Skip to content

Commit aa3bb33

Browse files
elasticmachineelasticmachine
authored
Merge branch 'master' into feature/component_templates
2 parents 5baef1d + dcca06b commit aa3bb33

332 files changed

Lines changed: 6117 additions & 3325 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.ci/es-snapshots/Jenkinsfile_verify_es‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,8 @@ def SNAPSHOT_MANIFEST = "https://storage.googleapis.com/kibana-ci-es-snapshots-d
2222
kibanaPipeline(timeoutMinutes: 150) {
2323
catchErrors {
2424
slackNotifications.onFailure(
25-
title: ":broken_heart: *<${env.BUILD_URL}|[${SNAPSHOT_VERSION}] ES Snapshot Verification Failure>*",
26-
message: ":broken_heart: [${SNAPSHOT_VERSION}] ES Snapshot Verification Failure",
25+
title: "*<${env.BUILD_URL}|[${SNAPSHOT_VERSION}] ES Snapshot Verification Failure>*",
26+
message: "[${SNAPSHOT_VERSION}] ES Snapshot Verification Failure",
2727
) {
2828
retryable.enable(2)
2929
withEnv(["ES_SNAPSHOT_MANIFEST=${SNAPSHOT_MANIFEST}"]) {

‎.eslintignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
/.es
44
/build
55
/built_assets
6+
/config/apm.dev.js
67
/data
78
/html_docs
89
/optimize

‎config/kibana.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@
9090
# Specifies the path where Kibana creates the process ID file.
9191
#pid.file: /var/run/kibana.pid
9292

93-
# Enables you specify a file where Kibana stores log output.
93+
# Enables you to specify a file where Kibana stores log output.
9494
#logging.dest: stdout
9595

9696
# Set the value of this setting to true to suppress all logging output.

‎docs/api/saved-objects/bulk_get.asciidoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ experimental[] Retrieve multiple {kib} saved objects by ID.
3535
==== Response body
3636

3737
`saved_objects`::
38-
(array) Top-level property the contains objects that represent the response for each of the requested objects. The order of the objects in the response is identical to the order of the objects in the request.
38+
(array) Top-level property containing objects that represent the response for each of the requested objects. The order of the objects in the response is identical to the order of the objects in the request.
3939

4040
Saved objects that are unable to persist are replaced with an error object.
4141

‎docs/apm/api.asciidoc‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,12 @@ Some APM app features are provided via a REST API:
1111
* <<agent-config-api>>
1212
* <<apm-annotation-api>>
1313

14+
[float]
15+
[[apm-api-example]]
16+
=== Using the APIs
17+
18+
Users interacting with APM APIs must have <<apm-app-api-user,sufficient privileges>>.
19+
In addition, there are request headers to be aware of, like `kbn-xsrf: true`, and `Content-Type: applicaton/json`.
1420
Here's an example CURL request that adds an annotation to the APM app:
1521

1622
[source,curl]
@@ -32,16 +38,8 @@ curl -X POST \
3238
}'
3339
----
3440

35-
For more information, the Kibana <<api,REST API reference>> provides information on how to use Kibana APIs,
36-
like required request headers and authentication options.
37-
38-
// AGENT CONFIG API
39-
// GET --> Feature (APM) Read
40-
// CREATE/EDIT/DELETE --> Feature (APM) All
41-
42-
// ANNOTATION API
43-
// Feature (APM) All
44-
// Index: `observability-annotations`. Privileges: `create_index`, `create_doc`, `manage`, and `read`.
41+
The Kibana <<api,REST API reference>> provides additional information on how to use Kibana APIs,
42+
required request headers, and token-based authentication options.
4543

4644
////
4745
*******************************************************
@@ -61,6 +59,8 @@ The following Agent configuration APIs are available:
6159
* <<apm-list-config>> to list all Agent configurations.
6260
* <<apm-search-config>> to search for an Agent configuration.
6361

62+
See <<apm-app-api-config-manager>> for information on the privileges required to use this API endpoint.
63+
6464
////
6565
*******************************************************
6666
////
@@ -327,6 +327,8 @@ The following APIs are available:
327327
By default, annotations are stored in a newly created `observability-annotations` index.
328328
The name of this index can be changed in your `config.yml` by editing `xpack.observability.annotations.index`.
329329

330+
See <<apm-app-api-annotation-manager>> for information on the privileges required to use this API endpoint.
331+
330332
////
331333
*******************************************************
332334
////

‎docs/apm/apm-app-users.asciidoc‎

Lines changed: 256 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,256 @@
1+
[role="xpack"]
2+
[[apm-app-users]]
3+
== APM app users and privileges
4+
5+
:beat_default_index_prefix: apm
6+
:beat_kib_app: APM app
7+
:annotation_index: `observability-annotations`
8+
9+
++++
10+
<titleabbrev>Users and privileges</titleabbrev>
11+
++++
12+
13+
You can use role-based access control to grant users access to secured
14+
resources. The roles that you set up depend on your organization's security
15+
requirements and the minimum privileges required to use specific features.
16+
17+
{es-security-features} provides {ref}/built-in-roles.html[built-in roles] that grant a
18+
subset of the privileges needed by APM users.
19+
When possible, assign users the built-in roles to minimize the affect of future changes on your security strategy.
20+
If no built-in role is available, you can assign users the privileges needed to accomplish a specific task.
21+
In general, there are three types of privileges you'll work with:
22+
23+
* **Elasticsearch cluster privileges**: Manage the actions a user can perform against your cluster.
24+
* **Elasticsearch index privileges**: Control access to the data in specific indices your cluster.
25+
* **Kibana space privileges**: Grant users write or read access to features and apps within Kibana.
26+
27+
////
28+
*********************************** ***********************************
29+
////
30+
31+
[role="xpack"]
32+
[[apm-app-reader]]
33+
=== APM reader user
34+
35+
++++
36+
<titleabbrev>Create an APM reader user</titleabbrev>
37+
++++
38+
39+
[[apm-app-reader-full]]
40+
==== Full APM reader
41+
42+
APM reader users typically need to view the APM app, dashboards, and visualizations that contain APM data.
43+
These users might also need to create and edit dashboards, visualizations, and machine learning jobs.
44+
45+
. Assign the following built-in roles:
46+
+
47+
[options="header"]
48+
|====
49+
|Role | Purpose
50+
51+
|`kibana_admin`
52+
|Grants access to all features in Kibana.
53+
54+
|`apm_user`
55+
|Grants the privileges required for APM users on +{beat_default_index_prefix}*+ indices
56+
57+
|`machine_learning_admin`
58+
|Grants the privileges required to create, update, and view machine learning jobs
59+
|====
60+
61+
[[apm-app-reader-partial]]
62+
==== Partial APM reader
63+
64+
In some instances, you may wish to restrict certain Kibana apps that a user has access to.
65+
66+
. Assign the following built in roles:
67+
+
68+
[options="header"]
69+
|====
70+
|Role | Purpose
71+
|`apm_user`
72+
|Grants the privileges required for APM users on +{beat_default_index_prefix}*+ indices
73+
|====
74+
75+
. Assign space privileges to any Kibana space that the user needs access to.
76+
Here are two examples:
77+
+
78+
[options="header"]
79+
|====
80+
|Type | Privilege | Purpose
81+
82+
| Spaces
83+
| `Read` or `All` on the {beat_kib_app}
84+
| Allow the use of the the {beat_kib_app}
85+
86+
| Spaces
87+
| `Read` or `All` on Dashboards, Visualize, and Discover
88+
| Allow the user to view, edit, and create dashboards, as well as browse data.
89+
|====
90+
91+
. Finally, assign the following role if a user needs to enable and edit machine learning features:
92+
+
93+
[options="header"]
94+
|====
95+
|Role | Purpose
96+
97+
|`machine_learning_admin`
98+
|Grants the privileges required to create, update, and view machine learning jobs
99+
|====
100+
101+
////
102+
*********************************** ***********************************
103+
////
104+
105+
[role="xpack"]
106+
[[apm-app-central-config-user]]
107+
=== APM app central config user
108+
109+
++++
110+
<titleabbrev>Create a central config user</titleabbrev>
111+
++++
112+
113+
[[apm-app-central-config-manager]]
114+
==== Central configuration manager
115+
116+
Central configuration users need to be able to view, create, update, and delete Agent configurations.
117+
118+
. Assign the following built-in roles:
119+
+
120+
[options="header"]
121+
|====
122+
|Role | Purpose
123+
124+
|`apm_user`
125+
|Grants the privileges required for APM users on +{beat_default_index_prefix}*+ indices
126+
|====
127+
128+
. Assign the following Kibana space privileges:
129+
+
130+
[options="header"]
131+
|====
132+
|Type | Privilege | Purpose
133+
134+
| Spaces
135+
|`All` on {beat_kib_app}
136+
|Allow full use of the {beat_kib_app}
137+
|====
138+
139+
[[apm-app-central-config-reader]]
140+
==== Central configuration reader
141+
142+
In some instances, you may wish to create a user that can only read central configurations,
143+
but not create, update, or delete them.
144+
145+
. Assign the following built-in roles:
146+
+
147+
[options="header"]
148+
|====
149+
|Role | Purpose
150+
|`apm_user`
151+
|Grants the privileges required for APM users on +{beat_default_index_prefix}*+ indices
152+
|====
153+
154+
. Assign the following Kibana space privileges:
155+
+
156+
[options="header"]
157+
|====
158+
|Type | Privilege | Purpose
159+
160+
| Spaces
161+
|`read` on the {beat_kib_app}
162+
|Allow read access to the {beat_kib_app}
163+
|====
164+
165+
[[apm-app-central-config-api]]
166+
==== Central configuration API
167+
168+
See <<apm-app-api-user>>.
169+
170+
////
171+
*********************************** ***********************************
172+
////
173+
174+
[role="xpack"]
175+
[[apm-app-api-user]]
176+
=== APM app API user
177+
178+
++++
179+
<titleabbrev>Create an API user</titleabbrev>
180+
++++
181+
182+
[[apm-app-api-config-manager]]
183+
==== Central configuration API
184+
185+
Users can list, search, create, update, and delete central configurations via the APM app API.
186+
187+
. Assign the following Kibana space privileges:
188+
+
189+
[options="header"]
190+
|====
191+
|Type | Privilege | Purpose
192+
193+
| Spaces
194+
|`all` on the {beat_kib_app}
195+
|Allow all access to the {beat_kib_app}
196+
|====
197+
198+
[[apm-app-api-config-reader]]
199+
==== Central configuration API reader
200+
201+
Sometimes a user only needs to list and search central configurations via the APM app API.
202+
203+
. Assign the following Kibana space privileges:
204+
+
205+
[options="header"]
206+
|====
207+
|Type | Privilege | Purpose
208+
209+
| Spaces
210+
|`read` on the {beat_kib_app}
211+
|Allow read access to the {beat_kib_app}
212+
|====
213+
214+
[[apm-app-api-annotation-manager]]
215+
==== Annotation API
216+
217+
Users can use the annotation API to create annotations on their APM data.
218+
219+
. Create a new role, named something like `annotation_role`,
220+
and assign the following privileges:
221+
+
222+
[options="header"]
223+
|====
224+
|Type | Privilege | Purpose
225+
226+
|Index
227+
|`manage` on +{annotation_index}+ index
228+
|Check if the +{annotation_index}+ index exists
229+
230+
|Index
231+
|`read` on +{annotation_index}+ index
232+
|Read the +{annotation_index}+ index
233+
234+
|Index
235+
|`create_index` on +{annotation_index}+ index
236+
|Create the +{annotation_index}+ index
237+
238+
|Index
239+
|`create_doc` on +{annotation_index}+ index
240+
|Create new annotations in the +{annotation_index}+ index
241+
|====
242+
243+
. Assign the `annotation_role` created previously,
244+
and the following Kibana space privileges to any annotation API users:
245+
+
246+
[options="header"]
247+
|====
248+
|Type | Privilege | Purpose
249+
250+
| Spaces
251+
|`all` on the {beat_kib_app}
252+
|Allow all access to the {beat_kib_app}
253+
|====
254+
255+
//LEARN MORE
256+
//Learn more about <<kibana-feature-privileges,feature privileges>>.

‎docs/apm/index.asciidoc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ include::getting-started.asciidoc[]
3131

3232
include::how-to-guides.asciidoc[]
3333

34+
include::apm-app-users.asciidoc[]
35+
3436
include::settings.asciidoc[]
3537

3638
include::api.asciidoc[]

‎docs/development/core/public/kibana-plugin-core-public.appcategory.label.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
## AppCategory.label property
66

7-
Label used for cateogry name. Also used as aria-label if one isn't set.
7+
Label used for category name. Also used as aria-label if one isn't set.
88

99
<b>Signature:</b>
1010

‎docs/development/core/public/kibana-plugin-core-public.appcategory.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,6 @@ export interface AppCategory
1919
| [ariaLabel](./kibana-plugin-core-public.appcategory.arialabel.md) | <code>string</code> | If the visual label isn't appropriate for screen readers, can override it here |
2020
| [euiIconType](./kibana-plugin-core-public.appcategory.euiicontype.md) | <code>string</code> | Define an icon to be used for the category If the category is only 1 item, and no icon is defined, will default to the product icon Defaults to initials if no icon is defined |
2121
| [id](./kibana-plugin-core-public.appcategory.id.md) | <code>string</code> | Unique identifier for the categories |
22-
| [label](./kibana-plugin-core-public.appcategory.label.md) | <code>string</code> | Label used for cateogry name. Also used as aria-label if one isn't set. |
22+
| [label](./kibana-plugin-core-public.appcategory.label.md) | <code>string</code> | Label used for category name. Also used as aria-label if one isn't set. |
2323
| [order](./kibana-plugin-core-public.appcategory.order.md) | <code>number</code> | The order that categories will be sorted in Prefer large steps between categories to allow for further editing (Default categories are in steps of 1000) |
2424

‎docs/development/core/server/kibana-plugin-core-server.httpservicesetup.registerroutehandlercontext.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ registerRouteHandlerContext: <T extends keyof RequestHandlerContext>(contextName
2121
'myApp',
2222
(context, req) => {
2323
async function search (id: string) {
24-
return await context.elasticsearch.adminClient.callAsInternalUser('endpoint', id);
24+
return await context.elasticsearch.legacy.client.callAsInternalUser('endpoint', id);
2525
}
2626
return { search };
2727
}

0 commit comments

Comments
 (0)