Skip to content

Remove hardcoded passwords following install_yamls#1158#471

Open
kstrenkova wants to merge 1 commit into
openstack-k8s-operators:mainfrom
kstrenkova:update-hardcoded-passwords
Open

Remove hardcoded passwords following install_yamls#1158#471
kstrenkova wants to merge 1 commit into
openstack-k8s-operators:mainfrom
kstrenkova:update-hardcoded-passwords

Conversation

@kstrenkova

@kstrenkova kstrenkova commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

A recent change [1] in install_yamls repository replaced hardcoded passwords with dynamically generated secrets. To keep test-operator up to date, it is needed to also update/remove hardcoded passwords, which is the goal of this PR. The new dynamic passwords also break EnsureCloudsConfigMapExists which injected "12345678" into clouds.yaml when empty, but that value no longer matches the real admin password.

This patch removes the workaround and has Tobiko and HorizonTest mount the original openstack-config ConfigMap directly. For HorizonTest, the password is read from osp-secret thanks to a ci-framework patch [2]. For Tobiko, a new way of supporting the password from secure.yaml is being worked on [3].

[1] openstack-k8s-operators/install_yamls#1158
[2] openstack-k8s-operators/ci-framework#4067
[3] https://review.opendev.org/c/x/tobiko/+/998010

@centosinfra-prod-github-app

Copy link
Copy Markdown

Merge Failed.

This change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset.
Warning:
Unable to update github.com/openstack-k8s-operators/test-operator

@kstrenkova
kstrenkova force-pushed the update-hardcoded-passwords branch from 3ed90e9 to 174e112 Compare July 21, 2026 09:42
@centosinfra-prod-github-app

Copy link
Copy Markdown

Merge Failed.

This change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset.
Warning:
Unable to update github.com/openstack-k8s-operators/test-operator

@kstrenkova
kstrenkova force-pushed the update-hardcoded-passwords branch from 174e112 to 4a328f5 Compare July 21, 2026 09:45
@centosinfra-prod-github-app

Copy link
Copy Markdown

Merge Failed.

This change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset.
Warning:
Unable to update github.com/openstack-k8s-operators/test-operator

@kstrenkova
kstrenkova force-pushed the update-hardcoded-passwords branch from 4a328f5 to 7d7836c Compare July 21, 2026 10:24
@centosinfra-prod-github-app

Copy link
Copy Markdown

Merge Failed.

This change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset.
Warning:
Unable to update github.com/openstack-k8s-operators/test-operator

@kstrenkova

Copy link
Copy Markdown
Contributor Author

recheck

@centosinfra-prod-github-app

Copy link
Copy Markdown

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/03a143b88269460fa842f3ad5e869d56

✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 08m 35s
✔️ test-operator-kuttl SUCCESS in 44m 53s
podified-multinode-edpm-deployment-crc-test-operator FAILURE in 2h 30m 00s

@Valkyrie00

Valkyrie00 commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

recheck - LGTM, We just have to wait for the new tobiko image

@openshift-ci

openshift-ci Bot commented Jul 22, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kstrenkova, Valkyrie00

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@Valkyrie00 Valkyrie00 removed the lgtm label Jul 22, 2026
@centosinfra-prod-github-app

Copy link
Copy Markdown

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/eb1edf2803c74d84bfa6eec40ce8c61a

✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 47m 37s
✔️ test-operator-kuttl SUCCESS in 45m 39s
podified-multinode-edpm-deployment-crc-test-operator FAILURE in 2h 30m 20s

@kstrenkova

Copy link
Copy Markdown
Contributor Author

recheck - LGTM, We just have to wait for the new tobiko image

Thanks for the review! I have contacted @HanzJas for the HorizonTest part and seems more things have been failing for them than I thought. So we will need to wait for both Tobiko and Horizon, plus the tests will not pass otherwise anyway (recheck will not work).

@HanzJas

HanzJas commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

recheck - LGTM, We just have to wait for the new tobiko image

Thanks for the review! I have contacted @HanzJas for the HorizonTest part and seems more things have been failing for them than I thought. So we will need to wait for both Tobiko and Horizon, plus the tests will not pass otherwise anyway (recheck will not work).

Hello @kstrenkova, yes, horizontests are still reading/using old 12345678 password so our tests are currently failing in component pipeline. I created a fix directly in horizontest tcib that is reading password directly from OpenStackConfig(): openstack-k8s-operators/tcib#408, currently waiting for reviews/comments.
But if you have some better (global) solution, let's do it.

A recent change [1] in install_yamls repository replaced hardcoded
passwords with dynamically generated secrets. To keep test-operator
up to date, it is needed to also update/remove hardcoded passwords,
which is the goal of this PR. The new dynamic passwords also break
EnsureCloudsConfigMapExists which injected "12345678" into
clouds.yaml when empty, but that value no longer matches the
real admin password.

This patch removes the workaround and has Tobiko and HorizonTest
mount the original openstack-config ConfigMap directly. For
HorizonTest, the password is read from osp-secret thanks to a
ci-framework patch [2]. For Tobiko, a new way of supporting the
password from secure.yaml is being worked on [3].

[1] openstack-k8s-operators/install_yamls#1158
[2] openstack-k8s-operators/ci-framework#4067
[3] https://review.opendev.org/c/x/tobiko/+/998010
@kstrenkova
kstrenkova force-pushed the update-hardcoded-passwords branch from 7d7836c to 26b3cfc Compare July 23, 2026 13:47
@kstrenkova

Copy link
Copy Markdown
Contributor Author

I removed the change in config/samples/...horizontest.yaml because it will be applied in a different PR (deprecate AdminPassword and AdminUser), so just preparing to not have merge conflicts :D

@centosinfra-prod-github-app

Copy link
Copy Markdown

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/80af82893eef4f919c1fa87f5e733507

openstack-k8s-operators-content-provider FAILURE in 11m 12s
⚠️ test-operator-kuttl SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider
⚠️ podified-multinode-edpm-deployment-crc-test-operator SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants