Repository navigation
fix: generate trustee runner passwords and disable api-user (ovcs) - #3930
Open
xalsina-sequent wants to merge 3 commits into
Open
xalsina-sequent wants to merge 3 commits into
xalsina-sequent wants to merge 3 commits into
Conversation
Parent issue: sequentech/meta#13842 Follow-up to #3566. The realm template no longer carries passwords, and operators set each trustee's password at its first login. The deployment files still shipped `TRUSTEE1_PASSWORD=trustee1` (and trustee2, trustee3) for the unattended runners, which leads an operator to set password = username, the pattern meta#13842 removes. - Remote deployment: `configure-environment.sh` generates `TRUSTEE1_PASSWORD` and `TRUSTEE2_PASSWORD`; the example leaves them empty. - Air-gap bundle: `.env` ships `generate-on-first-up` placeholders, and `up` generates `TRUSTEE1_PASSWORD`..`TRUSTEE3_PASSWORD` once, as it already does for `MESSAGING_RELAY_SECRET`. - Realm template: `api-user` is disabled. It is in the admin group, has no credentials and nothing signs in with it, so a password set on it later would give a working administrator account. A Windmill test next to the template's no-credentials test keeps it disabled. - Docs: the runner's `TRUSTEE_PASSWORD` is the password to set on the trustee account; `api-user` is disabled. The committed sequent-core WASM package is rebuilt because the template is one of its recorded inputs (`step-dev wasm --check-package` passes). Validation: `scripts.test_tenant_bootstrap_configuration` and `scripts.dev.test_airgap_bundle` pass on Linux (the air-gap `up` uses GNU sed), including new tests for the generated passwords; sequent-core `keycloak::realm` and `permissions` tests pass. The Windmill test file is identical to the release backports, where the focused `realm_user_credentials` and `tenant_bootstrap_admin` tests pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review: 2
Please check the settings in the CodeRabbit UI or the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
Conflicts were only in the generated sequent-core packages and yarn.lock; rebuilt the package from the merged sources. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Conflicts were only in the generated sequent-core packages and yarn.lock; rebuilt the package from the merged sources. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Parent issue: https://github.com/sequentech/meta/issues/13842
Follow-up to #3566, from the review of its 9.0/10.0/10.1 backports (#3563, #3562, #3565).
Trustee runner passwords. Operators set each trustee's Keycloak password at its first login, and the unattended runner signs in with
TRUSTEE_PASSWORD. The deployment files shippedTRUSTEE1_PASSWORD=trustee1(and trustee2 and trustee3), which leads an operator to set password = username, the pattern meta#13842 removes.configure-environment.shgeneratesTRUSTEE1_PASSWORDandTRUSTEE2_PASSWORD, and the example file leaves them empty..envshipsgenerate-on-first-up, andupgeneratesTRUSTEE1_PASSWORDtoTRUSTEE3_PASSWORDonce, the same way it handlesMESSAGING_RELAY_SECRET.api-userdisabled in the template. It is in the admin group, has no credentials, and nothing signs in with it, so a password set on it later would give a working administrator account. A Windmill test next to the template's no-credentials test keeps it disabled.Docs:
developers_keycloak.mdandtrustee-configuration.mdupdated.The committed sequent-core WASM package is rebuilt because the template is one of its recorded inputs.
Validation
scripts.test_tenant_bootstrap_configurationandscripts.dev.test_airgap_bundlepass on Linux, including new tests for the generated passwords. The air-gapupuses GNUsed -i, so the existing relay-secret test also fails on macOS.keycloak::realmandpermissionstests pass.step-dev wasm --check-packagepasses.realm_user_credentialsandtenant_bootstrap_admintests pass.Not in this PR: gitops
ensure_keycloak_trustee_usersstill createstrustee4+ with password = username (part of meta#13842's fix).🤖 Generated with Claude Code