Fix PostgreSQL credential security and extract random string generation - #16
Merged
openshift-merge-bot[bot] merged 2 commits intoJul 13, 2026
Conversation
|
Skipping CI for Draft Pull Request. |
lpiwowar
force-pushed
the
lpiwowar/postgresql-password
branch
3 times, most recently
from
July 10, 2026 16:15
cf56b81 to
be4035f
Compare
umago
requested changes
Jul 10, 2026
umago
left a comment
umago
left a comment
Collaborator
There was a problem hiding this comment.
Thanks Lukas! I know this is draft still but it looks good.
Only thing I would say is that a 16 character password seems a bit too weak. I would do at least 32 to be on the safe-side here.
lpiwowar
force-pushed
the
lpiwowar/postgresql-password
branch
from
July 13, 2026 10:16
be4035f to
5097f7f
Compare
lpiwowar
changed the title
postgres user
lpiwowar
marked this pull request as ready for review
July 13, 2026 10:24
umago
previously approved these changes
Jul 13, 2026
umago
left a comment
umago
left a comment
Collaborator
There was a problem hiding this comment.
Thanks!
Tests are still running but the code looks good to me!
The previous PostgreSQL setup had several security and consistency problems: Security issues: 1. POSTGRESQL_ADMIN_PASSWORD was set, making the postgres superuser accessible remotely (not just locally via `oc rsh` + `psql`). [1] 2. Both lightspeed-stack and llama-stack were connecting as the postgres superuser rather than a dedicated non-admin user. 3. The postgres superuser username usage was hardcoded and credential paths into the app and db pods were inconsistent. Naming/consistency issues: 4. lightspeed-stack used database "postgres" while llama-stack used "llamastack", with no explicit database name in llama-stack's config. 5. POSTGRES_USER/POSTGRES_PASSWORD env var names did not follow the POSTGRESQL_* convention of the PostgreSQL container image and also the usage of these env vars was insonsistent across the operator code. 6. Bootstrap SQL was embedded in postgres_bootstrap.sh, making it hard to read and maintain. Fixes: - Remove POSTGRESQL_ADMIN_PASSWORD. The postgres superuser is now only accessible locally via `oc rsh` + `psql` (no password required). - Introduce a dedicated non-admin user "lightspeed-app-user", stored in lightspeed-postgres-secret alongside the password. Both apps now connect as this user via POSTGRESQL_USER and POSTGRESQL_PASSWORD. - Rename the lightspeed-stack database from "postgres" to "lightspeed-stack" and make llama-stack's "llamastack" database selection explicit in its config. - Rename POSTGRES_USER/POSTGRES_PASSWORD -> POSTGRESQL_USER/POSTGRESQL_PASSWORD throughout to match the container image's naming convention. - Extract bootstrap SQL into postgres_bootstrap.sql to enable syntax highlighting and improve maintainability. [1] https://github.com/sclorg/postgresql-container/blob/master/src/root/usr/share/container-scripts/postgresql/README.md#postgresql-admin-account
Move generateRandomString from postgres_reconciler.go to common.go so the helper is available across the package. Add tests covering output length, hex character validity, and uniqueness. Also, make the generated password longer and thus more secure (16 -> 32).
lpiwowar
force-pushed
the
lpiwowar/postgresql-password
branch
from
July 13, 2026 12:02
5097f7f to
505896b
Compare
umago
approved these changes
Jul 13, 2026
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: lpiwowar, umago The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Collaborator
|
Waiting tests before final approval |
Collaborator
|
/lgtm |
openshift-merge-bot
Bot
merged commit Jul 13, 2026
6161942
into
openstack-k8s-operators:main
8 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The previous PostgreSQL setup had several security and consistency problems:
Security issues:
POSTGRESQL_ADMIN_PASSWORDwas set, making the postgres superuser accessible remotely (not just locally viaoc rsh+psql). [1]Naming/consistency issues:
4. lightspeed-stack used database "postgres" while llama-stack used "llamastack", with no explicit database name in llama-stack's config.
5.
POSTGRES_USER/POSTGRES_PASSWORDenv var names did not follow thePOSTGRESQL_*convention of the PostgreSQL container image and also the usage of these env vars was insonsistent across the operator code.6. Bootstrap SQL was embedded in
postgres_bootstrap.sh, making it hard to read and maintain.Fixes:
POSTGRESQL_ADMIN_PASSWORD. The postgres superuser is now only accessible locally viaoc rsh+psql(no password required).lightspeed-postgres-secretalongside the password. Both apps now connect as this user viaPOSTGRESQL_USERandPOSTGRESQL_PASSWORD.postgrestolightspeed-stackand make llama-stack'sllamastackdatabase selection explicit in its config.POSTGRES_USER/POSTGRES_PASSWORD->POSTGRESQL_USER/POSTGRESQL_PASSWORDthroughout to match the container image's naming convention.postgres_bootstrap.sqlto enable syntax highlighting and improve maintainability.[1] https://github.com/sclorg/postgresql-container/blob/master/src/root/usr/share/container-scripts/postgresql/README.md#postgresql-admin-account