[Breaking change] kibana_user role removed and replaced by kibana_admin

[kobelb]

Change description

Which release will ship the breaking change?

8.0

Describe the change. How will it manifest to users?

The kibana_user role has been removed, and users should use the kibana_admin role instead. Users who are still assigned the kibana_user role will no longer be granted those privileges and will be unable to login and use Kibana.

How many users will be affected?

There are likely a considerable number of deployments that are still using the kibana_user role. It was the primary method of granting users access to Kibana prior to Spaces and the granular RBAC work. Additionally, the kibana_admin role was introduced mid-7.x.

What can users do to address the change manually?

Use Kibana's user management to change all users who are granted the kibana_user role to now use the kibana_admin role. Use Kibana's role-mapping management to change all role-mappings which assign the kibana_user role to now assign the kibana_admin role.

How could we make migration easier with the Upgrade Assistant?

If we could automatically migrate users and role-mappings to use kibana_admin instead of kibana_user, it'd eliminate this burden

Are there any edge cases?

No

Test Data

Provide test data. We can’t build a solution without data to test it against.

POST /_security/user/old_user
{
  "password" : "password",
  "roles" : [ "kibana_user" ],
  "full_name" : "Kibana User"
}

POST /_security/role_mapping/old_role_mapping
{
  "roles": [ "kibana_user"],
  "enabled": true, 
  "rules": {
    "field" : { "username" : "*" }
  }
}

Cross links

N/A

[elasticmachine]

Pinging @elastic/es-ui (Team:Elasticsearch UI)

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[alisonelizabeth]

I'm going to remove the Elasticsearch UI team label. This deprecation should be registered by the plugin owner via the core deprecations service (#94845). All registered deprecations will be displayed in the Upgrade Assistant (to be implemented via #97159). Feel free to reach out to myself or the core team with any questions!