Merge branch 'main' into use-version-variables-cloud

Author: colleenmcginnis

cloud-account/dark-mode.md

@@ -6,7 +6,7 @@ applies_to:
 
 # Use dark mode in Kibana
 
-The dark mode changes Kibana's default light appearance to a darker and higher-contrast color theme. From the application header, you can turn on dark mode or synchronize the color mode with your operating system settings.
+The dark mode changes Kibana's default light appearance to a darker color theme. From the application header, you can turn on dark mode or synchronize the color mode with your operating system settings.
 
 :::{tip}
 If you're using {{ecloud}}, this setting only applies to the Kibana UI of your serverless projects and hosted deployments. If you'd like to change the {{ecloud}} Console color theme too, you must do so separately from its respective interface.
@@ -16,10 +16,15 @@ If you're using {{ecloud}}, this setting only applies to the Kibana UI of your s
 
 1. Open the user menu from the header.
 2. Select **Appearance**.
+   
+   :::{note}
+   On self-managed deployments of {{kib}}, this option is located on your profile page. To access it, select **Edit profile** from the header's user menu.
+   :::
+
 3. Choose a color mode:
 
     - **Light**: The default color mode of Kibana
-    - **Dark**: The dark and high-contrast color mode of Kibana
+    - **Dark**: The dark color mode of Kibana
     - **System**: Synchronizes Kibana's color mode with your system settings
     - **Space default**: Sets the color mode to the value defined in the [Space settings](kibana://reference/advanced-settings.md#kibana-general-settings)
 

cloud-account/high-contrast.md

@@ -0,0 +1,28 @@
+---
+description: Use high-contrast mode in Kibana.
+applies_to:
+  stack: ga 9.1
+  serverless: ga
+products:
+  - id: kibana
+---
+
+# Use high-contrast mode in Kibana
+
+You can change the interface contrast mode of Kibana to improve visibility and readability in low-light conditions.
+
+1. Open the user menu from the header.
+2. Select **Appearance**.
+   
+   :::{note}
+   On self-managed deployments of {{kib}}, this option is located on your profile page. To access it, select **Edit profile** from the header's user menu.
+   :::
+
+3. Choose an interface contrast mode:
+
+    - **System**: Synchronizes Kibana's contrast mode with your system settings.
+    - **Normal**: Normal contrast mode.
+    - **High**: The high-contrast color mode of Kibana.
+
+4. Select **Save changes**.
+5. Refresh the page to apply the selected contrast mode.

cloud-account/toc.yml

@@ -6,4 +6,5 @@ toc:
   - file: change-your-password.md
   - file: add-a-login-method.md
   - file: multifactor-authentication.md
-  - file: dark-mode.md
+  - file: dark-mode.md
+  - file: high-contrast.md

deploy-manage/api-keys/elastic-cloud-api-keys.md

@@ -30,7 +30,7 @@ These keys provides access to the API that enables you to manage your deployment
 3. On the **API keys** tab of the **Organization** page, click **Create API key**.
 4. On the **Create API key** flyout, you can configure your new key by adding a name, set expiration, or assign [roles](../users-roles/cloud-organization/user-roles.md).
 
-    By default, API keys expire after three months. You can set the expiration to a different preset value or to a specific date, up to one year. If you need the key to work indefinitely, you can also set its expiration to Never. In this case, the key won’t expire.
+    By default, API keys expire after three months. You can set the expiration to a different preset value or to a specific date, up to one year. If you need the key to work indefinitely, you can also set its expiration to Never. In this case, the key won’t expire. Each user is allowed to create up to 64 API keys.
 
     ::::{note}
     When an API key is nearing expiration, Elastic sends an email to the creator of the API key and each of the operational contacts. When you use an API key to authenticate, the API response header `X-Elastic-Api-Key-Expiration` indicates the key’s expiration date. You can log this value to detect API keys that are nearing expiration.

deploy-manage/deploy/cloud-enterprise/deploy-large-installation.md

@@ -14,11 +14,11 @@ products:
 This type of installation is recommended for deployments with significant overall search and indexing throughput. You need:
 
 * 3 hosts with at least 64 GB RAM each for directors and coordinators (ECE management services)
-* 3 hosts for allocators, each with one of the following RAM configurations:
+* A minimum of 3 hosts for allocators, using one of the following configurations per availability zone:
 
-    * 1 x 256 GB RAM
-    * 2 x 128 GB RAM
-    * 4 x 64 GB RAM
+    * 1 host with 256 GB RAM → 3 hosts total
+    * 2 hosts with 128 GB RAM each → 6 hosts total
+    * 4 hosts with 64 GB RAM each → 12 hosts total
 
 * 3 hosts with 16 GB RAM each for proxies
 * 3 availability zones
@@ -27,6 +27,10 @@ This type of installation is recommended for deployments with significant overal
 :alt: A large installation with nine to twelve hosts across three availability zones
 :::
 
+::::{note}
+In the diagram, the Director Coordinator host in Availability zone 1, which represents the first host to be installed, has the allocator and proxy roles greyed out. This host temporarily holds all roles until the other nodes are added and configured. Eventually, the allocator and proxy roles will be removed from this host.
+::::
+
 ## Important considerations  [ece_before_you_start_3]
 
 Note that the large-sized {{ece}} installation separates the allocator and proxy roles from the director and coordinator roles (ECE management services).
@@ -100,8 +104,24 @@ Make sure you have completed all prerequisites and environment preparations desc
     bash <(curl -fsSL https://download.elastic.co/cloud/elastic-cloud-enterprise.sh) install --coordinator-host HOST_IP --roles-token 'MY_TOKEN' --roles "proxy" --availability-zone MY_ZONE-3 --memory-settings '{"runner":{"xms":"1G","xmx":"1G"}}'
     ```
 
-6. [Change the deployment configuration](working-with-deployments.md) for the `admin-console-elasticsearch`, `logging-and-metrics`, and `security` clusters to use three availability zones and resize the nodes to use at least 4 GB of RAM. This change makes sure that the clusters used by the administration console are highly available and provisioned sufficiently.
+6. [Log into the Cloud UI](log-into-cloud-ui.md).
+
+7. [Change the deployment configuration](/deploy-manage/deploy/cloud-enterprise/customize-deployment.md) for the `admin-console-elasticsearch`, `logging-and-metrics`, and `security` [system deployments](/deploy-manage/deploy/cloud-enterprise/system-deployments-configuration.md) to use three availability zones and resize the nodes to use at least 4 GB of RAM. This ensures the system clusters are both highly available and sufficiently provisioned.
+
+8. [Vacate all instances from the initial host](/deploy-manage/maintenance/ece/move-nodes-instances-from-allocators.md#move-nodes-from-allocators). This host runs some {{es}} and {{kib}} instances from system deployments, which must be moved to other allocators before proceeding.
+
+    Wait until all instances have been moved off the initial host before continuing.
+
+9. [Remove the `allocator` and `proxy` roles](/deploy-manage/deploy/cloud-enterprise/assign-roles-to-hosts.md) from the initial host. You cannot remove the `allocator` role until all instances have been vacated.
+
+    ::::{note}
+    After removing the proxy role from the first host, the {{es}} and {{kib}} URLs shown in the Cloud UI will stop working. This happens because the **Deployment domain name** in **Platform** > **Settings** is set to the IP address of the first host, in the format `FIRST_HOST_IP.ip.es.io`. For more details, refer to [Change endpoint URLs](./change-endpoint-urls.md).
+
+    To resolve this, follow the steps in [Post-installation steps](./post-installation-steps.md) to complete the integration between your load balancer, ECE proxies, TLS certificates, and wildcard DNS record.
+    ::::
 
-7. [Log into the Cloud UI](log-into-cloud-ui.md) to provision your deployment.
+    ::::{tip}
+    If you don't yet have a load balancer, TLS certificates, or a wildcard DNS record ready, you can [change the endpoint URL](./change-endpoint-urls.md) to the IP address of one of the ECE proxies, using the format `PROXY_IP.ip.es.io`. This will allow you to continue using the deployment endpoint URLs provided by the Cloud UI.
+    ::::
 
-Once the installation is complete, you can continue with [](./post-installation-steps.md).
+Once the installation is complete, you can continue with [](./post-installation-steps.md).

deploy-manage/deploy/cloud-enterprise/deploy-medium-installation.md

@@ -21,6 +21,10 @@ This type of installation is recommended for many production setups. You need:
 :alt: A medium installation with nine to twelve hosts across three availability zones
 :::
 
+::::{note}
+In the diagram, the Director Coordinator host in Availability zone 1, which represents the first host to be installed, has the allocator role greyed out. This host temporarily holds all roles until the other nodes are added and configured. Eventually, the allocator role will be removed from this host.
+::::
+
 ## Important considerations  [ece_before_you_start_2]
 
 * Monitor the load on proxies and make sure the volume of user requests routed by the proxies does not affect the resources available to the ECE management services.
@@ -85,8 +89,14 @@ Make sure you have completed all prerequisites and environment preparations desc
     bash <(curl -fsSL https://download.elastic.co/cloud/elastic-cloud-enterprise.sh) install --coordinator-host HOST_IP --roles-token 'ALLOCATOR_TOKEN' --roles "allocator" --availability-zone MY_ZONE-3 --memory-settings '{"runner":{"xms":"1G","xmx":"1G"},"allocator":{"xms":"4G","xmx":"4G"}}'
     ```
 
-5. [Change the deployment configuration](working-with-deployments.md) for the `admin-console-elasticsearch`, `logging-and-metrics`, and `security` clusters to use three availability zones and resize the nodes to use at least 4 GB of RAM. This change makes sure that the clusters used by the administration console are highly available and provisioned sufficiently.
+5. [Log into the Cloud UI](log-into-cloud-ui.md).
+
+6. [Change the deployment configuration](/deploy-manage/deploy/cloud-enterprise/customize-deployment.md) for the `admin-console-elasticsearch`, `logging-and-metrics`, and `security` [system deployments](/deploy-manage/deploy/cloud-enterprise/system-deployments-configuration.md) to use three availability zones and resize the nodes to use at least 4 GB of RAM. This ensures the system clusters are both highly available and sufficiently provisioned.
+
+7. [Vacate all instances from the initial host](/deploy-manage/maintenance/ece/move-nodes-instances-from-allocators.md#move-nodes-from-allocators). This host runs some {{es}} and {{kib}} instances from system deployments, which must be moved to other allocators before proceeding.
+
+    Wait until all instances have been moved off the initial host before continuing.
 
-6. [Log into the Cloud UI](log-into-cloud-ui.md) to provision your deployment.
+8. [Remove the `allocator` role](/deploy-manage/deploy/cloud-enterprise/assign-roles-to-hosts.md) from the initial host. You cannot remove the role until all instances have been vacated.
 
-Once the installation is complete, you can continue with [](./post-installation-steps.md).
+Once the installation is complete, you can continue with [](./post-installation-steps.md).

deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings.md

@@ -137,13 +137,14 @@ This table compares Security capabilities between {{ech}} deployments and Server
 |---------|---------------------|------------------------------|------------------|
 | **[Advanced Entity Analytics](/solutions/security/advanced-entity-analytics.md)** | ✅ | ✅ | |
 | **[AI Assistant](/solutions/security/ai/ai-assistant.md)** | ✅ | ✅ | |
-| **API keys** | ✅ | ✅ | |
+| **[API keys](/deploy-manage/api-keys.md)** | ✅ | ✅ | |
 | **[Cloud Security](/solutions/security/cloud.md)** | ✅ | ✅ | |
 | [**Defend for Containers integration**](https://www.elastic.co/guide/en/security/8.18/d4c-overview.html) | ✅ (deprecated in 9.0) | ❌ | Not available in Serverless |
 | **[Endpoint security](/solutions/security/configure-elastic-defend.md)** | ✅ | ✅ | |
 | **[Kibana Alerts](/deploy-manage/monitor/monitoring-data/configure-stack-monitoring-alerts.md)** | ✅ | ✅ | |
 | **Kibana navigation** | Standard layout | Different layout | UI differences in Security projects |
 | **[LogsDB](/manage-data/data-store/data-streams/logs-data-stream.md)** | Optional | ✅ | - Enabled by default <br>- Cannot be disabled |
+| **[Native realm authentication](/deploy-manage/users-roles/cluster-or-deployment-auth/native.md)** | ✅ | ❌ | Only API key-based authentication is supported at the project level. User authentication, including SAML SSO, is managed at the [organization level](/deploy-manage/users-roles/cloud-organization.md). |
 | **Role-based access control** | ✅ | Limited | Core RBAC functionality supported |
 | **SIEM capabilities** | ✅ | ✅ | Core functionality supported |