Merge branch '9.0' into backport/9.0/pr-130279

Author: piergm

build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/RestrictedBuildApiService.java

@@ -59,9 +59,6 @@ private static ListMultimap<Class<?>, String> createLegacyRestTestBasePluginUsag
         map.put(LegacyRestTestBasePlugin.class, ":x-pack:plugin:deprecation:qa:early-deprecation-rest");
         map.put(LegacyRestTestBasePlugin.class, ":x-pack:plugin:deprecation:qa:rest");
         map.put(LegacyRestTestBasePlugin.class, ":x-pack:plugin:downsample:qa:with-security");
-        map.put(LegacyRestTestBasePlugin.class, ":x-pack:plugin:enrich:qa:rest");
-        map.put(LegacyRestTestBasePlugin.class, ":x-pack:plugin:enrich:qa:rest-with-advanced-security");
-        map.put(LegacyRestTestBasePlugin.class, ":x-pack:plugin:enrich:qa:rest-with-security");
         map.put(LegacyRestTestBasePlugin.class, ":x-pack:plugin:ent-search:qa:rest");
         map.put(LegacyRestTestBasePlugin.class, ":x-pack:plugin:eql:qa:ccs-rolling-upgrade");
         map.put(LegacyRestTestBasePlugin.class, ":x-pack:plugin:eql:qa:correctness");

docs/changelog/131680.yaml

@@ -0,0 +1,5 @@
+pr: 131680
+summary: Grant server module read/write entitlements for deprecated path setting "path.shared_data"
+area: Infra/Core
+type: bug
+issues: []

docs/reference/elasticsearch-plugins/cloud/ec-plugins-guide.md

@@ -49,7 +49,7 @@ curl -X POST \
   -H "Authorization: ApiKey $CLOUD_API_KEY" \
   -H 'Content-Type: application/json' \
   -d '{
-   "download_url" : "https://my_site/custom-plugin-8.4.3.zip",
+   "download_url" : "<MY_SITE_URL>/custom-plugin-8.4.3.zip",
    "extension_type" : "plugin",
    "name" : "custom-plugin",
    "version" : "8.4.3"
@@ -323,7 +323,7 @@ curl -X POST \
   -H "Authorization: ApiKey $CLOUD_API_KEY" \
   -H 'Content-Type: application/json' \
   -d '{
-   "download_url" : "https://my_site/custom-plugin-8.4.3-10212022.zip",
+   "download_url" : "<MY_SITE_URL>/custom-plugin-8.4.3-10212022.zip",
    "extension_type" : "plugin",
     "name": "custom-plugin-10212022",
    "version" : "8.4.3"

docs/reference/elasticsearch-plugins/manage-plugins-using-configuration-file.md

@@ -25,7 +25,7 @@ plugins:
   - id: analysis-icu
   - id: repository-azure
   - id: custom-mapper
-    location: https://example.com/archive/custom-mapper-1.0.0.zip
+    location: <EXAMPLE_URL>/archive/custom-mapper-1.0.0.zip
 ```
 
 This example installs the official `analysis-icu` and `repository-azure` plugins, and one unofficial plugin. Every plugin must provide an `id`. Unofficial plugins must also provide a `location`. This is typically a URL, but Maven coordinates are also supported. The downloaded plugin’s name must match the ID in the configuration file.
@@ -35,7 +35,7 @@ While {{es}} will respect the [standard Java proxy system properties](https://do
 ```yaml
 plugins:
   - id: custom-mapper
-    location: https://example.com/archive/custom-mapper-1.0.0.zip
+    location: <EXAMPLE_URL>/archive/custom-mapper-1.0.0.zip
 proxy: proxy.example.com:8443
 ```
 

docs/reference/elasticsearch-plugins/plugin-management-custom-url.md

@@ -46,13 +46,13 @@ HTTP
 :   To install a plugin from an HTTP URL:
 
     ```shell
-    sudo bin/elasticsearch-plugin install https://some.domain/path/to/plugin.zip
+    sudo bin/elasticsearch-plugin install <EXAMPLE_PLUGIN_HOST_URL>/plugin.zip
     ```
 
     The plugin script will refuse to talk to an HTTPS URL with an untrusted certificate. To use a self-signed HTTPS cert, you will need to add the CA cert to a local Java truststore and pass the location to the script as follows:
 
     ```shell
-    sudo CLI_JAVA_OPTS="-Djavax.net.ssl.trustStore=/path/to/trustStore.jks" bin/elasticsearch-plugin install https://host/plugin.zip
+    sudo CLI_JAVA_OPTS="-Djavax.net.ssl.trustStore=/path/to/trustStore.jks" bin/elasticsearch-plugin install <MY_HOST_URL>/plugin.zip
     ```
 
 

docs/reference/elasticsearch/command-line-tools/saml-metadata.md

@@ -112,6 +112,6 @@ bin/elasticsearch-saml-metadata --realm saml2 \
     --locale en-GB \
     --contacts \
     --organisation-name "Mega Corp. Finance Team" \
-    --organisation-url "http://mega.example.com/finance/"
+    --organisation-url "<EXAMPLE_URL>/finance/"
 ```
 

docs/reference/elasticsearch/configuration-reference/machine-learning-settings.md

@@ -119,7 +119,7 @@ $$$xpack.ml.model_repository$$$
     or
 
     ```
-    xpack.ml.model_repository: https://my-custom-backend
+    xpack.ml.model_repository: <MY_CUSTOM_BACKEND_URL>
     ```
 
     If `xpack.ml.model_repository` is a file location, it must point to a subdirectory of the `config` directory of {{es}}.

docs/reference/elasticsearch/configuration-reference/monitoring-settings.md

@@ -200,13 +200,13 @@ xpack.monitoring.exporters.my_remote:
         host: "10.1.2.3"
       example2:
         type: http
-        host: ["http://10.1.2.4"]
+        host: ["<HOST_IP>"]
       example3:
         type: http
         host: ["10.1.2.5", "10.1.2.6"]
       example4:
         type: http
-        host: ["https://10.1.2.3:9200"]
+        host: ["HOST_IP>:9200"]
     ```
 
 

docs/reference/elasticsearch/configuration-reference/security-settings.md

@@ -1403,16 +1403,16 @@ In addition to the [settings that are valid for all realms](#ref-realm-settings)
 :   ([Static](docs-content://deploy-manage/stack-settings.md#static-cluster-setting)) The token type, `id_token` or `access_token`, that the JWT realm uses to verify incoming JWTs. Defaults to `id_token`.
 
 `allowed_audiences` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted")
-:   ([Static](docs-content://deploy-manage/stack-settings.md#static-cluster-setting)) A list of allowed JWT audiences that {{es}} should verify. {{es}} will only consume JWTs that were intended for any of these audiences, as denoted by the `aud` claim in the JWT). The audiences are compared with exact string matches and do not support wildcards or regex. Examples of `aud` claim are `https://example.com/client1` and `other_service,elasticsearch`. When `token_type` is `access_token`, the audiences can be optionally denoted by a different claim in the JWT if `aud` does not exist. See also [`fallback_claims.aud`](#security-settings-jwt-fallback-claims-aud).
+:   ([Static](docs-content://deploy-manage/stack-settings.md#static-cluster-setting)) A list of allowed JWT audiences that {{es}} should verify. {{es}} will only consume JWTs that were intended for any of these audiences, as denoted by the `aud` claim in the JWT). The audiences are compared with exact string matches and do not support wildcards or regex. Examples of `aud` claim are `<example-url>/client1` and `other_service,elasticsearch`. When `token_type` is `access_token`, the audiences can be optionally denoted by a different claim in the JWT if `aud` does not exist. See also [`fallback_claims.aud`](#security-settings-jwt-fallback-claims-aud).
 
 `allowed_clock_skew` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted")
 :   ([Static](docs-content://deploy-manage/stack-settings.md#static-cluster-setting)) The maximum allowed clock skew to be taken into consideration when validating JWTs with regards to their creation, not before, and expiration times.
 
 `allowed_issuer` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted")
-:   ([Static](docs-content://deploy-manage/stack-settings.md#static-cluster-setting)) A verifiable Identifier for your JWT Issuer. An Issuer Identifier is usually a case sensitive URL using the https scheme that contains scheme, host, and optionally, port number and path components and no query or fragment components. However, it can be any string. The value for this setting should be provided by your JWT Issuer. The issuer is compared with exact string matches and do not support wildcards or regex. Examples of `iss` claim are `https://example.com:8443/jwt` and `issuer123`.
+:   ([Static](docs-content://deploy-manage/stack-settings.md#static-cluster-setting)) A verifiable Identifier for your JWT Issuer. An Issuer Identifier is usually a case sensitive URL using the https scheme that contains scheme, host, and optionally, port number and path components and no query or fragment components. However, it can be any string. The value for this setting should be provided by your JWT Issuer. The issuer is compared with exact string matches and do not support wildcards or regex. Examples of `iss` claim are `<example-url>:8443/jwt` and `issuer123`.
 
 `allowed_subjects` ![logo cloud](https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg "Supported on Elastic Cloud Hosted")
-:   ([Static](docs-content://deploy-manage/stack-settings.md#static-cluster-setting)) A list of allowed JWT subjects that {{es}} should verify. {{es}} will only consume JWTs that were issued for any of these subjects, as denoted by the `sub` claim in the JWT. The subjects are compared with exact string matches and do not support wildcards or regex. Examples of `sub` claim are `https://example.com/user1` and `user_1,user2`. When `token_type` is `access_token`, this setting is mandatory and the subject can be optionally denoted by a different claim in the JWT if `sub` does not exist. See also [`fallback_claims.sub`](#security-settings-jwt-fallback-claims-sub).
+:   ([Static](docs-content://deploy-manage/stack-settings.md#static-cluster-setting)) A list of allowed JWT subjects that {{es}} should verify. {{es}} will only consume JWTs that were issued for any of these subjects, as denoted by the `sub` claim in the JWT. The subjects are compared with exact string matches and do not support wildcards or regex. Examples of `sub` claim are `<example-url>/user1` and `user_1,user2`. When `token_type` is `access_token`, this setting is mandatory and the subject can be optionally denoted by a different claim in the JWT if `sub` does not exist. See also [`fallback_claims.sub`](#security-settings-jwt-fallback-claims-sub).
 
 $$$security-settings-jwt-fallback-claims-sub$$$
 

docs/reference/elasticsearch/rest-apis/reindex-indices.md

@@ -592,7 +592,7 @@ POST _reindex
 {
   "source": {
     "remote": {
-      "host": "http://otherhost:9200",
+      "host": "<OTHER_HOST_URL>:9200",
       "username": "user",
       "password": "pass"
     },
@@ -625,7 +625,7 @@ POST _reindex
 {
   "source": {
     "remote": {
-      "host": "http://otherhost:9200",
+      "host": "<OTHER_HOST_URL>:9200",
       "headers": {
         "Authorization": "ApiKey API_KEY_VALUE"
       }
@@ -674,7 +674,7 @@ POST _reindex
 {
   "source": {
     "remote": {
-      "host": "http://otherhost:9200",
+      "host": "<OTHER_HOST_URL>:9200",
       ...
     },
     "index": "source",
@@ -704,7 +704,7 @@ POST _reindex
 {
   "source": {
     "remote": {
-      "host": "http://otherhost:9200",
+      "host": "<OTHER_HOST_URL>:9200",
       ...,
       "socket_timeout": "1m",
       "connect_timeout": "10s"