fixup!

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/Security.java

@@ -1224,7 +1224,7 @@ Collection<Object> createComponents(
 
     private void applyPendingSecurityMigrations(SecurityIndexManager.State newState) {
         // If no migrations have been applied and the security index is on the latest version (new index), all migrations can be skipped
-        if (newState.migrationsVersion == 0 && newState.createdOnLatestVersion) {
+        if (newState.migrationsVersion == 0 && newState.createdOnLatestMigrationVersion) {
             submitPersistentMigrationTask(SecurityMigrations.MIGRATIONS_BY_VERSION.lastKey(), false);
             return;
         }

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/store/NativeRolesStore.java

@@ -258,7 +258,7 @@ public boolean isMetadataSearchable() {
         // * the security index has been created anew (using the latest index version),
         // i.e. it is NOT created in a previous ES version that potentially didn't index the role metadata
         // * or, the .security index has been migrated (using an internal update-by-query) such that the metadata is queryable
-        return frozenSecurityIndex.isCreatedOnLatestVersion()
+        return frozenSecurityIndex.isCreatedOnLatestMigrationVersion()
             || securityIndex.isMigrationsVersionAtLeast(ROLE_METADATA_FLATTENED_MIGRATION_VERSION);
     }
 

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/support/SecurityIndexManager.java

@@ -270,7 +270,7 @@ private SystemIndexDescriptor.MappingsVersion getMinSecurityIndexMappingVersion(
      * Check if the index was created on the latest index version available in the cluster
      */
 
-    private static boolean isCreatedOnLatestVersion(IndexMetadata indexMetadata) {
+    private static boolean isCreatedOnLatestMigrationVersion(IndexMetadata indexMetadata) {
         if (indexMetadata == null) {
             return false;
         }
@@ -279,10 +279,11 @@ private static boolean isCreatedOnLatestVersion(IndexMetadata indexMetadata) {
             indexMetadata.getSettings()
         );
 
-        // 1 is the first migration, before the MAIN_INDEX_CREATED_ON_MIGRATION_VERSION was introduced
-        if (indexCreatedOnMigrationVersion > 1) {
+        // 2 is the migration before the MAIN_INDEX_CREATED_ON_MIGRATION_VERSION was introduced
+        if (indexCreatedOnMigrationVersion > 2) {
             return indexCreatedOnMigrationVersion.equals(SecurityMigrations.MIGRATIONS_BY_VERSION.lastKey());
         }
+        // Fall back on IndexVersion
         return SETTING_INDEX_VERSION_CREATED.get(indexMetadata.getSettings()).onOrAfter(IndexVersion.current());
     }
 
@@ -340,7 +341,7 @@ public void clusterChanged(ClusterChangedEvent event) {
         }
         final State previousState = state;
         final IndexMetadata indexMetadata = resolveConcreteIndex(systemIndexDescriptor.getAliasName(), event.state().metadata());
-        final boolean createdOnLatestVersion = isCreatedOnLatestVersion(indexMetadata);
+        final boolean createdOnLatestMigrationVersion = isCreatedOnLatestMigrationVersion(indexMetadata);
         final Instant creationTime = indexMetadata != null ? Instant.ofEpochMilli(indexMetadata.getCreationDate()) : null;
         final boolean isIndexUpToDate = indexMetadata == null
             || INDEX_FORMAT_SETTING.get(indexMetadata.getSettings()) == systemIndexDescriptor.getIndexFormat();
@@ -380,7 +381,7 @@ public void clusterChanged(ClusterChangedEvent event) {
             indexAvailableForSearch,
             indexAvailableForWrite,
             mappingIsUpToDate,
-            createdOnLatestVersion,
+            createdOnLatestMigrationVersion,
             roleMappingsCleanupMigrationStatus,
             migrationsVersion,
             minClusterMappingVersion,
@@ -756,8 +757,8 @@ public void onFailure(Exception e) {
         }
     }
 
-    public boolean isCreatedOnLatestVersion() {
-        return state.createdOnLatestVersion;
+    public boolean isCreatedOnLatestMigrationVersion() {
+        return state.createdOnLatestMigrationVersion;
     }
 
     /**
@@ -802,7 +803,7 @@ public static class State {
         public final boolean indexAvailableForSearch;
         public final boolean indexAvailableForWrite;
         public final boolean mappingUpToDate;
-        public final boolean createdOnLatestVersion;
+        public final boolean createdOnLatestMigrationVersion;
         public final RoleMappingsCleanupMigrationStatus roleMappingsCleanupMigrationStatus;
         public final Integer migrationsVersion;
         // Min mapping version supported by the descriptors in the cluster
@@ -821,7 +822,7 @@ public State(
             boolean indexAvailableForSearch,
             boolean indexAvailableForWrite,
             boolean mappingUpToDate,
-            boolean createdOnLatestVersion,
+            boolean createdOnLatestMigrationVersion,
             RoleMappingsCleanupMigrationStatus roleMappingsCleanupMigrationStatus,
             Integer migrationsVersion,
             SystemIndexDescriptor.MappingsVersion minClusterMappingVersion,
@@ -838,7 +839,7 @@ public State(
             this.indexAvailableForWrite = indexAvailableForWrite;
             this.mappingUpToDate = mappingUpToDate;
             this.migrationsVersion = migrationsVersion;
-            this.createdOnLatestVersion = createdOnLatestVersion;
+            this.createdOnLatestMigrationVersion = createdOnLatestMigrationVersion;
             this.roleMappingsCleanupMigrationStatus = roleMappingsCleanupMigrationStatus;
             this.minClusterMappingVersion = minClusterMappingVersion;
             this.indexMappingVersion = indexMappingVersion;
@@ -859,7 +860,7 @@ public boolean equals(Object o) {
                 && indexAvailableForSearch == state.indexAvailableForSearch
                 && indexAvailableForWrite == state.indexAvailableForWrite
                 && mappingUpToDate == state.mappingUpToDate
-                && createdOnLatestVersion == state.createdOnLatestVersion
+                && createdOnLatestMigrationVersion == state.createdOnLatestMigrationVersion
                 && roleMappingsCleanupMigrationStatus == state.roleMappingsCleanupMigrationStatus
                 && Objects.equals(indexMappingVersion, state.indexMappingVersion)
                 && Objects.equals(migrationsVersion, state.migrationsVersion)
@@ -882,7 +883,7 @@ public int hashCode() {
                 indexAvailableForSearch,
                 indexAvailableForWrite,
                 mappingUpToDate,
-                createdOnLatestVersion,
+                createdOnLatestMigrationVersion,
                 roleMappingsCleanupMigrationStatus,
                 migrationsVersion,
                 minClusterMappingVersion,
@@ -906,8 +907,8 @@ public String toString() {
                 + indexAvailableForWrite
                 + ", mappingUpToDate="
                 + mappingUpToDate
-                + ", createdOnLatestVersion="
-                + createdOnLatestVersion
+                + ", createdOnLatestMigrationVersion="
+                + createdOnLatestMigrationVersion
                 + ", roleMappingsCleanupMigrationStatus="
                 + roleMappingsCleanupMigrationStatus
                 + ", migrationsVersion="

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/support/SecurityMigrations.java

@@ -45,14 +45,10 @@
 import static org.elasticsearch.xpack.security.support.SecuritySystemIndices.SecurityMainIndexMappingVersion.ADD_MANAGE_ROLES_PRIVILEGE;
 import static org.elasticsearch.xpack.security.support.SecuritySystemIndices.SecurityMainIndexMappingVersion.ADD_REMOTE_CLUSTER_AND_DESCRIPTION_FIELDS;
 
-/**
- * Interface for creating SecurityMigrations that will be automatically applied once to existing .security indices
- */
 public class SecurityMigrations {
 
     /**
      * Interface for creating SecurityMigrations that will be automatically applied once to existing .security indices
-     * IMPORTANT: A new index version needs to be added to {@link org.elasticsearch.index.IndexVersions} for the migration to be triggered
      */
     public interface SecurityMigration {
         /**