Can `monitoring.ui.elasticsearch.*` credentials be deprecated

klacabane commented 2 years ago

Summary

Stack monitoring settings allows one to specify a monitoring cluster in monitoring.ui.elasticsearch.hosts configuration as a source to populate the views. To load the monitoring data remotely in Stack Monitoring we require that the same username/password pair authenticated in the local kibana exists in the monitoring one.

The monitoring cluster settings under monitoring.ui.elasticsearch.* also require credentials to poll the remote cluster license and collect telemetry but these are not critical since the UI loads even with wrong credentials provided[1]. They could also be used to run ccs queries/alerts: https://github.com/elastic/kibana/issues/93432

We should verify that these credentials are still required to power any functionality:

if they are required we should check whether the authenticated user has enough permissions to be a drop-in replacement
if not we should get rid of these settings and any code that rely on them

[1]

[2022-03-31T18:45:42.043+02:00][WARN ][plugins.licensing] License information could not be obtained from Elasticsearch due to ResponseError: security_exception: [security_exception] Reason: unable to authenticate user [foobar] for REST request [/_xpack] error

elasticmachine commented 2 years ago

Pinging @elastic/infra-monitoring-ui (Team:Infra Monitoring UI)

matschaffer commented 2 years ago

Just a gut feel, but I think CCS eliminates most of the need for this configuration. So +1 on deprecating it.

My guess is it was created prior to CCS as a way to access both prod & monitoring data without requiring an additional kibana instance.

Granted just removing it and requiring CCS to get set up would definitely qualify as a breaking change for any user leveraging the config option.

elastic / kibana

Can `monitoring.ui.elasticsearch.*` credentials be deprecated #129114

Summary