fix(k0s): generate kubeflex postgres password at first boot instead of hardcoding it - #102
Merged
castrojo merged 1 commit intoSep 13, 2026
Conversation
…f hardcoding it The postgres StatefulSet seeded into every default Bluefin Server install hardcoded the superuser password as a plaintext env var (value: "kubeflex", the publicly documented kubeflex default) in 20-postgres.yaml. That manifest is auto-applied by the k0s deployer on every install, so the credential was committed to git in plaintext and readable from any pod spec in kubeflex-system. - Read the password from the kubeflex-postgres Secret via secretKeyRef. - Generate that Secret once at first boot with a random password (generate-postgres-secret.sh, run by k0s-first-boot.service before k0s applies manifests; its 15- name sorts before 20-postgres.yaml). The generator is idempotent so the initialized database stays accessible across re-boots. Nothing sensitive is committed to git. - Stage the helper in the k0s sysext and cover the new behavior in tests. Signed-off-by: kylerankin <kylerankin@users.noreply.github.com>
castrojo
approved these changes
Sep 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #98
The postgres StatefulSet seeded into every default Bluefin Server install
hardcoded the PostgreSQL superuser password as a plaintext env var
(
value: "kubeflex", the publicly documented kubeflex default) infiles/k0s/manifests/kubestellar/20-postgres.yaml. That manifest isauto-applied by the k0s manifest deployer on every install, so the credential
was committed to git in plaintext and readable from any pod spec in
kubeflex-system.Changes:
kubeflex-postgres) viavalueFrom.secretKeyRefinstead of a plaintext env value.files/k0s/kubeflex/generate-postgres-secret.shruns fromk0s-first-boot.serviceafter the manifests dir is seeded and before k0sapplies manifests (its
15-name sorts before20-postgres.yaml, so theSecret exists first). The generator is idempotent, so the initialized
database stays accessible across re-boots. Nothing sensitive is committed to
git.
elements/oci/k0s-sysext.bst).tests/unit/test_k0s_manifests.py.This follows the same remediation shape recommended for #72 (move credentials
into a Secret referenced via secretKeyRef) and keeps the default install
working out of the box. Existing clusters should still rotate the postgres
password per recommendation #3 in the issue.
— hive: backend=pi model=lemonade/Ornith-1.5-35B-A3B-GGUF-Q6_K
🐝 Hive Agent:
contributor| SHA:dbf5d8e