[BUG] "invalid action name [cluster:feature/tenancy/config/read] must start with one of: [cluster:admin, indices:data/read, indices:monitor, indices:data/write, internal:, indices:internal, cluster:monitor, cluster:internal, indices:admin]"

[mbasha86]

Describe the bug
On fresh start after upgrading to OpenSearch 2.7.0, OpenSearch are generating these lines:

{"type": "logging", "timestamp": "2023-05-10T17:12:42,877Z", "level": "WARN", "component": "o.o.t.TransportService", "cluster.name": "logging", "node.name": "ofd-data-1", "message": "invalid action name [cluster:feature/tenancy/config/read] must start with one of: [cluster:admin, indices:data/read, indices:monitor, indices:data/write, internal:, indices:internal, cluster:monitor, cluster:internal, indices:admin]" }
{"type": "logging", "timestamp": "2023-05-10T17:12:42,884Z", "level": "WARN", "component": "o.o.t.TransportService", "cluster.name": "logging", "node.name": "ofd-data-1", "message": "invalid action name [cluster:feature/tenancy/config/update] must start with one of: [cluster:admin, indices:data/read, indices:monitor, indices:data/write, internal:, indices:internal, cluster:monitor, cluster:internal, indices:admin]" }

But OpenSearch seems to be working fine.

To Reproduce
Just start OpenSearch instance after upgrade and check log.

Expected behavior
The warning lines not be generated. It is confusing looking to warnings and OpenSearch works fine.

Host/Environment (please complete the following information):
K8s (v1.24.6)
AWS, Kind

[dblock]

Which version did you upgrade from @mbasha86 and how (rolling? restart?)?

[mbasha86]

Which version did you upgrade from @mbasha86 and how (rolling? restart?)?

i have upgraded from version 2.6.0 ...I am rolling it by redeploying my cluster again along with logging component (customized helm chart) which contains the new version of such OpenSearch component ..Then, i check related service and pod logs .

[cwperks]

Can this be transferred to the security repo?

[mbasha86]

Can this be transferred to the security repo?

ok , please go ahead

[cwperks]

This is being addressed in this open PR in the security repo: #2758. There was a recent change in the security plugin to support dynamic multitenancy that introduced these action names.

Thank you for reporting this @mbasha86