From 95fe862f87bea72f2b95965f9d48e58ce94aca6c Mon Sep 17 00:00:00 2001
From: Craig Perkins <cwperx@amazon.com>
Date: Tue, 3 Dec 2024 17:11:57 -0500
Subject: [PATCH] Keep oldConfig

Signed-off-by: Craig Perkins <cwperx@amazon.com>
---
 .../opensearch/security/configuration/DlsFlsValveImpl.java  | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/opensearch/security/configuration/DlsFlsValveImpl.java b/src/main/java/org/opensearch/security/configuration/DlsFlsValveImpl.java
index ac15b1cac5..498b908e5d 100644
--- a/src/main/java/org/opensearch/security/configuration/DlsFlsValveImpl.java
+++ b/src/main/java/org/opensearch/security/configuration/DlsFlsValveImpl.java
@@ -679,7 +679,7 @@ static Mode get(Settings settings) {
     public void updateConfiguration(SecurityDynamicConfiguration<RoleV7> rolesConfiguration) {
         try {
             if (rolesConfiguration != null) {
-                this.dlsFlsProcessedConfig.set(
+                DlsFlsProcessedConfig oldConfig = this.dlsFlsProcessedConfig.getAndSet(
                     new DlsFlsProcessedConfig(
                         DynamicConfigFactory.addStatics(rolesConfiguration.clone()),
                         clusterService.state().metadata().getIndicesLookup(),
@@ -688,6 +688,10 @@ public void updateConfiguration(SecurityDynamicConfiguration<RoleV7> rolesConfig
                         fieldMaskingConfig
                     )
                 );
+
+                if (oldConfig != null) {
+                    oldConfig.shutdown();
+                }
             }
         } catch (Exception e) {
             log.error("Error while updating DLS/FLS configuration with {}", rolesConfiguration, e);