Merge branch '8.6' into backport/8.6/pr-140665

docs/developer/best-practices/index.asciidoc

@@ -22,7 +22,7 @@ Are you planning with scalability in mind?
 
 Did you know {kib} makes a public statement about our commitment to
 creating an accessible product for people with disabilities?
-https://www.elastic.co/guide/en/kibana/master/accessibility.html[We do]!
+<<accessibility,We do>>!
 It’s very important all of our apps are accessible.
 
 * Learn how https://elastic.github.io/eui/#/guidelines/accessibility[EUI

docs/maps/asset-tracking-tutorial.asciidoc

@@ -8,7 +8,7 @@ In this tutorial, you’ll look at live urban transit data from the city of Port
 
 You’ll learn to:
 
-- Use {filebeat} to ingest the TriMet REST API into Elasticsearch.
+- Use {agent} to ingest the TriMet REST API into {es}.
 - Create a map with layers that visualize asset tracks and last-known locations.
 - Use symbols and colors to style data values and show which direction an asset is heading.
 - Set up tracking containment alerts to monitor moving vehicles.
@@ -23,11 +23,11 @@ image::maps/images/asset-tracking-tutorial/construction_zones.png[]
 
 - If you don’t already have {kib}, set it up with https://www.elastic.co/cloud/elasticsearch-service/signup?baymax=docs-body&elektra=docs[our free trial]. Download the deployment credentials.
 - Obtain an API key for https://developer.trimet.org/[TriMet web services] at https://developer.trimet.org/appid/registration/.
-- https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html[Install Filebeat].
+- {fleet-guide}/fleet-overview.html[Fleet] is enabled on your cluster, and one or more {fleet-guide}/elastic-agent-installation.html[{agent}s] is enrolled.
 
 [float]
 === Part 1: Ingest the Portland bus data
-To get to the fun of visualizing and alerting on Portland buses, you must first create a {filebeat} input to ingest the TriMet Portland bus data into {es}.
+To get to the fun of visualizing and alerting on Portland buses, you must first add the *Custom API* integration to an Elastic Agent policy to get the TriMet Portland bus data into {es}.
 
 [float]
 ==== Step 1: Set up an Elasticsearch index
@@ -270,47 +270,39 @@ PUT _ingest/pipeline/tri_met_tracks
 ----------------------------------
 
 [float]
-==== Step 2: Start {filebeat}
+==== Step 2: Configure {agent}
 
-. Replace the contents in your `filebeat.yml` file with the following:
-+
-[source,yaml]
-----------------------------------
-filebeat.inputs:
-# Fetch trimet bus data every minute.
-- type: httpjson
-  interval: 1m
-  request.url: "https://developer.trimet.org/ws/v2/vehicles?appID=<tri_met_app_id>"
-  response.split:
-    target: body.resultSet.vehicle
-  processors:
-    - decode_json_fields:
-        fields: ["message"]
-        target: "trimet"
+. From the {kib} main menu, click *Fleet*, then the *Agent policies* tab.
 
-  pipeline: "tri_met_tracks"
+. Click the name of the agent policy where you want to add the *Custom API* integration. The configuration changes you make only apply to the policy you select.
 
+. Click the name of the *Custom API* integration, or add the integration if the agent policy does not yet have it.
 
-# ---------------------------- Elastic Cloud Output ----------------------------
-cloud.id: <cloud_id>
-cloud.auth: <username:password>
+. From the *Edit Custom API integration* page, expand the *Change defaults* section.
 
-----------------------------------
+. Set the *Dataset name* to *httpjson.trimet*.
+
+. Set the *Ingest Pipeline* to *tri_met_pipeline*.
 
-. Replace `<tri_met_app_id>` with your TriMet application id.
-. Replace `<username:password>` with your Elastic Cloud deployment credentials.
-. Replace `<cloud_id>` with your {ece}/ece-cloud-id.html[elastic cloud id].
-. Open a terminal window, and then navigate to the {filebeat} folder.
-. In your `filebeat` folder, run {filebeat} with the edited config:
+. Set the *Request URL* to *https://developer.trimet.org/ws/v2/vehicles?appID=<tri_met_app_id>*.
+
+. Set *Response Split* to *target: body.resultSet.vehicle*.
+
+. At the bottom of the configuration, expand *Advanced options*.
+
+. Set *Processors* to:
 +
-[source,bash]
+[source,yaml]
 ----------------------------------
-/bin/filebeat -c filebeat.yml
+- decode_json_fields:
+    fields: ["message"]
+    target: "trimet"
 ----------------------------------
 
-. Wait for {filebeat} to start shipping data to Elastic Cloud. {filebeat} should not produce any output to stdout. 
+. Leave everything else as defaults.
+
+. Click *Save integration* to deploy the configuration to any {agent} with the policy assigned.
 
-. Leave the terminal window open and {filebeat} running throughout this tutorial.
 
 [float]
 ==== Step 3: Create a data view for the tri_met_tracks {es} index

docs/setup/connect-to-elasticsearch.asciidoc

@@ -13,7 +13,7 @@ All integrations are available in a single view, and
 image::images/add-integration.png[Integrations page from which you can choose integrations to start collecting and analyzing data]
 
 NOTE: When an integration is available for both
-https://www.elastic.co/guide/en/fleet/master/beats-agent-comparison.html[Elastic Agent and Beats],
+{fleet-guide}/beats-agent-comparison.html[Elastic Agent and Beats],
 the *Integrations* view defaults to the
 Elastic Agent integration, if it is generally available (GA).
 To show a

packages/core/http/core-http-resources-server-internal/src/http_resources_service.test.ts

@@ -57,6 +57,7 @@ describe('HttpResources service', () => {
       describe(`${name} register`, () => {
         const routeConfig: RouteConfig<any, any, any, 'get'> = { path: '/', validate: false };
         let register: HttpResources['register'];
+
         beforeEach(async () => {
           register = await initializer();
         });
@@ -81,32 +82,8 @@ describe('HttpResources service', () => {
               }
             );
           });
-
-          it('can attach headers, except the CSP header', async () => {
-            register(routeConfig, async (ctx, req, res) => {
-              return res.renderCoreApp({
-                headers: {
-                  'content-security-policy': "script-src 'unsafe-eval'",
-                  'x-kibana': '42',
-                },
-              });
-            });
-
-            const [[, routeHandler]] = router.get.mock.calls;
-
-            const responseFactory = createHttpResourcesResponseFactory();
-            await routeHandler(context, kibanaRequest, responseFactory);
-
-            expect(responseFactory.ok).toHaveBeenCalledWith({
-              body: '<body />',
-              headers: {
-                'x-kibana': '42',
-                'content-security-policy':
-                  "script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'",
-              },
-            });
-          });
         });
+
         describe('renderAnonymousCoreApp', () => {
           it('formats successful response', async () => {
             register(routeConfig, async (ctx, req, res) => {
@@ -127,32 +104,8 @@ describe('HttpResources service', () => {
               }
             );
           });
-
-          it('can attach headers, except the CSP header', async () => {
-            register(routeConfig, async (ctx, req, res) => {
-              return res.renderAnonymousCoreApp({
-                headers: {
-                  'content-security-policy': "script-src 'unsafe-eval'",
-                  'x-kibana': '42',
-                },
-              });
-            });
-
-            const [[, routeHandler]] = router.get.mock.calls;
-
-            const responseFactory = createHttpResourcesResponseFactory();
-            await routeHandler(context, kibanaRequest, responseFactory);
-
-            expect(responseFactory.ok).toHaveBeenCalledWith({
-              body: '<body />',
-              headers: {
-                'x-kibana': '42',
-                'content-security-policy':
-                  "script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'",
-              },
-            });
-          });
         });
+
         describe('renderHtml', () => {
           it('formats successful response', async () => {
             const htmlBody = '<html><body /></html>';
@@ -167,20 +120,17 @@ describe('HttpResources service', () => {
               body: htmlBody,
               headers: {
                 'content-type': 'text/html',
-                'content-security-policy':
-                  "script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'",
               },
             });
           });
 
-          it('can attach headers, except the CSP & "content-type" headers', async () => {
+          it('can attach headers, except the "content-type" header', async () => {
             const htmlBody = '<html><body /></html>';
             register(routeConfig, async (ctx, req, res) => {
               return res.renderHtml({
                 body: htmlBody,
                 headers: {
                   'content-type': 'text/html5',
-                  'content-security-policy': "script-src 'unsafe-eval'",
                   'x-kibana': '42',
                 },
               });
@@ -196,12 +146,11 @@ describe('HttpResources service', () => {
               headers: {
                 'content-type': 'text/html',
                 'x-kibana': '42',
-                'content-security-policy':
-                  "script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'",
               },
             });
           });
         });
+
         describe('renderJs', () => {
           it('formats successful response', async () => {
             const jsBody = 'alert(1);';
@@ -216,20 +165,17 @@ describe('HttpResources service', () => {
               body: jsBody,
               headers: {
                 'content-type': 'text/javascript',
-                'content-security-policy':
-                  "script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'",
               },
             });
           });
 
-          it('can attach headers, except the CSP & "content-type" headers', async () => {
+          it('can attach headers, except the "content-type" header', async () => {
             const jsBody = 'alert(1);';
             register(routeConfig, async (ctx, req, res) => {
               return res.renderJs({
                 body: jsBody,
                 headers: {
                   'content-type': 'text/html',
-                  'content-security-policy': "script-src 'unsafe-eval'",
                   'x-kibana': '42',
                 },
               });
@@ -245,12 +191,11 @@ describe('HttpResources service', () => {
               headers: {
                 'content-type': 'text/javascript',
                 'x-kibana': '42',
-                'content-security-policy':
-                  "script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'",
               },
             });
           });
         });
+
         describe('renderCss', () => {
           it('formats successful response', async () => {
             const cssBody = `body {border: 1px solid red;}`;
@@ -265,20 +210,17 @@ describe('HttpResources service', () => {
               body: cssBody,
               headers: {
                 'content-type': 'text/css',
-                'content-security-policy':
-                  "script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'",
               },
             });
           });
 
-          it('can attach headers, except the CSP & "content-type" headers', async () => {
+          it('can attach headers, except the "content-type" header', async () => {
             const cssBody = `body {border: 1px solid red;}`;
             register(routeConfig, async (ctx, req, res) => {
               return res.renderCss({
                 body: cssBody,
                 headers: {
                   'content-type': 'text/css5',
-                  'content-security-policy': "script-src 'unsafe-eval'",
                   'x-kibana': '42',
                 },
               });
@@ -294,8 +236,6 @@ describe('HttpResources service', () => {
               headers: {
                 'content-type': 'text/css',
                 'x-kibana': '42',
-                'content-security-policy':
-                  "script-src 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'",
               },
             });
           });

packages/core/http/core-http-resources-server-internal/src/http_resources_service.ts

@@ -101,7 +101,6 @@ export class HttpResourcesService implements CoreService<InternalHttpResourcesSe
     request: KibanaRequest,
     response: KibanaResponseFactory
   ): HttpResourcesServiceToolkit {
-    const cspHeader = deps.http.csp.header;
     return {
       async renderCoreApp(options: HttpResourcesRenderOptions = {}) {
         const apmConfig = getApmConfig(request.url.pathname);
@@ -116,7 +115,7 @@ export class HttpResourcesService implements CoreService<InternalHttpResourcesSe
 
         return response.ok({
           body,
-          headers: { ...options.headers, 'content-security-policy': cspHeader },
+          headers: options.headers,
         });
       },
       async renderAnonymousCoreApp(options: HttpResourcesRenderOptions = {}) {
@@ -132,7 +131,7 @@ export class HttpResourcesService implements CoreService<InternalHttpResourcesSe
 
         return response.ok({
           body,
-          headers: { ...options.headers, 'content-security-policy': cspHeader },
+          headers: options.headers,
         });
       },
       renderHtml(options: HttpResourcesResponseOptions) {
@@ -141,7 +140,6 @@ export class HttpResourcesService implements CoreService<InternalHttpResourcesSe
           headers: {
             ...options.headers,
             'content-type': 'text/html',
-            'content-security-policy': cspHeader,
           },
         });
       },
@@ -151,7 +149,6 @@ export class HttpResourcesService implements CoreService<InternalHttpResourcesSe
           headers: {
             ...options.headers,
             'content-type': 'text/javascript',
-            'content-security-policy': cspHeader,
           },
         });
       },
@@ -161,7 +158,6 @@ export class HttpResourcesService implements CoreService<InternalHttpResourcesSe
           headers: {
             ...options.headers,
             'content-type': 'text/css',
-            'content-security-policy': cspHeader,
           },
         });
       },

packages/core/http/core-http-server-internal/src/http_service.ts

@@ -102,6 +102,8 @@ export class HttpService
       },
     });
 
+    registerCoreHandlers(prebootSetup, config, this.env);
+
     if (this.shouldListen(config)) {
       this.log.debug('starting preboot server');
       await this.prebootServer.start();