[Release 3.0] Planned Breaking Changes for 3.0 in Plugin

[peterzhuamazon]

[Release 3.0] Planned Breaking Changes for 3.0 in Plugin

As mentioned in this META Issue, we want to track and increase transparency around the breaking changes planned for the 3.0 release across participating plugins.

Please kindly document all planned breaking changes related to your plugin for 3.0 here, by sharing detailed information about the changes, expected impact, and any guidance for users or other teams to adapt to the changes.

If needed, please also prepare PRs on documentation-website changes as part of the 3.0 release process.

Overall, this would help us deliver a smooth and seamless upgrade experience.

Thanks.

Changes in main not present on 2.x:

• Migrate to Apache HttpClient / Core 5.x #2166
• Support for HTTP/2 (server-side) #2051
• Set security plugin 3.0.0 baseline JDK version to JDK-21 #4457
• [RFC] Retire support for V6 configuration #4493
• Bump OpenSAML to 5.1.3 #5038
• SAML auth uses legacy _opendistro route #2060
• Remove deprecated settings from code #4117
• Protected indices are marked for deprecation--they should no longer be marked this way.  #3190
• transport_enabled setting on an auth domain and authorizer may be unnecessary after transport client removal  #3191

Major Updates

• [FEATURE] Deprecate the usage of ThreadContext.stashContext in plugins #2487 - Meta Issue
• [Proposal] Resource Permissions and Sharing #4500

[shikharj05]

@cwperks @peterzhuamazon what do you think about removing support for opendistro in APIs? For example APIs like -

https://github.com/opensearch-project/security/blob/main/src/main/java/org/opensearch/security/ssl/rest/SecuritySSLInfoAction.java#L52

security/src/main/java/org/opensearch/security/dlic/rest/support/Utils.java

Line 207 in 472f7c7

return addRoutesPrefix(routes, LEGACY_PLUGIN_API_ROUTE_PREFIX, PLUGIN_API_ROUTE_PREFIX);

Do we need to explicitly mark them deprecated before removing or we can remove them?