrichIndex, 1);
+
+        // Validate Index is read only
+        ensureEnrichIndexIsReadOnly(createdEnrichIndex);
     }
 
     public void testRunnerMultiSource() throws Exception {
@@ -243,6 +246,9 @@ public class EnrichPolicyRunnerTests extends ESSingleNodeTestCase {
 
         // Validate segments
         validateSegments(createdEnrichIndex, 3);
+
+        // Validate Index is read only
+        ensureEnrichIndexIsReadOnly(createdEnrichIndex);
     }
 
     public void testRunnerNoSourceIndex() throws Exception {
@@ -525,6 +531,9 @@ public class EnrichPolicyRunnerTests extends ESSingleNodeTestCase {
 
         // Validate segments
         validateSegments(createdEnrichIndex, 1);
+
+        // Validate Index is read only
+        ensureEnrichIndexIsReadOnly(createdEnrichIndex);
     }
 
     public void testRunnerExplicitObjectSourceMapping() throws Exception {
@@ -647,6 +656,9 @@ public class EnrichPolicyRunnerTests extends ESSingleNodeTestCase {
 
         // Validate segments
         validateSegments(createdEnrichIndex, 1);
+
+        // Validate Index is read only
+        ensureEnrichIndexIsReadOnly(createdEnrichIndex);
     }
 
     public void testRunnerTwoObjectLevelsSourceMapping() throws Exception {
@@ -784,6 +796,9 @@ public class EnrichPolicyRunnerTests extends ESSingleNodeTestCase {
 
         // Validate segments
         validateSegments(createdEnrichIndex, 1);
+
+        // Validate Index is read only
+        ensureEnrichIndexIsReadOnly(createdEnrichIndex);
     }
 
     public void testRunnerDottedKeyNameSourceMapping() throws Exception {
@@ -894,6 +909,9 @@ public class EnrichPolicyRunnerTests extends ESSingleNodeTestCase {
 
         // Validate segments
         validateSegments(createdEnrichIndex, 1);
+
+        // Validate Index is read only
+        ensureEnrichIndexIsReadOnly(createdEnrichIndex);
     }
 
     private EnrichPolicyRunner createPolicyRunner(String policyName, EnrichPolicy policy, ActionListener<PolicyExecutionResult> listener,
@@ -923,4 +941,14 @@ public class EnrichPolicyRunnerTests extends ESSingleNodeTestCase {
         Segment segment = shard.getSegments().iterator().next();
         assertThat(segment.getNumDocs(), is(equalTo(expectedDocs)));
     }
+
+    private void ensureEnrichIndexIsReadOnly(String createdEnrichIndex) {
+        ElasticsearchException expected = expectThrows(ElasticsearchException.class, () -> client().index(new IndexRequest()
+            .index(createdEnrichIndex)
+            .id(randomAlphaOfLength(10))
+            .source(Collections.singletonMap(randomAlphaOfLength(6), randomAlphaOfLength(10)))).actionGet());
+
+        assertThat(expected.getMessage(), containsString("index [" + createdEnrichIndex +
+            "] blocked by: [FORBIDDEN/8/index write (api)]"));
+    }
 }