Remove default credentials from gateway and use file config interpolation for encryption key #2853
Merged
Merged
Conversation
thivindu
requested review from
AnuGayan,
Arshardh,
CrowleyRajapakse,
HeshanSudarshana,
HiranyaKavishani,
Induwara04,
Krishanx92,
PasanT9,
Piumal1999,
RakhithaRR,
Tharsanan1,
Thushani-Jayasekera,
VirajSalaka,
ashera96,
chamilaadhi,
dushaniw,
hisanhunais,
lasanthaS,
malinthaprasan,
pubudu538,
renuka-fernando,
senthuran16,
tgtshanika,
tharikaGitHub and
tharindu1st
as code owners
July 24, 2026 07:22
Contributor
📝 WalkthroughWalkthroughGateway Basic Auth is now provisioned through ChangesGateway security and key provisioning
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 2 | ❌ 3❌ Failed checks (3 warnings)
✅ Passed checks (2 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 16
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ai-workspace-pr-check.yml:
- Around line 59-61: Remove the fixed admin/admin credential from the workflow
setup described by the surrounding comments. Update the adjacent setup
invocation to generate a unique password per run, pass that value through the
job environment or Cypress configuration, and revise the documentation so it no
longer advertises reusable credentials.
In `@common/authenticators/authn.go`:
- Around line 82-83: Update the no-auth configuration branch in the
authenticator initialization flow around the warning log to require an explicit
development/test opt-out before permitting unauthenticated admin access. If that
opt-out is absent, fail startup instead of continuing; preserve the warning only
for the explicitly permitted opt-out path and ensure authentication remains fail
closed by default.
In `@distribution/all-in-one/docker-compose.yaml`:
- Around line 106-117: Update the initialization flow around the existing
jwt_private.pem, jwt_public.pem, and encryption.key checks so each missing
artifact is generated independently without overwriting an existing JWT keypair.
Preserve existing JWT files when present, generate only absent files, and always
apply the required ownership and 0600 modes afterward to the generated or
existing private/encryption keys.
In `@docs/ai-gateway/mcp/quick-start-guide.md`:
- Around line 58-61: Add a trailing backslash to the curl command in the
quick-start example so the following heredoc and --data-binary argument remain
part of the same command.
In `@docs/ai-workspace/features/secrets-management.md`:
- Around line 350-351: Update the preceding encryption-key configuration
guidance to make the setup-provisioned mounted file at
resources/keys/encryption.key the Docker Compose default. Reframe
APIP_CP_ENCRYPTION_KEY as an alternative configuration path rather than a
required, never-auto-generated variable, and ensure the instructions match what
the shipped Compose config reads.
In `@event-gateway/docker-compose.test.postgres.yaml`:
- Around line 60-61: Remove the hardcoded values from
APIP_GW_CONTROLLER_AUTH_BASIC_ADMIN_USERNAME and
APIP_GW_CONTROLLER_AUTH_BASIC_ADMIN_PASSWORD_HASH in the test Compose
configuration. Require both credentials to come from externally supplied or
generated environment values, configured so startup fails when either is absent.
In `@event-gateway/docker-compose.test.sqlserver.yaml`:
- Around line 80-81: Remove the hardcoded admin username and bcrypt password
hash from the test SQL Server compose configuration, and require both values
through environment-variable substitution without functional defaults. Update
the relevant APIP_GW_CONTROLLER_AUTH_BASIC_ADMIN_USERNAME and
APIP_GW_CONTROLLER_AUTH_BASIC_ADMIN_PASSWORD_HASH entries while preserving the
existing variable names expected by the gateway.
In `@gateway/distribution/README.md`:
- Around line 45-47: Update the startup-failure statement in
gateway/distribution/README.md lines 45-47 to state that the controller refuses
to start without credentials only when Basic Auth is enabled; apply the same
qualification to the corresponding statement in gateway/README.md lines 47-49,
keeping both READMEs consistent.
In `@gateway/gateway-controller/pkg/config/config.go`:
- Around line 1894-1904: Update the Basic Auth validation in
gateway/gateway-controller/pkg/config/config.go around the enabled-auth check to
return a startup error when len(c.Controller.Auth.Basic.Users) is zero, while
preserving validation of empty usernames or passwords for configured users. Add
or update the corresponding validator test in
gateway/gateway-controller/pkg/config/validator_test.go to assert that enabled
Basic Auth with no users is rejected.
In `@platform-api/config/config-template.toml`:
- Around line 39-41: Correct the encryption-key setup guidance near the
`encryption_key` configuration: either change the empty `encryption_key` value
to use the documented `file` interpolation token for
`/etc/platform-api/keys/encryption.key`, or revise the preceding instructions to
tell users to replace the empty value manually. Ensure the template instructions
match the actual configuration behavior.
In `@portals/ai-workspace/distribution/README.md`:
- Line 44: Add resources/keys/encryption.key to the setup-output table in the
README, alongside the other generated and persisted secrets, and describe it as
the Platform API encryption key that must be retained.
In `@portals/ai-workspace/setup.sh`:
- Around line 130-135: Update the encryption key setup in setup.sh to avoid
world-readable permissions: replace the 644 mode on "$KEYS_DIR/encryption.key"
with a restrictive service-readable ownership and mode, such as 640 with the
appropriate group or 600 when the container UID owns the file. Preserve
readability by the Platform API service.
- Around line 130-134: The provisioning block that writes encryption.key must
preserve an existing key across setup reruns. Update the openssl generation
around KEYS_DIR/encryption.key to create the file only when absent, while
retaining the existing key; allow replacement only through the explicit
force/rotation path documented in the workspace README.
In `@samples/ai-app-claude-code/setup.sh`:
- Around line 73-76: Remove all admin/admin credential fallbacks and references.
In samples/ai-app-claude-code/setup.sh lines 73-76, require or use
explicit/generated credentials and recompute AUTH_HEADER after they are
available; also remove its Basic Auth fallback at line 14. Update
docs/gateway/kubernetes/gateway-operator.md lines 712-723 and
docs/gateway/kubernetes/kubernetes-standalone.md lines 206-217 to describe
provisioned credentials instead of chart-default admin/admin values. In
samples/ai-agent-with-mcp/configure-gateway.sh line 25,
samples/ai-app-claude-code/teardown.sh line 12,
samples/ai-gw-llm-proxy/inject-mock.sh line 27, and
samples/ai-gw-mcp-claude-desktop/inject-mock.sh line 26, require or source
explicit/generated credentials rather than silently defaulting.
In `@samples/llm-cost-control-and-privacy-control/setup.sh`:
- Line 14: Strip carriage returns and newlines from the base64 output used to
build AUTH_HEADER, ensuring long credentials remain on one line. Apply this
change at the AUTH_HEADER assignments in
samples/llm-cost-control-and-privacy-control/setup.sh (14-14),
samples/llm-cost-control-and-privacy-control/teardown.sh (12-12),
samples/prompt-decorator-policy/setup.sh (14-14), and
samples/prompt-decorator-policy/teardown.sh (12-12).
- Around line 151-154: Remove all known default administrative credentials and
require securely supplied credentials throughout the affected setup, teardown,
workflow, documentation, and skill instructions. In
samples/llm-cost-control-and-privacy-control/setup.sh lines 151-154 and
samples/prompt-decorator-policy/setup.sh lines 80-83, eliminate admin/admin
fallbacks; in both setup.sh line 14 sites and teardown.sh line 12 sites, require
and reuse credential variables for authentication and cleanup. Replace
perf-admin in .github/workflows/perf-gateway.yml lines 13-16 with a masked
secret or per-run credential, update .agents/skills/gateway-debug/SKILL.md lines
120-128 and 383 to describe variable-based authentication, and remove documented
admin/admin defaults from both README sites.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 491fc384-c122-496a-a8ed-38dd24fa5d4e
📒 Files selected for processing (66)
.agents/skills/gateway-debug/SKILL.md.agents/skills/gateway-integration-tests/SKILL.md.github/workflows/ai-workspace-pr-check.yml.github/workflows/perf-gateway.ymlcommon/authenticators/authn.godistribution/all-in-one/docker-compose.yamldocs/ai-gateway/llm/guardrails/aws-bedrock-guardrail.mddocs/ai-gateway/llm/guardrails/azure-content-safety.mddocs/ai-gateway/llm/guardrails/content-length.mddocs/ai-gateway/llm/guardrails/json-schema.mddocs/ai-gateway/llm/guardrails/pii-masking-regex.mddocs/ai-gateway/llm/guardrails/regex.mddocs/ai-gateway/llm/guardrails/semantic-prompt-guard.mddocs/ai-gateway/llm/guardrails/sentence-count.mddocs/ai-gateway/llm/guardrails/url.mddocs/ai-gateway/llm/guardrails/word-count.mddocs/ai-gateway/llm/llm-templates.mddocs/ai-gateway/llm/load-balancing/model-round-robin.mddocs/ai-gateway/llm/load-balancing/model-weighted-round-robin.mddocs/ai-gateway/llm/prompt-management/prompt-decorator.mddocs/ai-gateway/llm/prompt-management/prompt-template.mddocs/ai-gateway/llm/quick-start-guide.mddocs/ai-gateway/llm/semantic-caching.mddocs/ai-gateway/mcp/quick-start-guide.mddocs/ai-workspace/configuration.mddocs/ai-workspace/features/secrets-management.mddocs/gateway/bottom-up-api-deployment-guide.mddocs/gateway/kubernetes/gateway-operator.mddocs/gateway/kubernetes/kubernetes-standalone.mddocs/gateway/quick-start-guide.mdevent-gateway/docker-compose.test.postgres.yamlevent-gateway/docker-compose.test.sqlserver.yamlgateway/README.mdgateway/configs/config-template.tomlgateway/configs/config.tomlgateway/distribution/README.mdgateway/docker-compose.yamlgateway/gateway-controller/README.mdgateway/gateway-controller/authentication.mdgateway/gateway-controller/pkg/config/config.gogateway/gateway-controller/pkg/config/interpolate_test.gogateway/gateway-controller/pkg/config/validator_test.gogateway/perf/create_apis_and_capture_stats.shgateway/scripts/setup.shplatform-api/README.mdplatform-api/config/config-template.tomlplatform-api/config/config.tomlplatform-api/config/config_test.goportals/ai-workspace/README.mdportals/ai-workspace/distribution/README.mdportals/ai-workspace/production/README.mdportals/ai-workspace/setup.shportals/developer-portal/distribution/README.mdportals/developer-portal/docker-compose.platform-api.yamlportals/developer-portal/scripts/setup.shsamples/ai-agent-with-mcp/configure-gateway.shsamples/ai-app-claude-code/setup.shsamples/ai-app-claude-code/teardown.shsamples/ai-gw-llm-proxy/inject-mock.shsamples/ai-gw-mcp-claude-desktop/inject-mock.shsamples/llm-cost-control-and-privacy-control/README.mdsamples/llm-cost-control-and-privacy-control/setup.shsamples/llm-cost-control-and-privacy-control/teardown.shsamples/prompt-decorator-policy/README.mdsamples/prompt-decorator-policy/setup.shsamples/prompt-decorator-policy/teardown.sh
renuka-fernando
approved these changes
Jul 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Two related fixes that stop shipping guessable/hardcoded secrets and move them to provisioned, interpolated sources:
Neither service ships a usable default secret anymore; both fail closed if the secret is absent.
Fix 1 — Remove hardcoded admin:admin from the gateway-controller
Problem
gateway/configs/config.toml shipped a functional admin/admin basic-auth user, and every example/curl embedded Authorization: Basic YWRtaW46YWRtaW4=. A default credential present in every install is effectively no authentication.
Change
username = '{{ env "APIP_GW_CONTROLLER_AUTH_BASIC_ADMIN_USERNAME" "" }}'
password = '{{ env "APIP_GW_CONTROLLER_AUTH_BASIC_ADMIN_PASSWORD_HASH" "" }}'
Fix 2 — Platform API: read the encryption key from a file, not an env var (closes #2835)
Problem
platform_api.security.encryption_key used {{ env "APIP_CP_ENCRYPTION_KEY" }}, forcing operators to generate and paste the key into an environment variable.
Change
encryption_key = '{{ file "/etc/platform-api/keys/encryption.key" }}'