Repository navigation
Conversation
… (CCF-18200) SEC-AUT-DEFROOT-3 forbids shipped default credentials. Remove the private key baked into every operator image, unregister the unreleased SECA feature and its "replace-me" token, and drop the minioadmin fallbacks from the upload helpers. The installer and air-gap wrapper now reject missing, placeholder and factory-default object-store credentials before any cluster change. Splunk now signs JWTs with a per-installation RSA key and random passphrase instead of the built-in server.pem with passphrase "password". Existing signing Secrets are validated before reuse, a lost Secret on a configured install requires restoration (or explicit ROTATE_JWT_SIGNER=true, which restarts Splunk), and a freshly issued JWT is verified against the key. Co-Authored-By: Claude Code <noreply@anthropic.com>
…dentials Unregistering SECA changed the shared CRDs and operator for k0s and EKS. The default credential was only the unused "replace-me" Secret, which stays removed, so restore SECA's registration, CRD enum and sample as on main. k0s staging uses the shared upload helpers, which now refuse missing and minioadmin/minioadmin credentials. Check the same rules in k0s preflight and before staging so k0s fails before the Hugging Face download instead of at upload. Co-Authored-By: Claude Code <noreply@anthropic.com>
- Drop become from the Splunk pre-task (the pod cannot escalate) and skip it when the signing Secret is not mounted, so an interrupted upgrade cannot crash-loop Splunk. - Restart Splunk via a signer fingerprint in the Standalone extraEnv instead of a one-shot pod delete, so a failed rotation still converges on rerun; readiness waits for the pod carrying the current fingerprint. - ROTATE_JWT_SIGNER=true now replaces an existing Secret as documented, and oc errors reading the Standalone stop the run instead of looking like a fresh install. - Check credentials before the air-gap path changes the cluster, remove the unreachable duplicate checks, delete the signing Secret on uninstall, and give JWT verification clear errors for login and non-JSON responses. - Fix the Secret backup/restore docs and the upload helper usage docs. Co-Authored-By: Claude Code <noreply@anthropic.com>
…able Standalone lookups JWT verification now reads the admin password from the versioned Secret the Splunk pod actually mounts (mnt-splunk-secrets), so a rotated -v2 password is used instead of a stale -v1. An unparseable Standalone response now stops the run instead of being treated as a fresh install. Tests cover both, plus readiness waiting for the pod that carries the current signer fingerprint. Co-Authored-By: Claude Code <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
vavarshn
changed the title
vavarshn
force-pushed
the
vavarshn/ccf-18200-no-default-creds
branch
from
October 14, 2026 18:53
c607204 to
85915b6
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements CCF-18200 (PSB SEC-AUT-DEFROOT-3 "No default credentials") for the OpenShift deployment.
Dockerfile,Dockerfile.debug). Nothing read/certs; webhook/metrics certs come from cert-manager.API_TOKEN: "replace-me". SECA stays registered, so CRDs are unchanged for k0s/EKS.minioadmin/minioadmin. The OpenShift installer and air-gap path reject missing, placeholder and factory-default credentials before any cluster change; k0s fails early on the same rules.<standaloneName>-jwt-signinginstead of the built-inserver.pemwith passphrasepassword. Port 8089, HEC and KV store are unchanged.ROTATE_JWT_SIGNER=true).extraEnvmakes the Splunk Operator restart Splunk whenever the key changes.Behaviour changes to note
upload_to_minio.shandupload_to_seaweedfs_upload_only.shnow requireOBJECT_STORE_ACCESS_KEY/OBJECT_STORE_SECRET_KEYand refuseminioadmin/minioadmin. The OpenShift and k0s installers already pass credentials; k0s now fails at preflight instead of at upload.delete/clean-allnow also remove the signing Secret.Test plan
tools/ai-tier-cluster-setup/test_openshift_with_stack.sh: 217 passedtools/ai-tier-cluster-setup/test_k0s_cluster_with_stack.sh: 258 passedgo build ./...,go test ./pkg/ai/features/... ./internal/webhook/...main; Splunk becomes Ready and the installer's JWT check passesROTATE_JWT_SIGNER=truerotation, including an interrupted run followed by a plain re-runminioadmin/minioadminbefore patching the cluster/certs🤖 Generated with Claude Code