Setting to whitelist allowed licenses

[bytebilly]

Description

We want to introduce a new Elasticsearch setting to define which are the licenses that can be used in a specific cluster.

The main goal is to allow external coordinators (like ECK or ECE) to control which license can be installed on clusters that are centrally managed, and to avoid that inconsistent licenses are manually installed using direct access to the cluster.

Proposal

Introduce the new setting and perform the check on the license type when a new license is sent via Update license API.

The setting name is xpack.license.upload.types.

The value is a list of possible license types.
The supported use case is what is needed by Cloud, so trial,enterprise

The default value for this setting (if not set) is to allow any license to be used.

Questions

1. Is it defined in elasticsearch.yml? — YES
2. Can it be updated via setting via API? — NO
3. Will the check happen also on bootstrap? — NO

[elasticmachine]

Pinging @elastic/es-security (:Security/License)

[bytebilly]

@tvernum I left a few technical questions in the first comment, and I'd like to hear from you which could be a possible approach.

Given our previous discussions and priorities, we should try to add this feature in 7.6 if possible.

[tvernum]

Is it defined in elasticsearch.yml?

Yes

Can it be updated via setting via API?

No, that would defeat the purpose. The reason we want the setting is so that the orchestrator can control the license management by controlling the YML. If it's configurable via API then it is easy to by-pass the orchestrator.

Will the check happen also on bootstrap

No, we don't plant to do this. It is to easy to leave a cluster is a broken state.

[bytebilly]

Thanks, description updated with these answers.