apache / apache/doris-operator

[Feature] Allow setting the root password through the Secret store CSI driver

Open
#485 3 comments 0 reactions 0 assignees View on GitHub
Feature
Dominant language
Go
Stars
138
Forks
72
Avg merge
5d 12h
Merged PRs (30d)
3

Description

### Search before asking

- [x] I had searched in the [issues](https://github.com/apache/doris-operator/issues?q=is%3Aissue) and found no similar issues.

### Description

I recently read through the English [guide on setting the initial root password](https://github.com/apache/doris-operator/blob/master/doc/operation/initial_password.md) for an Apache Doris cluster and personally had some doubts about the security of the ways described there to set the root password. I'm not sure if this is the place to discuss those concerns, hence I will not post those here directly.

Instead, I would like to propose a new mechanism to provide the root password to the Doris Frontend container(s):
[The Kubernetes Secret Store CSI Driver](https://secrets-store-csi-driver.sigs.k8s.io/concepts.html#provider-for-the-secrets-store-csi-driver). The great advantages of this method are:
- Secrets by default always come from a place where they are stored securely, and access is well audited, as the system relies on external secret stores like OpenBAO/Vault or various or various Public Cloud secret managers
- You do not have to rely on Kubernetes secrets ([which by default are only base64 encoded, and stored in plaintext in etcd if encryption-at-rest is not enabled on the cluster - the default setting](https://kubernetes.io/docs/concepts/configuration/secret/)
- These secrets are never stored in ETCD but only in the external secret store, and made available to Linux pods as tmpfs volumes, which are cleaned up the moment a pod is deleted.

For an overview on how to apply this mechanism see [this page](https://secrets-store-csi-driver.sigs.k8s.io/getting-started/usage), perhaps it could be combined with first pattern mentioned, by providing the frontend config file as a secret mounted through the Secret Store CSI Driver.

### Use case

I believe adding the above mechanism will ensure the admin account password is much better protected (and audited) than in the current methods. A comprised admin password can cause data leaks and other damage, so I suggest setting up secure from the start, and for sure setting one by default (secure by default).

### Related issues

Not that I know of...

### Are you willing to submit PR?

- [ ] Yes I am willing to submit a PR!

### Code of Conduct

- [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.