[DOC] Backup & Restore Security Configuration

[albertzaharovits]

Documents how to backup and restore the configuration for security features.

This started of as documenting "Backup .security" but escalated fast, because it required explaining the relation with all the other configurations (eg which one goes first) . Documenting just the configuration part from the .security index would have raised more questions than answers, IMO.

[elasticmachine]

Pinging @elastic/es-security

[lcawl]

I'm tempted to move this up a level e.g. as a peer to the "Configuring security" section, so that we can break this into multiple pages. Do you have a strong preference for keeping it all on one long page?

[lcawl]

There is information missing here after "the"

[lcawl]

I think this step needs more information since it wasn't clear to me what "earlier" was referring to or what exact steps I needed to perform here.

[albertzaharovits]

@lcawl I have skipped a test that added a user because the fixture was complaining that security must be explicitly enabled for a trial license.
In addition, I have merged backup-security-config.asciidoc and restore-security-config.asciidoc in a single file because //TEST [continued] does not work across files. I believe it's better to have them separated but I don't know how to do that (without duplicating test setups in the second file). Lastly, I have added NOTCONSOLE to some curl cmds that should be run from the local shell.

[albertzaharovits]

@lcawl This commit does not apply cleanly to 6.8, yet the technical bits (the snapshot_user role) would work in 6.8 .
I know this is part of a bigger docs overhauling, do you think it is worthy/feasible a backport to 6.8 ? Security conf backups don't work across major versions, so the benefits of a backup in 6.8 are less important.

[lcawl]

At this time, that Administering Elasticsearch section only exists in 7.3 and later branches so if there's not a strong motivation for making it work there, I think we should refrain from backporting to that branch.

[albertzaharovits]

@tvernum this has been merged to 7.3, 7.x and master .
But we did a mistake to not document at the time we had parts of the feature ready. In this case, snapshot_user role exists since 6.7 and tokens were moved to a dedicated index since 7.2 .
I think "Administering Elasticsearch" doc section should be backported to 7.0 (It is prob of little value to backport to 6.8 since security restores don't work across major versions). I chatted with @lcawl about the possibility to backport the doc restructuring to 7.0 and there was no opposition.

So, do you think we should backport this doc section to all 7.x versions?

[albertzaharovits]

Backported to 7.0, 7.1 and 7.2.

[albertzaharovits]

Backports to 7.0 and 7.1 have been reverted. We've discussed this in our weekly meeting. There is nothing in this PR that would justify it be an exception to our usual backporting strategy. Moreover, before 7.2, there were security tokens stored in the .security index, so the wording in the docs would not be 100% accurate.