[Breaking change] forbid elasticsearch.username: elastic in production

[kobelb]

Change description

Which release will ship the breaking change?

This is deprecated but we are not sure when we will actually stop supporting it.

Edit Jan 2022: elastic/elasticsearch#81400 will change the superuser role to remove write access to system indices. That will implicitly prevent Kibana from using the elastic superuser to authenticate to Elasticsearch, since Kibana needs to be able to write to system indices. This means Kibana will stop supporting authenticating to ES with the elastic superuser (and other superusers) starting in 8.0.
See also: #122704

Describe the change. How will it manifest to users?

We should not allow Kibana to be configured with elasticsearch.username: elastic; that is a superuser and Kibana should run with minimal privileges.

Starting in 7.6, started logging a deprecation warning when Kibana is configured with the elastic user in production (#48247).

Starting in 7.16, we should ensure that this is also surfaced in the upgrade assistant.

In a later version (TBD) we will actually prevent Kibana from starting when this is used in production.

How many users will be affected?

TBD

What can users do to address the change manually?

Use Kibana's user management to set the password for the kibana_system user, and update all kibana.yml's to use this username and password for the elasticsearch.username and elasticsearch.password.

How could we make migration easier with the Upgrade Assistant?

There isn't a good way to use the Upgrade Assistant to do so. We don't want the Kibana server to be able to write values to the kibana.yml, nor do we have a way of doing so across every instance of Kibana.

Are there any edge cases?

No

Test Data

Example kibana.yml:

elasticsearch.username: elastic
elasticsearch.password: changeme

(note: need to run Kibana in production mode, it will not start in dev mode with this configuration)

Cross links

This is related to #81680.

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[jportner]

I changed this issue title and description --
We still plan to make this breaking change eventually, just not in 8.0.

However, we will add a deprecation message in the Upgrade Assistant starting in 7.16.