Disable cross-cluster functionality for _fleet/_fleet_msearch

docs/changelog/136703.yaml

@@ -0,0 +1,18 @@
+pr: 136703
+summary: Disable cross-cluster functionality for `_fleet/_fleet_msearch`
+area: Search
+type: breaking
+issues: []
+breaking:
+  title: Disable cross-cluster functionality for `_fleet/_fleet_msearch`
+  area: Search
+  details: |-
+    This endpoint is largely used for local searches only and is not compatible with true cross-cluster searches where
+    arbitrary number of indices and remotes can be specified. Although it is meant to accept an index parameter that
+    denotes a single searchable target, such a limitation can be bypassed through various means.
+
+    Keeping in view this endpoint's stated intent and future scope, cross-cluster functionality is being explicitly disabled.
+  impact: |-
+    This endpoint will no longer accept remote indices. Should one be provided, a top-level error is returned with
+    an appropriate explanation.
+  notable: false

x-pack/plugin/fleet/src/internalClusterTest/java/org/elasticsearch/xpack/fleet/action/FleetSearchRemoteIndicesDisallowedIT.java

@@ -41,5 +41,56 @@ public void testEndpointsShouldRejectRemoteIndices() {
                 Matchers.containsString("Fleet search API does not support remote indices. Found: [" + remoteIndex + "]")
             );
         }
+
+        {
+            Request request = new Request("POST", "/" + remoteIndex + "/_fleet/_fleet_msearch");
+            request.setJsonEntity("{}\n{}\n");
+            ResponseException responseException = expectThrows(ResponseException.class, () -> getRestClient().performRequest(request));
+            assertThat(
+                responseException.getMessage(),
+                Matchers.containsString("Fleet search API does not support remote indices. Found: [" + remoteIndex + "]")
+            );
+        }
+
+        {
+            /*
+             * It is possible, however, to sneak in multiple indices and a remote index if checkpoints are not specified.
+             * Unfortunately, that's the current behaviour and the Fleet team does not want us to touch it.
+             */
+            Request request = new Request("POST", "/foo,bar:baz/_fleet/_fleet_msearch");
+            request.setJsonEntity("{}\n{}\n");
+            try {
+                getRestClient().performRequest(request);
+            } catch (Exception e) {
+                throw new AssertionError(e);
+            }
+        }
+
+        {
+            // This is fine, there are no remote indices.
+            Request request = new Request("POST", "/foo/_fleet/_fleet_msearch");
+            request.setJsonEntity("{\"index\": \"bar*\"}\n{}\n");
+            try {
+                getRestClient().performRequest(request);
+            } catch (Exception e) {
+                throw new AssertionError(e);
+            }
+        }
+
+        {
+            // This is not valid. We shouldn't be passing multiple indices.
+            Request request = new Request("POST", "/foo/_fleet/_fleet_msearch");
+            request.setJsonEntity("{\"index\": \"bar,baz\", \"wait_for_checkpoints\": 1 }\n{}\n");
+            ResponseException responseException = expectThrows(ResponseException.class, () -> getRestClient().performRequest(request));
+            assertThat(responseException.getMessage(), Matchers.containsString("Fleet search API only supports searching a single index."));
+        }
+
+        {
+            // This is not valid. We shouldn't be passing remote indices.
+            Request request = new Request("POST", "/foo/_fleet/_fleet_msearch");
+            request.setJsonEntity("{\"index\": \"bar:baz\", \"wait_for_checkpoints\": 1 }\n{}\n");
+            ResponseException responseException = expectThrows(ResponseException.class, () -> getRestClient().performRequest(request));
+            assertThat(responseException.getMessage(), Matchers.containsString("Fleet search API does not support remote indices. Found:"));
+        }
     }
 }

x-pack/plugin/fleet/src/main/java/org/elasticsearch/xpack/fleet/rest/RestFleetMultiSearchAction.java

@@ -22,6 +22,7 @@
 import org.elasticsearch.rest.action.RestRefCountedChunkedToXContentListener;
 import org.elasticsearch.rest.action.search.RestMultiSearchAction;
 import org.elasticsearch.rest.action.search.RestSearchAction;
+import org.elasticsearch.transport.RemoteClusterService;
 import org.elasticsearch.usage.SearchUsageHolder;
 
 import java.io.IOException;
@@ -112,6 +113,10 @@ protected RestChannelConsumer prepareRequest(RestRequest request, NodeClient cli
                     );
                 }
             }
+
+            if (indices.length == 1 && RemoteClusterService.isRemoteIndexName(indices[0])) {
+                throw new IllegalArgumentException("Fleet search API does not support remote indices. Found: [" + indices[0] + "].");
+            }
             long[] checkpoints = searchRequest.getWaitForCheckpoints().get("*");
             if (checkpoints != null) {
                 searchRequest.setWaitForCheckpoints(Collections.singletonMap(indices[0], checkpoints));