|
|
@@ -6,9 +6,10 @@
|
|
|
//Installation and Upgrade Guide
|
|
|
|
|
|
//tag::notable-breaking-changes[]
|
|
|
-[float]
|
|
|
-==== The realm `order` setting is required
|
|
|
-
|
|
|
+.The realm `order` setting is now required.
|
|
|
+[%collapsible]
|
|
|
+====
|
|
|
+*Details* +
|
|
|
The `xpack.security.authc.realms.{type}.{name}.order` setting is now required and must be
|
|
|
specified for each explicitly configured realm. Each value must be unique.
|
|
|
The cluster will fail to start if the requirements are not met.
|
|
|
@@ -29,49 +30,58 @@ xpack.security.authc.realms.kerberos.kerb1:
|
|
|
keytab.path: es.keytab
|
|
|
remove_realm_name: false
|
|
|
--------------------------------------------------
|
|
|
-
|
|
|
+====
|
|
|
// end::notable-breaking-changes[]
|
|
|
|
|
|
-[float]
|
|
|
[[accept-default-password-removed]]
|
|
|
-==== The `accept_default_password` setting has been removed
|
|
|
-
|
|
|
+.The `accept_default_password` setting has been removed.
|
|
|
+[%collapsible]
|
|
|
+====
|
|
|
+*Details* +
|
|
|
The `xpack.security.authc.accept_default_password` setting has not had any affect
|
|
|
since the 6.0 release of {es}. It has been removed and cannot be used.
|
|
|
+====
|
|
|
|
|
|
-[float]
|
|
|
[[roles-index-cache-removed]]
|
|
|
-==== The `roles.index.cache.*` settings have been removed
|
|
|
-
|
|
|
+.The `roles.index.cache.*` settings have been removed.
|
|
|
+[%collapsible]
|
|
|
+====
|
|
|
+*Details* +
|
|
|
The `xpack.security.authz.store.roles.index.cache.max_size` and
|
|
|
`xpack.security.authz.store.roles.index.cache.ttl` settings have
|
|
|
been removed. These settings have been redundant and deprecated
|
|
|
since the 5.2 release of {es}.
|
|
|
+====
|
|
|
|
|
|
-[float]
|
|
|
[[migrate-tool-removed]]
|
|
|
-==== The `elasticsearch-migrate` tool has been removed
|
|
|
-
|
|
|
+.The `elasticsearch-migrate` tool has been removed.
|
|
|
+[%collapsible]
|
|
|
+====
|
|
|
+*Details* +
|
|
|
The `elasticsearch-migrate` tool provided a way to convert file
|
|
|
realm users and roles into the native realm. It has been deprecated
|
|
|
since 7.2.0. Users and roles should now be created in the native
|
|
|
realm directly.
|
|
|
+====
|
|
|
|
|
|
-[float]
|
|
|
[[separating-node-and-client-traffic]]
|
|
|
-==== The `transport.profiles.*.xpack.security.type` setting has been removed
|
|
|
-
|
|
|
+.The `transport.profiles.*.xpack.security.type` setting has been removed.
|
|
|
+[%collapsible]
|
|
|
+====
|
|
|
+*Details* +
|
|
|
The `transport.profiles.*.xpack.security.type` setting has been removed since
|
|
|
the Transport Client has been removed and therefore all client traffic now uses
|
|
|
the HTTP transport. Transport profiles using this setting should be removed.
|
|
|
+====
|
|
|
|
|
|
-[float]
|
|
|
+[discrete]
|
|
|
[[ssl-validation-changes]]
|
|
|
==== SSL/TLS configuration validation
|
|
|
|
|
|
-[float]
|
|
|
-===== The `xpack.security.transport.ssl.enabled` setting may be required
|
|
|
-
|
|
|
+.The `xpack.security.transport.ssl.enabled` setting is now required to configure `xpack.security.transport.ssl` settings.
|
|
|
+[%collapsible]
|
|
|
+====
|
|
|
+*Details* +
|
|
|
It is now an error to configure any SSL settings for
|
|
|
`xpack.security.transport.ssl` without also configuring
|
|
|
`xpack.security.transport.ssl.enabled`.
|
|
|
@@ -91,10 +101,12 @@ xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
|
|
|
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12
|
|
|
--------------------------------------------------
|
|
|
<1> or `false`.
|
|
|
+====
|
|
|
|
|
|
-[float]
|
|
|
-===== The `xpack.security.http.ssl.enabled` setting may be required
|
|
|
-
|
|
|
+.The `xpack.security.http.ssl.enabled` setting is now required to configure `xpack.security.http.ssl` settings.
|
|
|
+[%collapsible]
|
|
|
+====
|
|
|
+*Details* +
|
|
|
It is now an error to configure any SSL settings for
|
|
|
`xpack.security.http.ssl` without also configuring
|
|
|
`xpack.security.http.ssl.enabled`.
|
|
|
@@ -116,31 +128,36 @@ xpack.security.http.ssl.key: elasticsearch.key
|
|
|
xpack.security.http.ssl.certificate_authorities: [ "corporate-ca.crt" ]
|
|
|
--------------------------------------------------
|
|
|
<1> or `false`.
|
|
|
+====
|
|
|
|
|
|
-[float]
|
|
|
-===== The `xpack.security.transport.ssl` Certificate and Key may be required
|
|
|
-
|
|
|
+.A `xpack.security.transport.ssl` certificate and key are now required to enable SSL for the transport interface.
|
|
|
+[%collapsible]
|
|
|
+====
|
|
|
+*Details* +
|
|
|
It is now an error to enable SSL for the transport interface without also configuring
|
|
|
a certificate and key through use of the `xpack.security.transport.ssl.keystore.path`
|
|
|
setting or the `xpack.security.transport.ssl.certificate` and
|
|
|
`xpack.security.transport.ssl.key` settings.
|
|
|
+====
|
|
|
|
|
|
-[float]
|
|
|
-===== The `xpack.security.http.ssl` Certificate and Key may be required
|
|
|
-
|
|
|
+.A `xpack.security.http.ssl` certificate and key are now required to enable SSL for the HTTP server.
|
|
|
+[%collapsible]
|
|
|
+====
|
|
|
+*Details* +
|
|
|
It is now an error to enable SSL for the HTTP (Rest) server without also configuring
|
|
|
a certificate and key through use of the `xpack.security.http.ssl.keystore.path`
|
|
|
setting or the `xpack.security.http.ssl.certificate` and
|
|
|
`xpack.security.http.ssl.key` settings.
|
|
|
+====
|
|
|
|
|
|
-
|
|
|
-[float]
|
|
|
+[discrete]
|
|
|
[[builtin-users-changes]]
|
|
|
==== Changes to built-in users
|
|
|
|
|
|
-[float]
|
|
|
-===== The `kibana` user has been removed in favor of the `kibana_system` user
|
|
|
-
|
|
|
+.The `kibana` user has been renamed `kibana_system`.
|
|
|
+[%collapsible]
|
|
|
+====
|
|
|
+*Details* +
|
|
|
The `kibana` user was historically used to authenticate {kib} to {es}.
|
|
|
The name of this user was confusing, and was often mistakenly used to login to {kib}.
|
|
|
This has been renamed to `kibana_system` in order to reduce confusion, and to better
|
|
|
@@ -157,15 +174,17 @@ then you should update to use the new `kibana_system` user instead:
|
|
|
--------------------------------------------------
|
|
|
elasticsearch.username: kibana_system
|
|
|
--------------------------------------------------
|
|
|
+====
|
|
|
|
|
|
-
|
|
|
-[float]
|
|
|
+[discrete]
|
|
|
[[builtin-roles-changes]]
|
|
|
==== Changes to built-in roles
|
|
|
|
|
|
-[float]
|
|
|
-===== The `kibana_user` role has been removed in favor of the `kibana_admin` role
|
|
|
-
|
|
|
+.The `kibana_user` role has been renamed to `kibana_admin`.
|
|
|
+[%collapsible]
|
|
|
+====
|
|
|
+*Details* +
|
|
|
Users who were previously assigned the `kibana_user` role should instead be assigned
|
|
|
the `kibana_admin` role. This role grants the same set of privileges as `kibana_user`, but has been
|
|
|
renamed to better reflect its intended use.
|
|
|
+====
|
James Rodewig