[chectl] generate passwords for initial users

[sleshchenko]

Is your enhancement related to a problem? Please describe.

Currently, there are default users admin with password admin (different admins for Che and Keycloak, stored in the different realms).
And after the first login to Che, a user is asked to change a default password.
And for keycloak, there is no tip that password should be updated at all.

But chectl even do not tells that there is such default user and password should be updated.
So, there is some period when everyone is able to login as admin to Che and Keycloak on fresh installation if URLs are known.

Describe the solution you'd like

It would be safer if chectl generate a password for initial admin users to prevent logging in as admin knowing only Che and Keycloak URLs.

[sleshchenko]

cc @slemeur @l0rd

[l0rd]

Good point @sleshchenko. And that's critical. That should rather be done helm and operator side, not chectl. Otherwise we would only solve the problem partially (installing via the OperatorHub the password would not be changed for instance). As of today we may print a warning message when installing via chectl. I don't know if we can show a warning message easily on the OperatorHub side as well (cc @davidfestal)

[davidfestal]

afaik The operator already generates random admin passwords by default (at least for Keycloak).

[nickboldt]

@slemeur if you think this needs to be in 7.2, then it's been triaged. removing the status/need-triage label

[tolusha]

The default keycloak password in helm chart is admin
https://github.com/eclipse/che/blob/master/deploy/kubernetes/helm/che/custom-charts/che-keycloak/templates/deployment.yaml#L57-L58

On the operator side it is autogenerated

[tolusha]

Creating default admin user for Che
https://github.com/eclipse/che/blob/master/dockerfiles/keycloak/keycloak_config.sh#L26

[tolusha]

To force use to update its password we have to specify

spec:
  auth:
    updateAdminPassword: true

[mmorhun]

In terms of this issue we make sure that Keycloak admin password is autogenerated. If a user uses chectl the password will be printed into terminal.
Also we applied requirement to change Che admin password after first login. We don't use autogenerated password there because in case of using operator installer without chectl the password cannot be delivered to user easily.

[mmorhun]

Done