Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Remove residual platform credentials from Terraform state and unsafe defaults

Open
  • Is something wrong?
#400 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
20/100
Issue type
Refactor
Clarity
Mostly clear
Activity status
Active
Tech stack
helm, kubernetes, python, terraform
Domain
databases, infrastructure, security

Research direction

Read AGENTS.md and docs/architecture/identity-credentials.md first, then compare the current Terraform modules and Dex/GitHub implementation referenced by #384. Map credential owners, consumers, state exposure, upgrade behavior, and recovery before selecting a narrow module slice. Done means the scoped changes preserve credentials across redeploy and upgrades, prevent secret exposure in state, Helm values, logs, and CI, and include the requested regression and access checks.

Written by the indexing model from the issue text.

Description

priority: P1 roadmap track: operability

Milestone: v0.8-beta — On-Premises Beta
Roadmap: #183 · Precedent: #181 (closed identity secret hygiene; documented residual debt), #178 (workload identity classes), #46 (namespace RBAC), #50 (operational recovery), #27 (post-v1 optional external secret stores).

Goal

Make Kubernetes Secrets the supportable default by ensuring OLF does not generate or embed long-lived application secret values in Terraform state, rendered Helm release values, config files or CI diagnostics. A managed external secrets backend is not a prerequisite for v1.

Why

docs/architecture/identity-credentials.md records residual Terraform-observed values for PostgreSQL administrator/per-service passwords, local SeaweedFS S3 credentials, Polaris bootstrap credentials and Superset encryption key, plus legacy default admin passwords. #181 already moved the identity credentials it touched to in-cluster create-if-missing Jobs; the other cases remain real debt. sensitive = true does not remove secret values from Terraform state.

Scope

  1. Reconcile the inventory with the current Dex/GitHub implementation (#384) and current platform Terraform modules; classify each secret by owner, consumers, namespaces, state/Helm exposure, regeneration, rotation, recovery and data-loss impact. Exclude removed Keycloak/SMTP values once migrated.
  2. Move remaining generated credentials that must be shared between services to in-cluster provisioned/referenced Kubernetes Secrets (or other documented safe non-Terraform production mechanism). Do not write raw passwords or keys to Terraform outputs/state or rendered chart values. Keep reruns idempotent: redeploy must not rotate credentials.
  3. Replace insecure out-of-box service administrator passwords/defaults with explicit bootstrap or fail-closed validation, without conflating machine identities with GitHub human SSO.
  4. Verify existing cluster state containing old values is handled safely during upgrades; document state-history cleanup/recovery and Secret ownership. Migrate by retaining existing values, not silently regenerating them and breaking clients.
  5. Add regression checks preventing new Terraform random_password / random_id credential generation or kubernetes_secret value persistence for scoped services; forbid secret values in olf logs, diagnostics, contract outputs and CI. Apply the policy carefully to identifiers that are not secrets.
  6. E2E tests prove access by appropriate service accounts, denied access across stage/namespace boundaries, preserved credentials on redeploy, and an explicit rotation drill for at least one migrated legacy service credential.
  7. Document the appropriate backup/recovery method for irreplaceable secret material (e.g. encryption keys), integrated with #50 and provider restoration #47. Avoid placing plaintext Secrets in retained diagnostics or unsafe backups.

Acceptance

  • Scope inventory matches the actual repository (not only historical Keycloak rows).
  • No supported freshly deployed on-prem/local production-mode service requires long-lived plaintext credentials retained in Terraform state or Helm release values.
  • No fixed shared default admin password survives the secure deployment path.
  • Upgrade from existing state preserves service access and has a rollback procedure.
  • Secrets persist across redeploy, with documented safe rotation and recovery; loss of an encryption key is explicitly handled.
  • Per-namespace RBAC and secrets-exposure checks from #46/#52 continue to pass.
  • No Vault, External Secrets Operator or Secrets Manager is required or deployed.

Boundaries / PR slicing

This is not the optional managed secret store feature (#27), a new SSO subsystem, or generic Kubernetes control-plane hardening. Split implementation into narrow PRs by credential-owning module (e.g. DB, storage/catalog, application encryption and service-admin bootstrap); keep the cross-cutting inventory/checks as a separate small PR. Review AGENTS.md first.

Dominant language
Python
Stars
26
Forks
6
Avg merge
12h 14m
Merged PRs (30d)
133

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from OpenLakeForge/openlakeforge

All issues in OpenLakeForge/openlakeforge

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.