apache / apache/iotdb

[Feature request] Support configuring initial credentials via environment variables

Abierto
#17,319 3 comentarios 2 reacciones 0 asignados Ver en GitHub
Lenguaje dominante
Java
Estrellas
6.4k
Forks
1.2k
Merge medio
1 d 23 h
PR fusionados (30 d)
115

Descripción

### Search before asking

- [x] I searched in the [issues](https://github.com/apache/iotdb/issues) and found nothing similar.

### Motivation

When deploying IoTDB in a containerized or orchestrated environment (e.g. Kubernetes), there is currently no way to set the initial user credentials through environment variables. The only documented approach is to start the server with default credentials, manually connect, and run:

`ALTER USER root SET PASSWORD 'newpwd';`

This is impractical for automated deployments where manual intervention is not an option.

Requested behavior:

The entrypoint/startup scripts should check for the presence of environment variables — for example IOTDB_USER and IOTDB_PASSWORD — and, if set, apply those credentials automatically on first startup. This would allow orchestration tools (Helm charts, Docker Compose, etc.) to inject credentials via secrets without requiring a manual post-deploy step.

Use case:

```
- name: IOTDB_USER
valueFrom:
secretKeyRef:
name: iotdb-secret
key: iotdb-user
- name: IOTDB_PASSWORD
valueFrom:
secretKeyRef:
name: iotdb-secret
key: iotdb-password
```

In a Kubernetes Helm chart, we inject IOTDB_USER and IOTDB_PASSWORD into the pod spec from a Secret:

The environment variables are present inside the container, but IoTDB ignores them entirely. The server starts with the default root/root credentials regardless.

### Solution

If IOTDB_USER and IOTDB_PASSWORD are set, the startup scripts should apply them (e.g. by running the equivalent of ALTER USER root SET PASSWORD ...) so the instance is ready to use with the desired credentials without manual intervention.

### Alternatives

_No response_

### Are you willing to submit a PR?

- [ ] I'm willing to submit a PR!

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Comienza localizando el punto de entrada de IoTDB o los scripts de inicio que inicializan el servidor y las credenciales. Rastrea cómo se crea la cuenta root inicial y determina después dónde podrían leerse IOTDB_USER y IOTDB_PASSWORD durante el primer inicio. Se considerará terminado cuando un despliegue en contenedor pueda proporcionar esas variables e iniciarse con las credenciales solicitadas sin intervención manual de ALTER USER.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
docker-compose, helm, java, kubernetes
Área
authentication, database, devops
Tipo de issue
Nueva funcionalidad
Dificultad
4/5
Tiempo estimado
3-5 días
Estado de actividad
Tranquilo
Claridad
Bastante claro
Aptitud para principiantes
55/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.