Skip to content

Commit b1f1503

Browse files
mevan-karumevan-karu
committed
fix: use random secrets instead of default values for thunder secrets
Signed-off-by: Mevan <mevan.karu@gmail.com>
1 parent 7bfc100 commit b1f1503

6 files changed

Lines changed: 81 additions & 34 deletions

File tree

‎docs/_constants.mdx‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,5 +9,4 @@ export const versions = {
99

1010
export const defaultCredentials = {
1111
username: "admin@openchoreo.dev",
12-
password: "Admin@123",
1312
};

‎docs/ai/mcp-servers.mdx‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -144,12 +144,21 @@ On first use, a browser window opens for authentication. Log in with the default
144144

145145
Client credentials authentication uses the `service_mcp_client` OAuth application (confidential client, client_credentials grant), which is pre-created in the default ThunderID IdP. This method works with any AI agent that supports custom HTTP headers.
146146

147-
**Step 1: Obtain an Access Token**
147+
**Step 1: Retrieve the MCP Client Secret**
148+
149+
The `service_mcp_client` secret was randomly generated during installation. Retrieve it:
150+
151+
```bash
152+
SERVICE_MCP_CLIENT_SECRET=$(kubectl get secret openchoreo-initial-credentials \
153+
-n thunder -o jsonpath='{.data.service-mcp-client-secret}' | openssl base64 -d -A; echo)
154+
```
155+
156+
**Step 2: Obtain an Access Token**
148157

149158
```bash
150159
curl -s -X POST "http://thunder.openchoreo.localhost:8080/oauth2/token" \
151160
-H 'Content-Type: application/x-www-form-urlencoded' \
152-
-u 'service_mcp_client:service_mcp_client_secret' \
161+
-u "service_mcp_client:${SERVICE_MCP_CLIENT_SECRET}" \
153162
-d 'grant_type=client_credentials'
154163
```
155164

‎docs/getting-started/quick-start-guide.mdx‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,15 @@ The setup uses a preconfigured Dev Container that includes all required dependen
133133

134134
Default login credentials:
135135
- Username: <code>{defaultCredentials.username}</code>
136-
- Password: <code>{defaultCredentials.password}</code>
136+
- Password: Randomly generated during installation. Retrieve it with:
137+
138+
```bash
139+
kubectl get secret openchoreo-initial-credentials -n thunder -o jsonpath='{.data.admin-password}' | openssl base64 -d -A; echo
140+
```
141+
142+
:::tip
143+
After logging in, change your password or delete the `openchoreo-initial-credentials` secret.
144+
:::
137145

138146
<img
139147
src={require('./qsg-backstage-ui.png').default}

‎docs/getting-started/try-it-out/on-k3d-locally.mdx‎

Lines changed: 24 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -164,17 +164,15 @@ OpenChoreo uses [External Secrets Operator](https://external-secrets.io/) to man
164164
--wait --timeout 300s`}
165165
</CodeBlock>
166166

167-
The values file runs a postStart script that configures Kubernetes auth, creates reader/writer policies, and seeds the following secrets into the store:
168-
169-
| Secret | Value | Used By |
170-
| ------------------------------ | ------------------------------ | ------------------------------ |
171-
| `backstage-backend-secret` | `local-dev-backend-secret` | Backstage session signing |
172-
| `backstage-client-secret` | `backstage-portal-secret` | Backstage OAuth with ThunderID |
173-
| `backstage-jenkins-api-key` | `placeholder-not-in-use` | Placeholder |
174-
| `observer-oauth-client-secret` | `openchoreo-observer-secret` | Observer OAuth with ThunderID |
175-
| `rca-oauth-client-secret` | `openchoreo-rca-agent-secret` | SRE Agent OAuth with ThunderID |
176-
| `opensearch-username` | `admin` | OpenSearch access |
177-
| `opensearch-password` | `ThisIsTheOpenSearchPassword1` | OpenSearch access |
167+
The `values-openbao.yaml` postStart script configures Kubernetes auth, creates reader/writer policies, and seeds the Backstage backend secret into OpenBao. The remaining secrets are generated by `generate-thunder-secrets.sh` which runs before ThunderID install and writes to the following paths:
168+
169+
| OpenBao Path | Source | Use | ExternalSecret |
170+
| ---------------------------------- | ----------------------------- | --------------------------------- | ------------------- |
171+
| `backstage-backend-secret` | postStart (random) | Backstage session signing | `backstage-secrets` |
172+
| `backstage-client-secret` | `generate-thunder-secrets.sh` | Backstage OAuth with ThunderID | `backstage-secrets` |
173+
| `observer-oauth-client-secret` | `generate-thunder-secrets.sh` | Observer OAuth with ThunderID | `observer-secret` |
174+
| `rca-oauth-client-secret` | `generate-thunder-secrets.sh` | RCA Agent OAuth with ThunderID | (created on demand) |
175+
| `finops-agent-oauth-client-secret` | `generate-thunder-secrets.sh` | FinOps Agent OAuth with ThunderID | (created on demand) |
178176

179177
#### Create the ClusterSecretStore
180178

@@ -225,6 +223,13 @@ The control plane is the brain of OpenChoreo. It runs the API server, the web co
225223

226224
[ThunderID](https://github.com/thunder-id/thunderid) handles authentication and OAuth flows. The values file includes bootstrap scripts that run on first startup and configure the organization, users, groups, and OAuth applications automatically.
227225

226+
Before installing ThunderID, generate the required secrets:
227+
228+
```bash
229+
curl -fsSL https://raw.githubusercontent.com/openchoreo/openchoreo/${versions.githubRef}/install/prerequisites/thunder/generate-thunder-secrets.sh \
230+
| BAO_TOKEN=root bash
231+
```
232+
228233
<CodeBlock language="bash">
229234
{`helm upgrade --install thunder oci://ghcr.io/asgardeo/helm-charts/thunder \\
230235
--namespace thunder \\
@@ -306,7 +311,14 @@ In the `thunder` namespace:
306311
- **thunder** handles authentication and OAuth flows
307312

308313
:::tip[ThunderID Admin Console]
309-
You can browse and modify the bootstrapped identity configuration (users, groups, OAuth applications) in the ThunderID console at [http://thunder.openchoreo.localhost:8080/console](http://thunder.openchoreo.localhost:8080/console) using `admin` / `admin`. For details on what the bootstrap configured, see the [On Your Environment](on-your-environment.mdx) guide.
314+
You can browse and modify the bootstrapped identity configuration (users, groups, OAuth applications) in the ThunderID console at [http://thunder.openchoreo.localhost:8080/console](http://thunder.openchoreo.localhost:8080/console). Log in with username `admin` and retrieve the password using:
315+
316+
```bash
317+
kubectl get secret openchoreo-initial-credentials -n thunder \
318+
-o jsonpath='{.data.thunder-console-admin-password}' | openssl base64 -d -A; echo
319+
```
320+
321+
For details on what the bootstrap configured, see the [On Your Environment](on-your-environment.mdx) guide.
310322
:::
311323

312324
## Step 4: Install Default Resources

‎docs/getting-started/try-it-out/on-your-environment.mdx‎

Lines changed: 30 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -121,16 +121,15 @@ OpenChoreo uses [External Secrets Operator](https://external-secrets.io/) to man
121121
For production, provide your own values file with `server.dev.enabled=false` and configure proper storage and unsealing. See the [OpenBao Helm chart docs](https://github.com/openbao/openbao-helm).
122122
:::
123123

124-
The values file runs a postStart script that configures Kubernetes auth, creates reader/writer policies, and seeds the following secrets into the store:
124+
The `values-openbao.yaml` postStart script configures Kubernetes auth, creates reader/writer policies, and seeds the Backstage backend secret into OpenBao. The remaining secrets are generated by `generate-thunder-secrets.sh` which runs before ThunderID install and writes to the following paths:
125125

126-
| Secret | Value | Used By |
127-
| ------------------------------ | --------------------------------------------------- | ------------------------------ |
128-
| `backstage-backend-secret` | `local-dev-backend-secret` | Backstage session signing |
129-
| `backstage-client-secret` | `backstage-portal-secret` | Backstage OAuth with ThunderID |
130-
| `backstage-jenkins-api-key` | `placeholder-not-in-use` | Placeholder |
131-
| `opensearch-username` | `admin` | OpenSearch access |
132-
| `opensearch-password` | `ThisIsTheOpenSearchPassword1` | OpenSearch access |
133-
| `observer-oauth-client-secret` | `openchoreo-observer-resource-reader-client-secret` | Observer OAuth (UID resolver) |
126+
| OpenBao Path | Source | Use | ExternalSecret |
127+
| ---------------------------------- | ----------------------------- | --------------------------------- | ------------------- |
128+
| `backstage-backend-secret` | postStart (random) | Backstage session signing | `backstage-secrets` |
129+
| `backstage-client-secret` | `generate-thunder-secrets.sh` | Backstage OAuth with ThunderID | `backstage-secrets` |
130+
| `observer-oauth-client-secret` | `generate-thunder-secrets.sh` | Observer OAuth with ThunderID | `observer-secret` |
131+
| `rca-oauth-client-secret` | `generate-thunder-secrets.sh` | RCA Agent OAuth with ThunderID | (created on demand) |
132+
| `finops-agent-oauth-client-secret` | `generate-thunder-secrets.sh` | FinOps Agent OAuth with ThunderID | (created on demand) |
134133

135134
#### Create the ClusterSecretStore
136135

@@ -310,6 +309,15 @@ kubectl wait --for=condition=Ready certificate/cp-gateway-tls \
310309
-n openchoreo-control-plane --timeout=60s
311310
```
312311

312+
### Generate ThunderID Secrets
313+
314+
Before installing ThunderID, generate random passwords and client secrets. This creates the `openchoreo-initial-credentials` secret in the `thunder` namespace that ThunderID reads at startup:
315+
316+
```bash
317+
curl -fsSL https://raw.githubusercontent.com/openchoreo/openchoreo/${versions.githubRef}/install/prerequisites/thunder/generate-thunder-secrets.sh \
318+
| BAO_TOKEN=root bash
319+
```
320+
313321
### Install ThunderID (Identity Provider)
314322

315323
[ThunderID](https://github.com/thunder-id/thunderid) handles authentication and OAuth flows. The setup job is a **pre-install helm hook** that bootstraps users, groups, and OAuth applications on the very first `helm install`. To change these later, uninstall ThunderID, delete the PVC, and reinstall.
@@ -341,9 +349,9 @@ You can browse and modify the ThunderID configuration at:
341349
echo "https://thunder.${CP_BASE_DOMAIN}/console"
342350
```
343351

344-
| Username | Password |
345-
| -------- | -------- |
346-
| `admin` | `admin` |
352+
| Username | Password Retrieval Command |
353+
| -------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
354+
| `admin` | `kubectl get secret openchoreo-initial-credentials -n thunder -o jsonpath='{.data.thunder-console-admin-password}' \| openssl base64 -d -A; echo` |
347355

348356
#### Backstage Secrets
349357

@@ -639,9 +647,16 @@ Open the OpenChoreo console in your browser:
639647
echo "https://console.${CP_BASE_DOMAIN}"
640648
```
641649

642-
| Username | Password |
643-
| ------------------------------------------ | ------------------------------------------ |
644-
| <code>{defaultCredentials.username}</code> | <code>{defaultCredentials.password}</code> |
650+
| Username | Password |
651+
| ------------------------------------------ | ------------------------------------------------ |
652+
| <code>{defaultCredentials.username}</code> | Randomly generated. See retrieval command below. |
653+
654+
Retrieve your admin password:
655+
656+
```bash
657+
kubectl get secret openchoreo-initial-credentials -n thunder \
658+
-o jsonpath='{.data.admin-password}' | openssl base64 -d -A; echo
659+
```
645660

646661
You should see the OpenChoreo console. Deploy a sample web app:
647662

‎docs/platform-engineer-guide/identity-configuration.mdx‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,9 +42,13 @@ ThunderID includes a console where you can manage users, applications, and OAuth
4242
**Access ThunderID console:**
4343

4444
- URL: `<your-thunder-url>/console`
45-
- Default credentials:
46-
- Username: `admin`
47-
- Password: `admin`
45+
- Username: `admin`
46+
- Password: Retrieve from the Kubernetes secret:
47+
48+
```bash
49+
kubectl get secret openchoreo-initial-credentials -n thunder \
50+
-o jsonpath='{.data.thunder-console-admin-password}' | openssl base64 -d -A; echo
51+
```
4852

4953
:::note
5054
The default ThunderID deployment is intended for development and testing. For production deployments, configure your own OAuth2/OIDC-compliant identity provider as described in the next section.

0 commit comments

Comments
 (0)