Final lab: Lifecycle, backup and permissions with correction

What you will learn in this TP

• Write an ISM policy
• Restore a snapshot
• Limit permissions

Introduction #

What you will learn in this section

• Write an ISM policy
• Restore a snapshot
• Limit permissions

Context. Before production, you must prove that indexes manage themselves, that an accidental deletion can be repaired and that a reader cannot break anything.

Prerequisites: the first lab  ·  Estimated time: 50 min

A prototype ready to operate.

Setup #

Guided steps, with their solution.

1. 1. Write the policy

   Why? Without ISM, indexes grow until the disk is full.

   Create a policy: rollover, read-only at 7 days, deletion at 30 days. The 2-document threshold only serves to observe the rollover.
   See the correction

   curl -sk -u 'admin:Str0ng!Passw0rd-2026' -H 'Content-Type: application/json' -X PUT https://localhost:9200/_plugins/_ism/policies/cycle_logs -d '{
     "policy": {
       "description": "Rollover, lecture seule puis suppression",
       "default_state": "chaud",
       "states": [
         {"name": "chaud",
          "actions": [{"rollover": {"min_doc_count": 2}}],
          "transitions": [{"state_name": "tiede", "conditions": {"min_index_age": "7d"}}]},
         {"name": "tiede",
          "actions": [{"read_only": {}}, {"force_merge": {"max_num_segments": 1}}],
          "transitions": [{"state_name": "supprime", "conditions": {"min_index_age": "30d"}}]},
         {"name": "supprime", "actions": [{"delete": {}}], "transitions": []}
       ],
       "ism_template": [{"index_patterns": ["cycle-*"], "priority": 100}]
     }
   }'

2. 2. Trigger the rollover

   Why? Rollover needs a write alias and the rollover_alias setting.

   Create the template and first index, then write two documents. After two to three minutes, a cycle-000002 index should appear.
   See the correction

   # Template: the rollover alias the policy must use
   curl -sk -u 'admin:Str0ng!Passw0rd-2026' -H 'Content-Type: application/json' -X PUT https://localhost:9200/_index_template/cycle -d '{
     "index_patterns": ["cycle-*"],
     "template": {"settings": {
       "number_of_shards": 1, "number_of_replicas": 0,
       "plugins.index_state_management.rollover_alias": "cycle"
     }}
   }'
   
   # First index, with the write alias
   curl -sk -u 'admin:Str0ng!Passw0rd-2026' -H 'Content-Type: application/json' -X PUT https://localhost:9200/cycle-000001 -d '{"aliases":{"cycle":{"is_write_index":true}}}'
   
   # For the lab only: check policies every minute (5 by default)
   curl -sk -u 'admin:Str0ng!Passw0rd-2026' -H 'Content-Type: application/json' -X PUT https://localhost:9200/_cluster/settings \
     -d '{"persistent":{"plugins.index_state_management.job_interval":1}}'
   
   # Write two documents through the alias
   for i in 1 2; do
     curl -sk -u 'admin:Str0ng!Passw0rd-2026' -H 'Content-Type: application/json' -X POST 'https://localhost:9200/cycle/_doc?refresh=true' -d "{\"n\":$i}"
   done

   curl -sk -u 'admin:Str0ng!Passw0rd-2026' -H 'Content-Type: application/json' https://localhost:9200/_plugins/_ism/explain/cycle-000001
   curl -sk -u 'admin:Str0ng!Passw0rd-2026' -H 'Content-Type: application/json' 'https://localhost:9200/_cat/indices/cycle-*?v'

3. 3. Back up and restore

   Why? A replica does not protect against deletion.

   Create the repository, take a snapshot, delete logs-app-000001 and restore it: the count must return to 3.
   See the correction

   curl -sk -u 'admin:Str0ng!Passw0rd-2026' -H 'Content-Type: application/json' -X PUT https://localhost:9200/_snapshot/sauvegardes -d '{
     "type": "fs",
     "settings": {"location": "/usr/share/opensearch/data/snapshots"}
   }'
   
   curl -sk -u 'admin:Str0ng!Passw0rd-2026' -H 'Content-Type: application/json' -X PUT 'https://localhost:9200/_snapshot/sauvegardes/snap1?wait_for_completion=true' \
     -d '{"indices":"logs-app-*"}'
   
   # Lose an index, then restore it
   curl -sk -u 'admin:Str0ng!Passw0rd-2026' -H 'Content-Type: application/json' -X DELETE https://localhost:9200/logs-app-000001
   curl -sk -u 'admin:Str0ng!Passw0rd-2026' -H 'Content-Type: application/json' -X POST 'https://localhost:9200/_snapshot/sauvegardes/snap1/_restore?wait_for_completion=true' \
     -d '{"indices":"logs-app-000001"}'
   curl -sk -u 'admin:Str0ng!Passw0rd-2026' -H 'Content-Type: application/json' https://localhost:9200/logs-app-000001/_count

4. 4. Create a read-only role

   Why? Least privilege is proven by a refusal.

   Create the user, the role and their mapping. Check that reading returns 200 and deleting 403.
   See the correction

   curl -sk -u 'admin:Str0ng!Passw0rd-2026' -H 'Content-Type: application/json' -X PUT https://localhost:9200/_plugins/_security/api/internalusers/lecteur \
     -d '{"password":"L3cteur!Passw0rd-26","backend_roles":[]}'
   
   curl -sk -u 'admin:Str0ng!Passw0rd-2026' -H 'Content-Type: application/json' -X PUT https://localhost:9200/_plugins/_security/api/roles/lecture_logs -d '{
     "cluster_permissions": ["cluster_composite_ops_ro"],
     "index_permissions": [{"index_patterns": ["logs-app-*"], "allowed_actions": ["read"]}]
   }'
   
   curl -sk -u 'admin:Str0ng!Passw0rd-2026' -H 'Content-Type: application/json' -X PUT https://localhost:9200/_plugins/_security/api/rolesmapping/lecture_logs \
     -d '{"users":["lecteur"]}'
   
   # Read: 200. Delete: 403.
   curl -sk -u 'lecteur:L3cteur!Passw0rd-26' -o /dev/null -w '%{http_code}\n' https://localhost:9200/logs-app-000001/_search
   curl -sk -u 'lecteur:L3cteur!Passw0rd-26' -o /dev/null -w '%{http_code}\n' -X DELETE https://localhost:9200/logs-app-000001

Difficulty level : ●●●○○ (3/5)