[BUG] Unable to delete reporting created index .opendistro-reports-definitions

[daanbosch]

Describe the bug
Unable to delete reporting created index.

To Reproduce
Try to delete/change the index

Expected behavior
Index is deleted

Plugins
opensearch-alerting 1.3.6.0
opensearch-anomaly-detection 1.3.6.0
opensearch-asynchronous-search 1.3.6.0
opensearch-cross-cluster-replication 1.3.6.0
opensearch-index-management 1.3.6.0
opensearch-job-scheduler 1.3.6.0
opensearch-knn 1.3.6.0
opensearch-ml 1.3.6.0
opensearch-observability 1.3.6.0
opensearch-performance-analyzer 1.3.6.0
opensearch-reports-scheduler 1.3.6.0
opensearch-security 1.3.6.0
opensearch-sql 1.3.6.0
prometheus-exporter 1.3.6.0

Screenshots

curl -XDELETE -sk 'https://user:pw@opensearch.url:9200/.opendistro-reports-definitions'
{"error":{"root_cause":[{"type":"security_exception","reason":"no permissions for [] and User [name=daan, backend_roles=[, superadmin, admin, all_access], requestedTenant=null]"}],"type":"security_exception","reason":"no permissions for [] and User [name=daan, backend_roles=[, superadmin, admin, all_access], requestedTenant=null]"},"status":403}

Host/Environment (please complete the following information):
K8s using the opster operator
https://github.com/Opster/opensearch-k8s-operator

Additional context
The reason why I want to delete it, is that there are no replica's of this shard and it caused the cluster to be red.

[daanbosch]

Found a solution for the issue:

curl -XDELETE -k --cert ./kirk.pem --key ./kirk-key.pem  'https://localhost:9200/.opendistro-reports-definitions''

If you use the certificate to authenticate, you will be able to delete the index.

What I do not understand though, is the difference of using the cert versus the basic auth user. Maybe someone could explain the difference to me.

It would also be helpful if these plugins will create shards with at least one replica by default.

[dblock]

I'll move this to opensearch-devops, hopefully someone will know!

[dblock]

Actually looks like this is coming from reporting ...

[joshuali925]

using certificates will give you permission as superadmin, who will be able to remove system indices, and reporting indices are system indices

somewhat related: maybe we can give regular admin permission to manage them #955

i'll close this issue for now since there's a workaround, you can read more about super admin here https://opensearch.org/docs/latest/security/access-control/users-roles/#super-admin-users