Upgrade Guide - Incorrect upgrade path

Start by tracing the upgrade-guide path for a 5.0–5.5 cluster with no Cloud, X-Pack Security enabled, no TLS, and no 2.x indices. Compare its 6.3 output with the documented “jump straight to 6.3” full-cluster-restart path; done means the generated steps include TLS and the required restart rather than incorrectly routing through 5.6.

to reproduce:

• First off, we need some information about your stack.
  • 5.0-5.5
  • no Cloud
• Do you use X-Pack?
  • yes
• Which X-Pack features do you use?
  • Security
• Transport Layer Security (TLS) is required as of 6.0
  • no
• Do you have any indices that were created in 2.x?
  • no
• Upgrading from 5.x to 6.3
  • Upgrade to 5.6 first

Which returns:

Here you go!
These are the steps you need to take to upgrade to 6.3.
Upgrade to 5.6
Back up your data.
Use the Elasticsearch Migration plugin to check for upgrade issues.
Address any 5.x breaking changes that affect your applications:
Elasticsearch breaking changes
Upgrade one node at a time to Elasticsearch 5.6.
Install Elasticsearch 5.6.
Install X-Pack.
Restart the node.

Prepare to upgrade to 6.3
Back up your data.
Address any 6.0 breaking changes that affect your applications:
Elasticsearch breaking changes
If you're using the default changeme password, change your password.
Check the Elasticsearch deprecation log.
Upgrade to 6.3
Upgrade Elasticsearch to 6.3.
You can perform a rolling upgrade to Elasticsearch 6.3.
Remove the X-Pack plugin before restarting Elasticsearch.
Run bin/elasticsearch-plugin remove x-pack.

However, 6.x requires TLS
The path is therefore missing to enable TLS and the full cluster restart that comes with it.

Instead of the above, the upgrade to 6.x should follow the following path (taken from selecting "jump straing to 6.3" in the last question). In fact, going to 5.6 does not bring any benefits in this case and we should consider removing that question when TLS is not enabled. 5.6 is only required if you plan to roll to 6.x, which is not possible in this case:

Perform a Full Cluster Restart Upgrade to 6.3
Stop sending data to your cluster.
Shut down your cluster and install Elasticsearch 6.3 on all nodes.
Remove the X-Pack plugin before restarting Elasticsearch.
Run bin/elasticsearch-plugin remove x-pack.
Enable Transport Layer Security (TLS) to secure cluster communications.
TLS is required as of 6.0 to prevent unidentified nodes from joining a cluster and encrypt inter-node communications.
Restart your Elasticsearch cluster.
Create a temporary super user and upgrade the internal .security index.
Delete the temporary super user.