Move kibana-keystore from data/ to config/

docs/migration/migrate_8_0.asciidoc

@@ -115,12 +115,17 @@ URL that it derived from the actual server address and `xpack.security.public` s
 
 *Impact:* Any workflow that involved manually clearing generated bundles will have to be updated with the new path.
 
+[float]]
+=== kibana.keystore has moved from the `data` folder to the `config` folder
+*Details:* By default, kibana.keystore has moved from the configured `path.data` folder to `<root>/config` for archive distributions
+and `/etc/kibana` for package distributions.
+
 [float]
 [[breaking_80_user_role_changes]]
 === User role changes
 
 [float]
-==== `kibana_user` role has been removed and `kibana_admin` has been added.
+=== `kibana_user` role has been removed and `kibana_admin` has been added.
 
 *Details:* The `kibana_user` role has been removed and `kibana_admin` has been added to better
 reflect its intended use. This role continues to grant all access to every

src/cli_keystore/cli_keystore.js

@@ -19,15 +19,14 @@
 
 import _ from 'lodash';
 import { join } from 'path';
+import { existsSync } from 'fs';
 
+import Logger from '../cli_plugin/lib/logger';
 import { pkg } from '../core/server/utils';
 import Command from '../cli/command';
-import { getDataPath } from '../core/server/path';
+import { getConfigDirectory, getDataPath } from '../core/server/path';
 import { Keystore } from '../legacy/server/keystore';
 
-const path = join(getDataPath(), 'kibana.keystore');
-const keystore = new Keystore(path);
-
 import { createCli } from './create';
 import { listCli } from './list';
 import { addCli } from './add';
@@ -42,6 +41,21 @@ program
   .version(pkg.version)
   .description('A tool for managing settings stored in the Kibana keystore');
 
+function getKeystore() {
+  const configKeystore = join(getConfigDirectory(), 'kibana.keystore');
+  const dataKeystore = join(getDataPath(), 'kibana.keystore');
+
+  if (existsSync(dataKeystore)) {
+    const logger = new Logger();
+    logger.log(
+      `kibana.keystore path at ${dataKeystore} is deprecated.  Future versions will read from ${configKeystore}.`
+    );
+  }
+  return [configKeystore, dataKeystore].filter((p) => existsSync(p)).shift();
+}
+
+const keystore = new Keystore(getKeystore());
+
 createCli(program, keystore);
 listCli(program, keystore);
 addCli(program, keystore);

src/core/server/path/index.test.ts

@@ -18,7 +18,7 @@
  */
 
 import { accessSync, constants } from 'fs';
-import { getConfigPath, getDataPath } from './';
+import { getConfigPath, getDataPath, getConfigDirectory } from './';
 
 describe('Default path finder', () => {
   it('should find a kibana.yml', () => {
@@ -30,4 +30,9 @@ describe('Default path finder', () => {
     const dataPath = getDataPath();
     expect(() => accessSync(dataPath, constants.R_OK)).not.toThrow();
   });
+
+  it('should find a config directory', () => {
+    const configDirectory = getConfigDirectory();
+    expect(() => accessSync(configDirectory, constants.R_OK)).not.toThrow();
+  });
 });

src/core/server/path/index.ts

@@ -30,6 +30,10 @@ const CONFIG_PATHS = [
   fromRoot('config/kibana.yml'),
 ].filter(isString);
 
+const CONFIG_DIRECTORIES = [process.env.KIBANA_PATH_CONF, fromRoot('config'), '/etc/kibana'].filter(
+  isString
+);
+
 const DATA_PATHS = [
   process.env.DATA_PATH, // deprecated
   fromRoot('data'),
@@ -49,12 +53,19 @@ function findFile(paths: string[]) {
 }
 
 /**
- * Get the path where the config files are stored
+ * Get the path of kibana.yml
  * @internal
  */
 export const getConfigPath = () => findFile(CONFIG_PATHS);
+
+/**
+ * Get the directory containing configuration files
+ * @internal
+ */
+export const getConfigDirectory = () => findFile(CONFIG_DIRECTORIES);
+
 /**
- * Get the path where the data can be stored
+ * Get the directory containing runtime data
  * @internal
  */
 export const getDataPath = () => findFile(DATA_PATHS);