Include Secure Setting Names and Keystore Modified Time in Reload API Response by ebarlas · Pull Request #138052 · elastic/elasticsearch

ebarlas · 2025-11-13T19:28:24Z

This change augments the reload_secure_settings API response with the following properties for each node object:

secure_setting_names: JSON array of secure setting names from ES keystore
keystore_path: JSON string with file system path to keystore file
keystore_digest: JSON string with hex-encoded SHA-256 hash of keystore file raw bytes
keystore_last_modified_time: JSON string with ES keystore last-modified date-time

This change is a response to recurring ES admin confusion about which securing settings are being reloaded from which keystore. See issue #112268.

Curl call to reload_secure_settings targeting local ES distribution:

…d-secure-settings API response

elasticsearchmachine · 2025-11-13T19:29:12Z

Hi @ebarlas, I've created a changelog YAML for you.

elasticsearchmachine · 2025-11-13T19:31:03Z

Pinging @elastic/es-security (Team:Security)

jfreden

The PR looks great and the code is solid as always! I have a couple of comments.

At a higher level, it was discussed in the issue if the absolute path to the keystore should be included or not. My understanding from the discussion is that you landed on including it but it's not part of the change?

jfreden · 2025-11-18T12:18:54Z

server/src/main/java/org/elasticsearch/common/io/stream/StreamInput.java

        return ElasticsearchException.readException(this);
    }

+    /**


Nice addition!

jfreden · 2025-11-18T12:27:17Z

...elasticsearch/action/admin/cluster/node/reload/TransportNodesReloadSecureSettingsAction.java

+        try {
+            return Files.readAttributes(path, BasicFileAttributes.class).lastModifiedTime().toMillis();
+        } catch (IOException e) {
+            return null; // fallback to null if we can't read the time


I think we should log a warning here since it's unexpected. We just refreshed the keystore and now we can't get the modified timestamp.

jfreden · 2025-11-18T12:40:10Z

docs/changelog/138052.yaml

+summary: Include Secure Setting Names and Keystore Modified Time in Reload API Response
+area: Security
+type: enhancement
+issues: []


This could reference #112268

jfreden · 2025-11-18T12:43:11Z

server/src/internalClusterTest/java/org/elasticsearch/action/admin/ReloadSecureSettingsIT.java

@@ -412,6 +413,8 @@ public void onResponse(NodesReloadSecureSettingsResponse nodesReloadResponse) {
                    assertThat(nodesMap.size(), equalTo(cluster().size()));


I don't think it matters but this test is disabled when running in fips mode. Since we're reading properties on the keystore we might want to make sure it works in fips mode too?

The current approach seems adequate. I see that ReloadSecureSettingsWithPasswordProtectedKeystoreRestIT has a group of tests with a keystore password.

jfreden · 2025-11-18T12:44:35Z

...va/org/elasticsearch/action/admin/cluster/node/reload/NodesReloadSecureSettingsResponse.java

    public static class NodeResponse extends BaseNodeResponse {

-        private Exception reloadException = null;
+        private static final TransportVersion KEYSTORE_DETAILS = TransportVersion.fromName("keystore_details_in_reload_response");


nit: might want to use more specific naming since we might want to add more details in the future.

jfreden · 2025-11-18T12:54:45Z

...g/elasticsearch/action/admin/cluster/node/reload/NodesReloadSecureSettingsResponseTests.java

+import java.util.List;
+import java.util.Optional;
+
+public class NodesReloadSecureSettingsResponseTests extends ESTestCase {


There is actually an abstract class that does testing like this AbstractBWCSerializationTestCase that's used throughout the code base. You might want to consider extending that for more test coverage.

Good catch!

This turned out to be a poor match since AbstractBWCSerializationTestCase expects both wire serialization and XContent serialization. The NodesReloadSecureSettingsResponse source code is not currently arranged that way.

ankit--sethi · 2025-11-20T17:28:24Z

I think someone jumped ahead of you in terms of transport version, but otherwise LGTM to me!

...va/org/elasticsearch/action/admin/cluster/node/reload/NodesReloadSecureSettingsResponse.java

…de/reload/NodesReloadSecureSettingsResponse.java Co-authored-by: Slobodan Adamović <slobodanadamovic@users.noreply.github.com>

idegtiarenko · 2025-11-21T10:23:19Z

...g/elasticsearch/action/admin/cluster/node/reload/NodesReloadSecureSettingsResponseTests.java

+            assertNotNull(readNr.reloadException());
+            assertEquals(nr.reloadException().getMessage(), readNr.reloadException().getMessage());
+        }
+        if (version.equals(TransportVersion.current())) {


This would cause a failure as soon as somebody introduce a new transport version.
Should this be version.supports(NodesReloadSecureSettingsResponse.NodeResponse.KEYSTORE_DETAILS) instead?

Include keystore details in reload-secure-settings API response: - Secure setting names - Keystore file path - Keystore SHA-256 checksum - Keystore last modified time

Include secure setting names and keystore last modified time in reloa…

85e3247

…d-secure-settings API response

ebarlas requested a review from a team November 13, 2025 19:28

ebarlas self-assigned this Nov 13, 2025

ebarlas added >enhancement :Security/Security Security issues without another label Team:Security Meta label for security team labels Nov 13, 2025

elasticsearchmachine added the v9.3.0 label Nov 13, 2025

Update docs/changelog/138052.yaml

ff852ed

ebarlas mentioned this pull request Nov 13, 2025

Report more information about keystore contents on reload #112268

Open

ebarlas marked this pull request as ready for review November 13, 2025 19:30

ebarlas requested a review from a team as a code owner November 13, 2025 19:30

Sort list of secure setting names for readability

dfe89fa

jfreden reviewed Nov 18, 2025

View reviewed changes

Include keystore path and digest in reload-secure-settings response.

7449fad

ankit--sethi approved these changes Nov 20, 2025

View reviewed changes

ebarlas and others added 4 commits November 20, 2025 09:41

Merge branch 'main' into keystore-details-in-reload-response

15637b5

Link issue 112268

6f8209b

[CI] Update transport version definitions

b4a2405

Merge branch 'main' into keystore-details-in-reload-response

d7a0490

slobodanadamovic reviewed Nov 20, 2025

View reviewed changes

...va/org/elasticsearch/action/admin/cluster/node/reload/NodesReloadSecureSettingsResponse.java Outdated Show resolved Hide resolved

...va/org/elasticsearch/action/admin/cluster/node/reload/NodesReloadSecureSettingsResponse.java Outdated Show resolved Hide resolved

ebarlas and others added 2 commits November 20, 2025 11:00

Update server/src/main/java/org/elasticsearch/action/admin/cluster/no…

97c1161

…de/reload/NodesReloadSecureSettingsResponse.java Co-authored-by: Slobodan Adamović <slobodanadamovic@users.noreply.github.com>

Update server/src/main/java/org/elasticsearch/action/admin/cluster/no…

e8ce278

…de/reload/NodesReloadSecureSettingsResponse.java Co-authored-by: Slobodan Adamović <slobodanadamovic@users.noreply.github.com>

ebarlas merged commit b283d24 into elastic:main Nov 20, 2025
40 checks passed

idegtiarenko reviewed Nov 21, 2025

View reviewed changes

pebrc mentioned this pull request Nov 21, 2025

Reload the keystore for Elasticsearch 9.3 without node restarts elastic/cloud-on-k8s#8922

Open

ebarlas mentioned this pull request Dec 9, 2025

Add reload_secure_settings node object properties elastic/elasticsearch-specification#5825

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Include Secure Setting Names and Keystore Modified Time in Reload API Response#138052

Include Secure Setting Names and Keystore Modified Time in Reload API Response#138052
ebarlas merged 10 commits intoelastic:mainfrom
ebarlas:keystore-details-in-reload-response

ebarlas commented Nov 13, 2025 •

edited

Loading

elasticsearchmachine commented Nov 13, 2025

elasticsearchmachine commented Nov 13, 2025

jfreden left a comment

jfreden Nov 18, 2025

jfreden Nov 18, 2025

jfreden Nov 18, 2025

jfreden Nov 18, 2025

ebarlas Nov 18, 2025

jfreden Nov 18, 2025

jfreden Nov 18, 2025

ebarlas Nov 18, 2025

ebarlas Nov 18, 2025

ankit--sethi commented Nov 20, 2025

Uh oh!

Uh oh!

Uh oh!

idegtiarenko Nov 21, 2025

idegtiarenko Nov 21, 2025

Labels

6 participants

		@@ -412,6 +413,8 @@ public void onResponse(NodesReloadSecureSettingsResponse nodesReloadResponse) {
		assertThat(nodesMap.size(), equalTo(cluster().size()));

Conversation

ebarlas commented Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

elasticsearchmachine commented Nov 13, 2025

elasticsearchmachine commented Nov 13, 2025

jfreden left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ankit--sethi commented Nov 20, 2025

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Labels

6 participants

ebarlas commented Nov 13, 2025 •

edited

Loading