Docs: Update documentation for managing API keys to authorize requests to the APM Server

[gbamparop]

Agent API key management support has been added as part of elastic/kibana#77966 and the work has been done in elastic/kibana#119543 and elastic/kibana#120373.

API keys documentation in the APM server could be updated to reflect these changes.

A how to guide could also be added in the Kibana APM docs.

The management view is located in Kibana (APM -> Settings -> Agent Keys) and users can check the privileges they want to assign to the API key being created instead of pasting them in JSON into the role descriptors box like they do in the stack management.

Screen.Recording.2021-12-07.at.15.56.35.mov

Please also find some screenshots below that you might find useful:

[gbamparop]

@bmorelli25 could you please have a look at this?

[simitt]

Updated and now available in https://www.elastic.co/guide/en/apm/guide/current/api-key.html#create-an-api-key.

[gbamparop]

Updated and now available in https://www.elastic.co/guide/en/apm/guide/current/api-key.html#create-an-api-key.

@simitt the docs in this link seem to suggest to create an API key through Stack Management > API keys instead of APM settings -> Agent Keys mentioned in the description.

[bmorelli25]

Repeating what I posted on Slack:

@elastic/apm-server I'm confused about the sourcemap:write privilege. Is this privilege still required for anything? As far as I can tell, the /assets/v1/sourcemaps endpoint was removed in #6447.

I tried spinning up an 8.2 standalone APM Server and when I hit http://127.0.0.1:8200/assets/v1/sourcemaps, I get:

{
  "error": "404 page not found"
}

Maybe the backward compatibility with the apm-server/elasticsearch connection (apm-server.rum.source_mapping.elasticsearch.*) requires this privilege? I'm not sure how to test that one.

[axw]

@bmorelli25 you're quite right, there is no longer any code path in apm-server that checks this privilege. It would only make sense when using an older version of apm-server, e.g. 7.17.x.

[bmorelli25]

Thanks, @axw.

@gbamparop should I create an APM UI issue? I guess we should remove the sourcemap:write privilege from the flyout. Alternatively, we could name it something different and update the privileges to those required for Kibana's RUM source map API:

{
   "apm": {
      "applications": [
         {
            "application":"kibana-.kibana",
            "privileges":[ "feature_apm.all" ],
            "resources":[ "space:default" ]
         }
      ]
   }
}

[gbamparop]

@gbamparop should I create an APM UI issue? I guess we should remove the sourcemap:write privilege from the flyout. Alternatively, we could name it something different and update the privileges to those required for Kibana's RUM source map API:

@bmorelli25 please do, that would be great so we can have a look what the best approach should be.