[Extensions] Create extension point to be able to register security settings into extensions.yml

[cwperks]

The security plugin uses the ActionPlugin.getSettings() extension point to add security settings to opensearch.yml. For extensions, there are multiple instances where the security plugin will need to register security settings for an extension.

Examples include:

• [Extensions] Add extensions/extensions.yml setting to enable backward compatible plugin mode for extensions #2616
• [Extensions] Add support for extension_dns list in extensions.yml file #2730

There needs to be an extension point that the security plugin can hook into to add settings that would be placed into extensions.yml so that the security plugin can read in the settings.

[davidlago]

[Triaging] @peternied to take a look at this, related to the Extensions project.

[peternied]

I'm tackling making these items available, but I won't reuse the 'Settings' interface, we will use the extensions object so there is a strong interface between core <-> security plugin

[saratvemulapalli]

Coming from: #2749 (comment)
Thanks @cwperks for more information.

The terminology confused me, settings in OpenSearch are a way to configure at bootstrap/runtime and is driven by SettingsModule[1].
Extensions also support settings, and these settings are registered with OpenSearch SettingsModule[2]. Also as a side note, opensearch.yml is not modified after the node bootstrap its one time read only file, any changes to settings are in memory, tracked by SettingsModule.

Looks like we'd want to register few settings from Security plugin for extensions.
I would like to understand how they look like and are they per extension?
On the flip side, it absolutely makes sense for extensions.yml to have security config at bootstrap.

[1] https://github.com/opensearch-project/OpenSearch/blob/main/server/src/main/java/org/opensearch/common/settings/SettingsModule.java
[2] opensearch-project/OpenSearch#3753

[peternied]

Removed myself since it looks like @cwperks might want to take point with the implementation

[cwperks]

Thank you @peternied, I will look into it.

[cwperks]

@peternied I created a PR in core that shows an implementation of how the IdentityPlugin can define additional settings in extensions.yml that can then be read in by the security plugin: opensearch-project/OpenSearch#7526

[cwperks]

@saratvemulapalli I opened up a PR in core that demonstrates how the IdentityPlugin can extend the settings in extensions.yml to add settings needed for security: opensearch-project/OpenSearch#7526

[cwperks]

Closing this issue as the PR in core was merged: opensearch-project/OpenSearch#7526