Merge branch 'master' into manage-timeline-2

.ci/Jenkinsfile_flaky

@@ -70,6 +70,8 @@ def getWorkerFromParams(isXpack, job, ciGroup) {
           "run `node scripts/mocha`"
         )
       })
+    } else if (job == 'accessibility') {
+      return kibanaPipeline.functionalTestProcess('kibana-accessibility', './test/scripts/jenkins_accessibility.sh')
     } else if (job == 'firefoxSmoke') {
       return kibanaPipeline.functionalTestProcess('firefoxSmoke', './test/scripts/jenkins_firefox_smoke.sh')
     } else if(job == 'visualRegression') {
@@ -79,7 +81,9 @@ def getWorkerFromParams(isXpack, job, ciGroup) {
     }
   }
 
-  if (job == 'firefoxSmoke') {
+  if (job == 'accessibility') {
+    return kibanaPipeline.functionalTestProcess('xpack-accessibility', './test/scripts/jenkins_xpack_accessibility.sh')
+  } else if (job == 'firefoxSmoke') {
     return kibanaPipeline.functionalTestProcess('xpack-firefoxSmoke', './test/scripts/jenkins_xpack_firefox_smoke.sh')
   } else if(job == 'visualRegression') {
     return kibanaPipeline.functionalTestProcess('xpack-visualRegression', './test/scripts/jenkins_xpack_visual_regression.sh')

.ci/es-snapshots/Jenkinsfile_verify_es

@@ -22,8 +22,8 @@ def SNAPSHOT_MANIFEST = "https://storage.googleapis.com/kibana-ci-es-snapshots-d
 kibanaPipeline(timeoutMinutes: 150) {
   catchErrors {
     slackNotifications.onFailure(
-      title: ":broken_heart: *<${env.BUILD_URL}|[${SNAPSHOT_VERSION}] ES Snapshot Verification Failure>*",
-      message: ":broken_heart: [${SNAPSHOT_VERSION}] ES Snapshot Verification Failure",
+      title: "*<${env.BUILD_URL}|[${SNAPSHOT_VERSION}] ES Snapshot Verification Failure>*",
+      message: "[${SNAPSHOT_VERSION}] ES Snapshot Verification Failure",
     ) {
       retryable.enable(2)
       withEnv(["ES_SNAPSHOT_MANIFEST=${SNAPSHOT_MANIFEST}"]) {

.ci/packer_cache.sh

@@ -35,20 +35,20 @@ mkdir -p ".geckodriver"
 cp "node_modules/geckodriver/geckodriver.tar.gz" .geckodriver/geckodriver.tar.gz
 echo "$geckodriverPkgVersion" > .geckodriver/pkgVersion
 
-echo "Creating bootstrap_cache archive"
-
 # archive cacheable directories
 mkdir -p "$HOME/.kibana/bootstrap_cache"
 tar -cf "$HOME/.kibana/bootstrap_cache/$branch.tar" \
+  node_modules \
+  packages/*/node_modules \
+  x-pack/node_modules \
+  x-pack/legacy/plugins/*/node_modules \
   x-pack/legacy/plugins/reporting/.chromium \
+  test/plugin_functional/plugins/*/node_modules \
+  examples/*/node_modules \
   .es \
   .chromedriver \
   .geckodriver;
 
-echo "Adding node_modules"
-# Find all of the node_modules directories that aren't test fixtures, and aren't inside other node_modules directories, and append them to the tar
-find . -type d -name node_modules -not -path '*__fixtures__*' -prune -print0 | xargs -0I % tar -rf "$HOME/.kibana/bootstrap_cache/$branch.tar" "%"
-
 echo "created $HOME/.kibana/bootstrap_cache/$branch.tar"
 
 if [ "$branch" == "master" ]; then

.eslintignore

@@ -3,6 +3,7 @@
 /.es
 /build
 /built_assets
+/config/apm.dev.js
 /data
 /html_docs
 /optimize

.github/CODEOWNERS

@@ -158,7 +158,6 @@
 /x-pack/legacy/plugins/security/  @elastic/kibana-security
 /x-pack/legacy/plugins/spaces/  @elastic/kibana-security
 /x-pack/plugins/spaces/  @elastic/kibana-security
-/x-pack/legacy/plugins/encrypted_saved_objects/  @elastic/kibana-security
 /x-pack/plugins/encrypted_saved_objects/  @elastic/kibana-security
 /x-pack/plugins/security/  @elastic/kibana-security
 /x-pack/test/api_integration/apis/security/ @elastic/kibana-security

config/kibana.yml

@@ -90,7 +90,7 @@
 # Specifies the path where Kibana creates the process ID file.
 #pid.file: /var/run/kibana.pid
 
-# Enables you specify a file where Kibana stores log output.
+# Enables you to specify a file where Kibana stores log output.
 #logging.dest: stdout
 
 # Set the value of this setting to true to suppress all logging output.

docs/api/saved-objects/bulk_get.asciidoc

@@ -35,7 +35,7 @@ experimental[] Retrieve multiple {kib} saved objects by ID.
 ==== Response body
 
 `saved_objects`::
-  (array) Top-level property the contains objects that represent the response for each of the requested objects. The order of the objects in the response is identical to the order of the objects in the request.
+  (array) Top-level property containing objects that represent the response for each of the requested objects. The order of the objects in the response is identical to the order of the objects in the request.
 
 Saved objects that are unable to persist are replaced with an error object.
 

docs/apm/api.asciidoc

@@ -11,6 +11,12 @@ Some APM app features are provided via a REST API:
 * <<agent-config-api>>
 * <<apm-annotation-api>>
 
+[float]
+[[apm-api-example]]
+=== Using the APIs
+
+Users interacting with APM APIs must have <<apm-app-api-user,sufficient privileges>>.
+In addition, there are request headers to be aware of, like `kbn-xsrf: true`, and `Content-Type: applicaton/json`.
 Here's an example CURL request that adds an annotation to the APM app:
 
 [source,curl]
@@ -32,16 +38,8 @@ curl -X POST \
     }'
 ----
 
-For more information, the Kibana <<api,REST API reference>> provides information on how to use Kibana APIs,
-like required request headers and authentication options.
-
-// AGENT CONFIG API
-// GET --> Feature (APM) Read
-// CREATE/EDIT/DELETE --> Feature (APM) All
-
-// ANNOTATION API
-// Feature (APM) All
-// Index: `observability-annotations`. Privileges: `create_index`, `create_doc`, `manage`, and `read`.
+The Kibana <<api,REST API reference>> provides additional information on how to use Kibana APIs,
+required request headers, and token-based authentication options.
 
 ////
 *******************************************************
@@ -61,6 +59,8 @@ The following Agent configuration APIs are available:
 * <<apm-list-config>> to list all Agent configurations.
 * <<apm-search-config>> to search for an Agent configuration.
 
+See <<apm-app-api-config-manager>> for information on the privileges required to use this API endpoint.
+
 ////
 *******************************************************
 ////
@@ -327,6 +327,8 @@ The following APIs are available:
 By default, annotations are stored in a newly created `observability-annotations` index.
 The name of this index can be changed in your `config.yml` by editing `xpack.observability.annotations.index`.
 
+See <<apm-app-api-annotation-manager>> for information on the privileges required to use this API endpoint.
+
 ////
 *******************************************************
 ////

docs/apm/apm-app-users.asciidoc

@@ -0,0 +1,256 @@
+[role="xpack"]
+[[apm-app-users]]
+== APM app users and privileges
+
+:beat_default_index_prefix: apm
+:beat_kib_app: APM app
+:annotation_index: `observability-annotations`
+
+++++
+<titleabbrev>Users and privileges</titleabbrev>
+++++
+
+You can use role-based access control to grant users access to secured
+resources. The roles that you set up depend on your organization's security
+requirements and the minimum privileges required to use specific features.
+
+{es-security-features} provides {ref}/built-in-roles.html[built-in roles] that grant a
+subset of the privileges needed by APM users.
+When possible, assign users the built-in roles to minimize the affect of future changes on your security strategy.
+If no built-in role is available, you can assign users the privileges needed to accomplish a specific task.
+In general, there are three types of privileges you'll work with:
+
+* **Elasticsearch cluster privileges**: Manage the actions a user can perform against your cluster.
+* **Elasticsearch index privileges**: Control access to the data in specific indices your cluster.
+* **Kibana space privileges**: Grant users write or read access to features and apps within Kibana.
+
+////
+***********************************  ***********************************
+////
+
+[role="xpack"]
+[[apm-app-reader]]
+=== APM reader user
+
+++++
+<titleabbrev>Create an APM reader user</titleabbrev>
+++++
+
+[[apm-app-reader-full]]
+==== Full APM reader
+
+APM reader users typically need to view the APM app, dashboards, and visualizations that contain APM data.
+These users might also need to create and edit dashboards, visualizations, and machine learning jobs.
+
+. Assign the following built-in roles:
++
+[options="header"]
+|====
+|Role | Purpose
+
+|`kibana_admin`
+|Grants access to all features in Kibana.
+
+|`apm_user`
+|Grants the privileges required for APM users on +{beat_default_index_prefix}*+ indices
+
+|`machine_learning_admin`
+|Grants the privileges required to create, update, and view machine learning jobs
+|====
+
+[[apm-app-reader-partial]]
+==== Partial APM reader
+
+In some instances, you may wish to restrict certain Kibana apps that a user has access to.
+
+. Assign the following built in roles:
++
+[options="header"]
+|====
+|Role | Purpose
+|`apm_user`
+|Grants the privileges required for APM users on +{beat_default_index_prefix}*+ indices
+|====
+
+. Assign space privileges to any Kibana space that the user needs access to.
+Here are two examples:
++
+[options="header"]
+|====
+|Type | Privilege | Purpose
+
+| Spaces
+| `Read` or `All` on the {beat_kib_app}
+| Allow the use of the the {beat_kib_app}
+
+| Spaces
+| `Read` or `All` on Dashboards, Visualize, and Discover
+| Allow the user to view, edit, and create dashboards, as well as browse data.
+|====
+
+. Finally, assign the following role if a user needs to enable and edit machine learning features:
++
+[options="header"]
+|====
+|Role | Purpose
+
+|`machine_learning_admin`
+|Grants the privileges required to create, update, and view machine learning jobs
+|====
+
+////
+***********************************  ***********************************
+////
+
+[role="xpack"]
+[[apm-app-central-config-user]]
+=== APM app central config user
+
+++++
+<titleabbrev>Create a central config user</titleabbrev>
+++++
+
+[[apm-app-central-config-manager]]
+==== Central configuration manager
+
+Central configuration users need to be able to view, create, update, and delete Agent configurations.
+
+. Assign the following built-in roles:
++
+[options="header"]
+|====
+|Role | Purpose
+
+|`apm_user`
+|Grants the privileges required for APM users on +{beat_default_index_prefix}*+ indices
+|====
+
+. Assign the following Kibana space privileges:
++
+[options="header"]
+|====
+|Type | Privilege | Purpose
+
+| Spaces
+|`All` on {beat_kib_app}
+|Allow full use of the {beat_kib_app}
+|====
+
+[[apm-app-central-config-reader]]
+==== Central configuration reader
+
+In some instances, you may wish to create a user that can only read central configurations,
+but not create, update, or delete them.
+
+. Assign the following built-in roles:
++
+[options="header"]
+|====
+|Role | Purpose
+|`apm_user`
+|Grants the privileges required for APM users on +{beat_default_index_prefix}*+ indices
+|====
+
+. Assign the following Kibana space privileges:
++
+[options="header"]
+|====
+|Type | Privilege | Purpose
+
+| Spaces
+|`read` on the {beat_kib_app}
+|Allow read access to the {beat_kib_app}
+|====
+
+[[apm-app-central-config-api]]
+==== Central configuration API
+
+See <<apm-app-api-user>>.
+
+////
+***********************************  ***********************************
+////
+
+[role="xpack"]
+[[apm-app-api-user]]
+=== APM app API user
+
+++++
+<titleabbrev>Create an API user</titleabbrev>
+++++
+
+[[apm-app-api-config-manager]]
+==== Central configuration API
+
+Users can list, search, create, update, and delete central configurations via the APM app API.
+
+. Assign the following Kibana space privileges:
++
+[options="header"]
+|====
+|Type | Privilege | Purpose
+
+| Spaces
+|`all` on the {beat_kib_app}
+|Allow all access to the {beat_kib_app}
+|====
+
+[[apm-app-api-config-reader]]
+==== Central configuration API reader
+
+Sometimes a user only needs to list and search central configurations via the APM app API.
+
+. Assign the following Kibana space privileges:
++
+[options="header"]
+|====
+|Type | Privilege | Purpose
+
+| Spaces
+|`read` on the {beat_kib_app}
+|Allow read access to the {beat_kib_app}
+|====
+
+[[apm-app-api-annotation-manager]]
+==== Annotation API
+
+Users can use the annotation API to create annotations on their APM data.
+
+. Create a new role, named something like `annotation_role`,
+and assign the following privileges:
++
+[options="header"]
+|====
+|Type | Privilege | Purpose
+
+|Index
+|`manage` on +{annotation_index}+ index
+|Check if the +{annotation_index}+ index exists
+
+|Index
+|`read` on +{annotation_index}+ index
+|Read the +{annotation_index}+ index
+
+|Index
+|`create_index` on +{annotation_index}+ index
+|Create the +{annotation_index}+ index
+
+|Index
+|`create_doc` on +{annotation_index}+ index
+|Create new annotations in the +{annotation_index}+ index
+|====
+
+. Assign the `annotation_role` created previously,
+and the following Kibana space privileges to any annotation API users:
++
+[options="header"]
+|====
+|Type | Privilege | Purpose
+
+| Spaces
+|`all` on the {beat_kib_app}
+|Allow all access to the {beat_kib_app}
+|====
+
+//LEARN MORE
+//Learn more about <<kibana-feature-privileges,feature privileges>>.