feat: Add flag to skip OpenSearch security setup#1603
Conversation
Introduce OPENRAG_SKIP_OS_SECURITY_SETUP (env var, default false) in settings to allow deployments to opt out of OpenSearch security configuration when the platform manages roles/role-mappings externally. Use this flag in startup_orchestrator.startup_tasks and utils.opensearch_init.init_index to skip calling setup_opensearch_security and emit informative log lines; index creation still runs in init_index. Add unit tests to verify both the skipped and non-skipped behaviors and to ensure indices are still created when security setup is skipped.
WalkthroughThis PR introduces a new ChangesOpenSearch Security Skip Feature
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related issues
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
backend
edwinjosechittilappilly
changed the title
github-actions
Bot
added
enhancement
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds an OPENRAG_SKIP_OS_SECURITY_SETUP flag to allow deployments (e.g., SaaS/CPD) to opt out of OpenSearch security configuration while still creating indices.
Changes:
- New env-driven setting in
config/settings.pywith a default that varies based onOPENRAG_RUN_MODE(saas/on_prem -> true, otherwise false). startup_orchestrator.startup_tasksandutils.opensearch_init.init_indexnow branch on the flag and emit a skip log instead of callingsetup_opensearch_security.- New unit tests covering default resolution, startup behavior, and init_index behavior (including that index creation still runs).
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| src/config/settings.py | Adds OPENRAG_SKIP_OS_SECURITY_SETUP flag and _resolve_skip_os_security_default helper. |
| src/services/startup_orchestrator.py | Guards startup security setup behind the new flag. |
| src/utils/opensearch_init.py | Guards setup_opensearch_security call inside init_index behind the new flag. |
| tests/unit/test_skip_os_security_default.py | Tests for the run-mode-based default resolution. |
| tests/unit/test_skip_os_security_setup_init_index.py | Tests init_index flag behavior and index creation. |
| tests/unit/services/test_skip_os_security_setup_startup.py | Tests startup_tasks flag behavior. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| def _resolve_skip_os_security_default() -> str: | ||
| run_mode = os.getenv("OPENRAG_RUN_MODE", "").strip().lower() | ||
| if run_mode in ("saas", "on_prem"): | ||
| return "true" | ||
| return "false" |
There was a problem hiding this comment.
@coderabbitai please update the PR description
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
gh pr view 1603 --repo langflow-ai/openrag --json title,body
Length of output: 76
@edwinjosechittilappilly, I wasn't able to authenticate with the GitHub CLI in the sandbox environment (no GH_TOKEN), so I can't update the PR description programmatically. Here is the updated description based on the code changes — you can paste it directly into the PR:
Summary
Introduces OPENRAG_SKIP_OS_SECURITY_SETUP, a new configuration flag that controls whether OpenRAG performs its OpenSearch security context initialization (roles, role mappings, all_access admin pin) at startup and during index initialization.
Motivation
In SaaS and CPD (on_prem) deployments the security context is owned and managed externally (e.g. by Traefik in CPD or by the SaaS platform operator). Running the setup in those environments is redundant and can conflict with the platform's own security configuration.
Behavior
OPENRAG_RUN_MODE |
Default for OPENRAG_SKIP_OS_SECURITY_SETUP |
|---|---|
saas |
true — security setup is skipped |
on_prem (CPD) |
true — security setup is skipped |
anything else (oss, unset) |
false — security setup runs as before |
An explicit OPENRAG_SKIP_OS_SECURITY_SETUP environment variable always takes precedence over the run-mode default, so an operator can force-enable the setup in SaaS for a one-off bootstrap by setting OPENRAG_SKIP_OS_SECURITY_SETUP=false.
⚠️ Upgrade note for existing SaaS / CPD deployments: After this change, security setup will be skipped by default forOPENRAG_RUN_MODE=saasandOPENRAG_RUN_MODE=on_prem. If you rely on OpenRAG managing the OpenSearch security context in those modes today, setOPENRAG_SKIP_OS_SECURITY_SETUP=falseexplicitly before upgrading.
Changes
src/config/settings.py— Adds_resolve_skip_os_security_default()andOPENRAG_SKIP_OS_SECURITY_SETUP.- Startup orchestrator — conditionally skips security setup based on the flag.
- OpenSearch index initialization — conditionally skips security setup based on the flag.
- Tests — comprehensive coverage for both skip and non-skip paths.
| monkeypatch.setattr(orchestrator, "OPENRAG_SKIP_OS_SECURITY_SETUP", False) | ||
| monkeypatch.setattr(orchestrator, "DISABLE_INGEST_WITH_LANGFLOW", False) | ||
| # IBM_AUTH_ENABLED is imported lazily inside startup_tasks(). | ||
| monkeypatch.setattr("config.settings.IBM_AUTH_ENABLED", False, raising=False) |
| # * saas / on_prem (CPD) -> "true" (the platform owns the security context) | ||
| # * anything else (oss) -> "false" (today's behaviour preserved) | ||
| # An explicit OPENRAG_SKIP_OS_SECURITY_SETUP value always wins, so an | ||
| # operator can force-enable the setup in SaaS for a one-off bootstrap. | ||
| def _resolve_skip_os_security_default() -> str: | ||
| run_mode = os.getenv("OPENRAG_RUN_MODE", "").strip().lower() | ||
| if run_mode in ("saas", "on_prem"): | ||
| return "true" | ||
| return "false" | ||
|
|
||
|
|
||
| OPENRAG_SKIP_OS_SECURITY_SETUP = os.getenv( | ||
| "OPENRAG_SKIP_OS_SECURITY_SETUP", _resolve_skip_os_security_default() | ||
| ).lower() in ("true", "1", "yes") |
github-actions
Bot
added
enhancement
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/utils/opensearch_init.py`:
- Around line 108-112: The info log in the skip-path is exposing a user
identifier; update the logger call in the init_index flow (the logger.info call
that currently passes admin_username) to remove the admin_username keyword (or
replace it with a non-PII flag), so the message remains "Skipping OpenSearch
security setup during init_index (OPENRAG_SKIP_OS_SECURITY_SETUP=true)" without
logging any admin_username; locate the logger.info call in opensearch_init.py
and remove the admin_username argument from that call.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: baa64d3d-e47b-44a7-af47-69ba9036ea04
📒 Files selected for processing (6)
src/config/settings.pysrc/services/startup_orchestrator.pysrc/utils/opensearch_init.pytests/unit/services/test_skip_os_security_setup_startup.pytests/unit/test_skip_os_security_default.pytests/unit/test_skip_os_security_setup_init_index.py
| logger.info( | ||
| "Skipping OpenSearch security setup during init_index " | ||
| "(OPENRAG_SKIP_OS_SECURITY_SETUP=true)", | ||
| admin_username=admin_username, | ||
| ) |
There was a problem hiding this comment.
Avoid logging admin_username in the skip-path info log.
Line 111 logs a user identifier without operational necessity, which increases PII exposure in centralized logs.
🔧 Proposed fix
if OPENRAG_SKIP_OS_SECURITY_SETUP:
logger.info(
"Skipping OpenSearch security setup during init_index "
- "(OPENRAG_SKIP_OS_SECURITY_SETUP=true)",
- admin_username=admin_username,
+ "(OPENRAG_SKIP_OS_SECURITY_SETUP=true)",
)📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| logger.info( | |
| "Skipping OpenSearch security setup during init_index " | |
| "(OPENRAG_SKIP_OS_SECURITY_SETUP=true)", | |
| admin_username=admin_username, | |
| ) | |
| logger.info( | |
| "Skipping OpenSearch security setup during init_index " | |
| "(OPENRAG_SKIP_OS_SECURITY_SETUP=true)", | |
| ) |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/utils/opensearch_init.py` around lines 108 - 112, The info log in the
skip-path is exposing a user identifier; update the logger call in the
init_index flow (the logger.info call that currently passes admin_username) to
remove the admin_username keyword (or replace it with a non-PII flag), so the
message remains "Skipping OpenSearch security setup during init_index
(OPENRAG_SKIP_OS_SECURITY_SETUP=true)" without logging any admin_username;
locate the logger.info call in opensearch_init.py and remove the admin_username
argument from that call.
* Add flag to skip OpenSearch security setup Introduce OPENRAG_SKIP_OS_SECURITY_SETUP (env var, default false) in settings to allow deployments to opt out of OpenSearch security configuration when the platform manages roles/role-mappings externally. Use this flag in startup_orchestrator.startup_tasks and utils.opensearch_init.init_index to skip calling setup_opensearch_security and emit informative log lines; index creation still runs in init_index. Add unit tests to verify both the skipped and non-skipped behaviors and to ensure indices are still created when security setup is skipped. * style: ruff format (auto) --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Introduce OPENRAG_SKIP_OS_SECURITY_SETUP (env var, default false) in settings to allow deployments to opt out of OpenSearch security configuration when the platform manages roles/role-mappings externally. Use this flag in startup_orchestrator.startup_tasks and utils.opensearch_init.init_index to skip calling setup_opensearch_security and emit informative log lines; index creation still runs in init_index. Add unit tests to verify both the skipped and non-skipped behaviors and to ensure indices are still created when security setup is skipped.
#1602
Summary by CodeRabbit
New Features
OPENRAG_SKIP_OS_SECURITY_SETUPconfiguration option to conditionally skip OpenSearch security setup during startup and initialization. Default behavior adapts based on deployment mode.Tests