emqx/emqx-operator

Replacing default API keys

shailesh-bear opened this issue · 3 comments

shailesh-bear commented

Describe the bug

Unable to replace the default API keys. Currently, the operator automatically creates a api key bootstrap file, and mounts it to the pods. I am not able to override it.
If I set EMQX_API_KEY__BOOTSTRAP_FILE env variable, then the pod does not start as it has already been set by the operator, so there is duplicate entry and it fails. If I set the api_key.bootstrap_file in config, it has no effect as the env variable will override this setting.

To Reproduce
Steps to reproduce the behavior:

Create secret

apiVersion: v1
kind: Secret
metadata:
  name: api-keys
type: Opaque
data:
  bootstrap_api_key: "test:qt4o8U1eD132zq5uKf10r9AaEQGwAgdJ9AjUlT0uHYFNA"

Deploy cluster

apiVersion: apps.emqx.io/v2beta1
kind: EMQX
  name: emqx-cluster
spec:
  image: emqx:5.3.0
  config:
    data: |
      api_key.bootstrap_file = "/opt/emqx/etc/bootstrap_api_key"
  coreTemplate:
    spec:
      replicas: 1
      extraVolumes:
        - name: api-keys
          secret:
            secretName: api-keys
      extraVolumeMounts:
        - mountPath: "/opt/emqx/etc/bootstrap_api_key"
          name: api-keys
          subPath: bootstrap_api_key
  dashboardServiceTemplate:
    enabled: true
    spec:
      type: LoadBalancer

Check API keys in deployed cluster, they are not the ones from secret above.

Expected behavior
EMQX should use the API key provided as a secret, and it should allow overriding default API keys.

Anything else we need to know?:

Environment details::

  • Kubernetes version: 1.26.6-gke.1700
  • Cloud-provider/provisioner: Google
  • emqx-operator version: v2beta1
  • Install method: Helm
Rory-Z commented

Hi @shailesh-bear sorry, you can't replacing default API keys, because the EMQX operator controller need it to request EMQX API.
If you want add yourself bootstrap api keys, you can set it in .spec.bootstrapAPIKeys, for now, we just support plaintext, but we will support external secret soon
In this discussion: #953 (comment), I propose a plan to support external secret, if you have any idea, please let me know.

shailesh-bear commented

@Rory-Z How is the default API keys generated? If it is not a predefined, but rather randomly generated for each deployment, then it is not a security concern and those keys can be kept.