fix security concerns and address comments

Author: jshiwamV

aws/examples/simple/README.md

@@ -134,12 +134,12 @@ To get the NLB DNS name:
 terraform output -json | jq -r .nlb_dns_name.value
 ```
 
-Connect using psql with the default service account credentials:
+Connect using psql with the superuser credentials:
 ```bash
 # Get the password (use jq -r to decode JSON-escaped characters)
-terraform output -json mz_instance_service_account_credentials | jq -r '.password'
+terraform output -json mz_instance_superuser_credentials | jq -r '.password'
 
-psql -h <NLB_DNS> -p 6875 -U default
+psql -h <NLB_DNS> -p 6875 -U <username>
 ```
 
 **If using a private (internal) NLB:**

aws/examples/simple/main.tf

@@ -378,6 +378,9 @@ module "materialize_instance" {
   # The password for the external login to the Materialize instance
   external_login_password_mz_system = random_password.external_login_password_mz_system.result
   authenticator_kind                = "Password"
+  superuser_credentials = {
+    username = "materialize_admin"
+  }
 
   # AWS IAM role annotation for service account
   service_account_annotations = {

aws/examples/simple/outputs.tf

@@ -111,9 +111,9 @@ output "nlb_dns_name" {
   value       = module.materialize_nlb.nlb_dns_name
 }
 
-output "mz_instance_service_account_credentials" {
-  description = "Credentials for the default service account with superuser privileges, Login to materialize using these credentials"
-  value       = module.materialize_instance.service_account_credentials
+output "mz_instance_superuser_credentials" {
+  description = "Credentials for the superuser, Login to materialize using these credentials"
+  value       = module.materialize_instance.superuser_credentials
   sensitive   = true
 }
 

azure/examples/simple/README.md

@@ -160,12 +160,12 @@ To get the Load Balancer IP:
 kubectl get svc -n materialize-environment -o jsonpath='{.items[?(@.spec.type=="LoadBalancer")].status.loadBalancer.ingress[0].ip}'
 ```
 
-Connect using psql with the default service account credentials:
+Connect using psql with the superuser credentials:
 ```bash
 # Get the password (use jq -r to decode JSON-escaped characters)
-terraform output -json mz_instance_service_account_credentials | jq -r '.password'
+terraform output -json mz_instance_superuser_credentials | jq -r '.password'
 
-psql -h <LoadBalancerIP> -p 6875 -U default
+psql -h <LoadBalancerIP> -p 6875 -U <username>
 ```
 
 **If using a private (internal) Load Balancer:**

azure/examples/simple/outputs.tf

@@ -153,9 +153,9 @@ output "resource_group_name" {
   value = azurerm_resource_group.materialize.name
 }
 
-output "mz_instance_service_account_credentials" {
-  description = "Credentials for the default service account with superuser privileges, Login to materialize using these credentials"
-  value       = module.materialize_instance.service_account_credentials
+output "mz_instance_superuser_credentials" {
+  description = "Credentials for the superuser, Login to materialize using these credentials"
+  value       = module.materialize_instance.superuser_credentials
   sensitive   = true
 }
 

gcp/examples/simple/README.md

@@ -160,12 +160,12 @@ To get the Load Balancer IP:
 kubectl get svc -n materialize-environment -o jsonpath='{.items[?(@.spec.type=="LoadBalancer")].status.loadBalancer.ingress[0].ip}'
 ```
 
-Connect using psql with the default service account credentials:
+Connect using psql with the superuser credentials:
 ```bash
 # Get the password (use jq -r to decode JSON-escaped characters)
-terraform output -json mz_instance_service_account_credentials | jq -r '.password'
+terraform output -json mz_instance_superuser_credentials | jq -r '.password'
 
-psql -h <LoadBalancerIP> -p 6875 -U default
+psql -h <LoadBalancerIP> -p 6875 -U <username>
 ```
 
 **If using a private (internal) Load Balancer:**

gcp/examples/simple/main.tf

@@ -330,6 +330,9 @@ module "materialize_instance" {
   # The password for the external login to the Materialize instance
   external_login_password_mz_system = random_password.external_login_password_mz_system.result
   authenticator_kind                = "Password"
+  superuser_credentials = {
+    username = "materialize_admin"
+  }
 
   # GCP workload identity annotation for service account
   # TODO: this needs a fix in Environmentd Client. KSA based access to storage doesn't work end to end

gcp/examples/simple/outputs.tf

@@ -147,9 +147,9 @@ output "balancerd_load_balancer_ip" {
   value       = module.load_balancers.balancerd_load_balancer_ip
 }
 
-output "mz_instance_service_account_credentials" {
-  description = "Credentials for the default service account with superuser privileges, Login to materialize using these credentials"
-  value       = module.materialize_instance.service_account_credentials
+output "mz_instance_superuser_credentials" {
+  description = "Credentials for the superuser, Login to materialize using these credentials"
+  value       = module.materialize_instance.superuser_credentials
   sensitive   = true
 }
 

kubernetes/modules/materialize-instance/main.tf

@@ -1,32 +1,47 @@
 locals {
-  secret_name          = "${var.instance_name}-materialize-backend"
-  mz_resource_id       = data.kubernetes_resource.materialize_instance.object.status.resourceId
-  service_account_name = "default"
+  secret_name      = "${var.instance_name}-materialize-backend"
+  mz_resource_id   = data.kubernetes_resource.materialize_instance.object.status.resourceId
+  create_superuser = contains(["Password", "Sasl"], var.authenticator_kind) && var.superuser_credentials != null
 
-  # Hash of password - job only recreates when password changes
-  service_account_password_hash = contains(["Password", "Sasl"], var.authenticator_kind) ? substr(sha256(random_password.service_account_password[0].result), 0, 8) : ""
+  use_provided_password = trimspace(try(var.superuser_credentials.password, "")) != ""
+  superuser_password    = local.create_superuser ? (local.use_provided_password ? var.superuser_credentials.password : random_password.superuser_password[0].result) : ""
 }
 
-resource "random_password" "service_account_password" {
-  count            = contains(["Password", "Sasl"], var.authenticator_kind) ? 1 : 0
+resource "random_password" "superuser_password" {
+  count            = local.create_superuser ? 1 : 0
   length           = 16
   special          = true
   override_special = "!#$%&*()-_=+[]{}<>:?"
 }
 
-# Create a job to create the default service account with superuser privileges
-# https://materialize.com/docs/security/self-managed/access-control/manage-roles/#create-individual-userservice-account-roles
-resource "kubernetes_job" "create_service_account" {
-  count = contains(["Password", "Sasl"], var.authenticator_kind) ? 1 : 0
+# Secret to store superuser credentials (avoids exposing password in pod spec)
+resource "kubernetes_secret" "superuser_credentials" {
+  count = local.create_superuser ? 1 : 0
+
   metadata {
-    # Hash in name ensures job only recreates when password changes
-    name      = "${var.instance_name}-create-role-${local.service_account_password_hash}"
+    name      = "${var.instance_name}-superuser-credentials"
     namespace = var.instance_namespace
   }
 
+  data = {
+    username = var.superuser_credentials.username
+    password = local.superuser_password
+  }
+
+}
+
+# Create a job to create the user with superuser privileges
+# https://materialize.com/docs/security/self-managed/access-control/manage-roles/#create-individual-userservice-account-roles
+resource "kubernetes_job" "create_superuser" {
+  count = local.create_superuser ? 1 : 0
+  metadata {
+    generate_name = "${var.instance_name}-create-superuser-"
+    namespace     = var.instance_namespace
+  }
+
   spec {
-    # No TTL - job stays so Terraform doesn't see drift and recreate on every apply
-    backoff_limit = 3
+    ttl_seconds_after_finished = 600
+    backoff_limit              = 3
 
     template {
       metadata {
@@ -40,18 +55,18 @@ resource "kubernetes_job" "create_service_account" {
 
         container {
           name  = "psql"
-          image = "postgres:16-alpine"
+          image = "postgres:18-alpine"
 
           command = [
             "sh", "-c",
             <<-EOT
-            ROLE_EXISTS=$(PGPASSWORD=$MZ_PASSWORD psql -h $MZ_HOST -p 6875 -U mz_system -d materialize -tAc "SELECT 1 FROM mz_roles WHERE name = '${local.service_account_name}';")
+            ROLE_EXISTS=$(PGPASSWORD=$MZ_PASSWORD psql -h $MZ_HOST -p 6875 -U mz_system -d materialize -tAc "SELECT 1 FROM mz_roles WHERE name = '$SUPERUSER_USERNAME';")
             if [ -z "$ROLE_EXISTS" ]; then
               PGPASSWORD=$MZ_PASSWORD psql -h $MZ_HOST -p 6875 -U mz_system -d materialize \
-                -c "CREATE ROLE ${local.service_account_name} WITH SUPERUSER LOGIN PASSWORD '${random_password.service_account_password[0].result}';"
+                -c "CREATE ROLE $SUPERUSER_USERNAME WITH SUPERUSER LOGIN PASSWORD '$SUPERUSER_PASSWORD';"
             else
               PGPASSWORD=$MZ_PASSWORD psql -h $MZ_HOST -p 6875 -U mz_system -d materialize \
-                -c "ALTER ROLE ${local.service_account_name} PASSWORD '${random_password.service_account_password[0].result}';"
+                -c "ALTER ROLE $SUPERUSER_USERNAME PASSWORD '$SUPERUSER_PASSWORD';"
             fi
             EOT
           ]
@@ -70,6 +85,26 @@ resource "kubernetes_job" "create_service_account" {
               }
             }
           }
+
+          env {
+            name = "SUPERUSER_USERNAME"
+            value_from {
+              secret_key_ref {
+                name = kubernetes_secret.superuser_credentials[0].metadata[0].name
+                key  = "username"
+              }
+            }
+          }
+
+          env {
+            name = "SUPERUSER_PASSWORD"
+            value_from {
+              secret_key_ref {
+                name = kubernetes_secret.superuser_credentials[0].metadata[0].name
+                key  = "password"
+              }
+            }
+          }
         }
       }
     }
@@ -79,6 +114,7 @@ resource "kubernetes_job" "create_service_account" {
 
   timeouts {
     create = "5m"
+    update = "5m"
   }
 
   depends_on = [

kubernetes/modules/materialize-instance/outputs.tf

@@ -32,11 +32,11 @@ output "mz_system_credentials" {
   sensitive = true
 }
 
-output "service_account_credentials" {
-  description = "Credentials for the default service account with superuser privileges, Login to materialize using these credentials"
-  value = contains(["Password", "Sasl"], var.authenticator_kind) ? {
-    username = local.service_account_name
-    password = random_password.service_account_password[0].result
+output "superuser_credentials" {
+  description = "Credentials for the superuser, Login to materialize using these credentials"
+  value = local.create_superuser ? {
+    username = var.superuser_credentials.username
+    password = local.superuser_password
   } : {}
   sensitive = true
 }