SONAR-13974 Add upgrade notes for new ES configuration

server/sonar-docs/src/pages/setup/operate-cluster.md

@@ -90,22 +90,27 @@ When the [Project Move](/instance-administration/project-move/) feature is used
 * The archive of the exported projects must be copied to all the applications nodes in the target server
 
 ## Configuration details
-Start with the [default configuration](/setup/install-cluster/); it's good in most cases. The details below are only needed in specific cases.
+There are three TCP networks to configure: 
+>>>>>>> c612aa18893... SONAR-13974 Add upgrade notes for new ES configuration
 
-[Hazelcast](https://hazelcast.org/) is used to manage the communication between the nodes of the cluster. You don't need to install it yourself, it's provided out of the box.
+- the network of application nodes: relying on Hazelcast, configured with the `sonar.cluster.node.host` and `sonar.cluster.node.port` properties
+- the network of search nodes: used by Elasticsearch, configured with the `sonar.cluster.node.search.host` and `sonar.cluster.node.search.port` properties
+- the network between application nodes and search nodes, configured with the `sonar.cluster.node.es.host` and `sonar.cluster.node.es.port` properties
+
+[Hazelcast](https://hazelcast.org/) is used to manage the communication between the cluster's application nodes. You don't need to install it yourself, it's provided out of the box.
 
 The following properties may be defined in the _$SONARQUBE-HOME/conf/sonar.properties_ file of each node in a cluster. When defining a property that contains a list of hosts (`*.hosts`) the port is not required if the default port was not overridden in the configuration.
 
+[[warning]]
+| Ports can be unintentionally exposed. We recommend only giving external access to the application nodes and to main port (`sonar.web.port`).
+
 ### All nodes
 Property | Description | Default | Required | 
 ---|---|---|---|
 `sonar.cluster.enabled`|Set to `true` in each node to activate the cluster mode|`false`|yes
 `sonar.cluster.name`|The name of the cluster. **Required if multiple clusters are present on the same network.** For example this prevents mixing Production and Preproduction clusters. This will be the name stored in the Hazelcast cluster and used as the name of the Elasticsearch cluster.|`sonarqube`|no
-`sonar.cluster.search.hosts`|Comma-delimited list of search hosts in the cluster. Each item in the list must contain the host and port. For search nodes, the item format is `sonar.search.host:sonar.search.transportPort`. For application nodes, the item format is `sonar.search.host:sonar.search.port`.| |yes
 `sonar.cluster.node.name`|The name of the node that is used on Elasticsearch and stored in Hazelcast member attribute (NODE_NAME) for sonar-application|`sonarqube-{UUID}`|no
 `sonar.cluster.node.type`|Type of node: either `application` or `search`| |yes
-`sonar.cluster.node.host`|IP address of the network card that will be used by Hazelcast to communicate with the members of the cluster. Must not be a loopback address.| |yes
-
 
 ### Application nodes
 Property  | Description | Required 
@@ -120,9 +125,11 @@ onar.cluster.node.host:sonar.cluster.node.port`.|yes
 ### Search nodes
 Property  | Description | Default | Required 
 ---|---|---|---
-`sonar.search.host`|Listening IP. IP must be accessible to all other search and application nodes.|`127.0.0.1`|yes
-`sonar.search.port`|Listening port. Port must be accessible to all application nodes. This port is used for HTTP communication between search and application nodes|`9001`|yes
-`sonar.search.transportPort`|Listening port. Port must be accessible to all other search nodes. This port is used for TCP communication between search nodes.|`9002`|yes
+`sonar.cluster.node.search.host`|Listening IP. IP must be accessible to all application nodes.|`127.0.0.1`|yes
+`sonar.cluster.node.search.port`|Listening port. Port must be accessible to all application nodes. This port is used for HTTP communication between search and application nodes|`9001`|yes
+`sonar.cluster.es.hosts`|Comma-delimited list of search hosts in the cluster. The list can contain either the host or the host and port but not both. The item format is `sonar.cluster.node.es.host` for host only or`sonar.cluster.node.es.host:sonar.cluster.node.es.port` for host and port.| |yes
+`sonar.cluster.node.es.host`|Elasticsearch host of the current node used by Elasticsearch internal communication to form a cluster (TCP transport).|localhost|yes
+`sonar.cluster.node.es.port`|Elasticsearch port of the current node used by Elasticsearch internal communication to form a cluster (TCP transport). Port must be accessible to all other search nodes|9002| yes
 `sonar.search.initialStateTimeout`|The timeout for the Elasticsearch nodes to elect a master node. The default value will be fine in most cases, but in a situation where startup is failing because of a timeout, this may need to be adjusted. The value must be set in the format: `{integer}{timeunit}`. Valid `{timeunit}` values are: `ms` (milliseconds); `s` (seconds); `m` (minutes); `h` (hours); `d` (days); `w` (weeks)|cluster: 120s; standalone: 30s|no
 
 ## Limitations
@@ -131,11 +138,13 @@ Property  | Description | Default | Required
 * Plugins are not shared, meaning if you install/uninstall/upgrade a given plugin on one application node, you need to perform the same actions on the other application node.
 * There is no way to perform actions on the cluster from a central app - all operations must be done manually on each node of the cluster.
 
-
 ## Frequently Asked Questions
+
 ### Does Elasticsearch discover automatically other ES nodes? 
 No. Multicast is disabled. All hosts (IP+port) must be listed.
+
 ### Can different nodes run on the same machine? 
 Yes, but it's best to have one machine for each node to be resilient to failures. To maintain an even higher level of availability, each of your three search nodes can be located in a separate availability zone *within the same region*.
+
 ### Can the members of a cluster be discovered automatically? 
 No, all nodes must be configured in _$SONARQUBE-HOME/conf/sonar.properties_

server/sonar-docs/src/pages/setup/operate-server.md

@@ -124,6 +124,8 @@ sudo service sonar start
 
 This section helps you configure the SonarQube Server if you want to run it behind a proxy. This can be done for security concerns or to consolidate multiple disparate applications. To run the SonarQube server over HTTPS, see the HTTPS Configuration section below.
 
+[[warning]]
+|For security reasons, we recommend only giving external access to the main port.
 
 ### Using an Apache Proxy