Configure Azure snapshot repository via APIs

[sherry-ger]

Currently, the snapshot and restore settings are stored in the elasticsearch.yml If the azure user password expired, to update it in the elasticsearch.yml file would require a cluster restart to take effect. Given how often a password can expire, this is not a desirable behavior. Also, sometimes there is not any access to settings in the yml file on the machines running the elasticsearch nodes. For example, when using the DC/OS elastic package.

[hanoch]

👍

[hanoch]

to make sure we are on the same page, we are requesting to have all the snapshot and restore settings that are currently only configurable by editing the elasticsearch.yml file, be configurable via the APIs, both REST (http) API and Transport (java) API, including account, key, etc. :
https://www.elastic.co/guide/en/elasticsearch/plugins/current/repository-azure-usage.html

The reason for that is that in some systems (e.g. DC/OS using the mesosphere elastic package) we don't have access to set or modify settings on the elasticsearch.yml file, node system variables, node enviremenmt vatriables, or even add/adjust the parameters that elasticsearch is run with.
This is why we need the ability to specify all settings like Azure accout, key, etc, when we reference/create a repository, for example with the preparePutRepository Java API function.

[tlrx]

In the recent versions of Elasticsearch, we don't allow any secret to be specified using the REST API, Java API or directly in the elasticsearch configuration file. Instead, any secret must be defined in the Elasticsearch Keystore (see documentation) as a secured setting.

For now these settings are not reloadable but there is an ongoing effort (#29135) to make them reloadable. This way, the Azure/S3/GCS settings will be updatable in the keystore specified at the elasticsearch startup.

So I'm going to close this issue as we won't allow to specify credentials using the Rest API in the future. Please feel free to add a comment.