bifrost/releasenotes/notes/random-passwords-b33b8de010ee82b6.yaml
Dmitry Tantsur 2a6fc72559 Use random passwords by default
It's easy to forget to override them, and you'll end up with a well known
password used in your keystone and database. Use the password module
to generate secure random passwords instead. Operators of production
environments are still expected to provide their own passwords.

The generated passwords are stored in /etc/bifrost and reused on the next
installation. A new task is provided for upgrading the bootstrap (admin)
user in keystone to the new password.

Change-Id: I6771015f2b062233eeff85704655c8e2ab64364d
2020-07-25 21:59:02 +02:00

19 lines
686 B
YAML

---
upgrade:
- |
The ``inspector_user`` user is not created by default any more. Use
``bifrost_user`` instead.
- |
If you're relying on default passwords (e.g. for the database or keystone
passwords), they will be changed on upgrade. Please use explicit values
if you want to avoid it.
security:
- |
Random passwords are now generated by default instead of using a constant.
The same parameters as before can be used to override them.
deprecations:
- |
The ``ironic_db_password`` parameter is deprecated, please use
``service_password`` to set a password to use between services or
override the whole ``ironic`` and ``keystone`` objects.