[Breaking change] `kibana` user removed and replaced by `kibana_system`

kobelb commented 4 years ago

Change description

Which release will ship the breaking change?

~8.0~ (Edit Joe 9/1/21: this is deprecated but we are not yet sure when we will remove it)

Describe the change. How will it manifest to users?

~The kibana user has been removed, and users should use the kibana_system user instead. Instances of Kibana that are configured to use the kibana will not be able to start-up.~

(Edit Joe 9/7/21: we should encourage users to use a service account token instead, if possible. Need to find out if this can be done when accessing Elasticsearch without TLS in 7.16)

How many users will be affected?

I anticipate an overwhelming majority of users will still be using the kibana user. The kibana_system user was only recently added, and unless users are in the habit of reading the Kibana deprecation logs, they're likely unware of this change.

What can users do to address the change manually?

Use Kibana's user management to set the password for the kibana_system user, and update all kibana.yml's to use this username and password for the elasticsearch.username and elasticsearch.password.

How could we make migration easier with the Upgrade Assistant?

There isn't a good way to use the Upgrade Assistant to do so. We don't want the Kibana server to be able to write values to the kibana.yml, nor do we have a way of doing so across every instance of Kibana.

Are there any edge cases?

No

Test Data

Example kibana.yml:

elasticsearch.username: kibana
elasticsearch.password: changeme

Cross links

This is related to #51101.

elasticmachine commented 4 years ago

Pinging @elastic/es-ui (Team:Elasticsearch UI)

elasticmachine commented 4 years ago

Pinging @elastic/kibana-security (Team:Security)

alisonelizabeth commented 3 years ago

I'm going to remove the Elasticsearch UI team label. This deprecation should be registered by the plugin owner via the core deprecations service (https://github.com/elastic/kibana/pull/94845). All registered deprecations will be displayed in the Upgrade Assistant (to be implemented via https://github.com/elastic/kibana/pull/97159). Feel free to reach out to myself or the core team with any questions!

jportner commented 3 years ago

We have not actually removed the kibana user yet, we are going to keep it around for the foreseeable future. We will leave it in the upgrade assistant as a "warning" to try to steer folks towards changing it, though.

I updated the issue description to clarify that we won't be breaking this in 8.0.

elastic / kibana