Synchronize Kibana spaces to Seacat tenants

[byewokko]

Breaking changes

• Batman for Kibana now also requires kibana_url. If this is empty, Kibana space sync is disabled.
• Batman does no longer create Seacat resources from all Kibana roles. However, existing elk:-prefixed resources are still mapped to corresponding Kibana roles for backward compatibility.
• Config sectionbatman:elk has been renamed to batman:kibana. The old config still works as fallback.

Changes

• When a new tenant (tenant_id=my-company) is created in Seacat Auth, Batman service creates a space in Kibana (space_id=my-company) and two Elastic roles with access to that space:
  • tenant_my-company_read with read-only privileges,
  • tenant_my-company_all with read-write privileges.
• Spaces are synced primarily on housekeeping, plus on tenant creation or update. This can be disabled by setting
• Users are synced primarily on housekeeping, plus on authorization changes (role un/assignment).
• Batman does no longer create Seacat resources from all Kibana roles.
• Instead of creating resources from all Kibana roles, only the following fixed resources are used:
  • kibana:access maps to specific role that grants read-only access to corresponding tenant space (e.g. tenant_my-company_read),
  • kibana:edit maps to specific role that grants read-write access to corresponding tenant space (e.g. tenant_my-company_all),
  • kibana:admin maps to Kibana kibana_admin role,
  • authz:superuser maps to Elastic superuser.
• To ensure backward compatibility, existing elk:-prefixed resources are still mapped to corresponding Kibana roles (e.g. resource elk:analyst will be mapped to Kibana's analyst role as before).
• Seacat Auth DOES NOT automatically create ElasticSearch index patterns and map them to their respective tenant spaces.

[ateska]

Space ID cannot contain "." while tenant ID can. It is replaced with "--".

Tenants should not allow "." either, for multiple reasons. Do we have tenants with "." anywhere?

I suggest to disable "." in tenant name during validation.

[ateska]

Space ID default is reserved in Kibana. Because of that, Seacat tenant default is mapped to space seacat-default.

"tenant-default" is better, "SeaCat" is not a known concept in many deployments.