Suggestion to create service account tokens using CLI is wrong

[jportner]

Related: #115241, #122704

In 7.17, the Upgrade Assistant shows a deprecation warning for Kibana instances that have elasticsearch.username: elastic or elasticsearch.username: kibana configured.

Authenticating Kibana to Elasticsearch with either of these users is deprecated and should be avoided.

Note that using elasticsearch.username: kibana_system is still supported / not deprecated, but we want to start nudging users towards using service account tokens instead.
To that end, these deprecation warnings suggest using elasticsearch.serviceAccountToken instead:

kibana/src/core/server/elasticsearch/elasticsearch_config.ts

Lines 148 to 180 in 9ffffbc

	if (es.username === 'elastic' || es.username === 'kibana') {
	const username = es.username;
	const level = es.username === 'elastic' ? 'critical' : 'warning';
	addDeprecation({
	configPath: `${fromPath}.username`,
	title: i18n.translate('core.deprecations.elasticsearchUsername.title', {
	defaultMessage: 'Using "elasticsearch.username: {username}" is deprecated',
	values: { username },
	}),
	message: i18n.translate('core.deprecations.elasticsearchUsername.message', {
	defaultMessage:
	'Kibana is configured to authenticate to Elasticsearch with the "{username}" user. Use a service account token instead.',
	values: { username },
	}),
	level,
	documentationUrl: `https://www.elastic.co/guide/en/elasticsearch/reference/${branch}/service-accounts.html`,
	correctiveActions: {
	manualSteps: [
	i18n.translate('core.deprecations.elasticsearchUsername.manualSteps1', {
	defaultMessage:
	'Use the elasticsearch-service-tokens CLI tool to create a new service account token for the "elastic/kibana" service account.',
	}),
	i18n.translate('core.deprecations.elasticsearchUsername.manualSteps2', {
	defaultMessage: 'Add the "elasticsearch.serviceAccountToken" setting to kibana.yml.',
	}),
	i18n.translate('core.deprecations.elasticsearchUsername.manualSteps3', {
	defaultMessage:
	'Remove "elasticsearch.username" and "elasticsearch.password" from kibana.yml.',
	}),
	],
	},
	});
	}

We should change the warning to suggest using creating a service account token with the API instead.

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)