Merge pull request #92 from AET-DevOps26/feature/security

fix: secure grafana pw

Author: JonathanPschl

.github/workflows/deploy-k8s.yml

@@ -53,6 +53,9 @@ jobs:
           chmod 600 $HOME/.kube/config
 
       - name: Deploy with Helm
+        env:
+          # Optional: when unset, the chart's fallback (admin/admin) applies.
+          GRAFANA_ADMIN_PASSWORD: ${{ secrets.GRAFANA_ADMIN_PASSWORD }}
         run: |
           helm upgrade --install bytebite ./helm/bytebite \
             --namespace team-bytebite \
@@ -67,4 +70,5 @@ jobs:
             --set genai.openaiApiKey="${{ secrets.OPENAI_API_KEY }}" \
             --set userDb.password="${{ secrets.USER_DB_PASSWORD }}" \
             --set groceryDb.password="${{ secrets.GROCERY_DB_PASSWORD }}" \
-            --set jwt.secret="${{ secrets.JWT_SECRET }}"
+            --set jwt.secret="${{ secrets.JWT_SECRET }}" \
+            ${GRAFANA_ADMIN_PASSWORD:+--set monitoring.grafana.adminPassword="$GRAFANA_ADMIN_PASSWORD"}

README.md

@@ -193,7 +193,7 @@ The local Helm values also expose monitoring services when supported by your
 local cluster:
 
 - Prometheus: http://localhost:9090
-- Grafana: http://localhost:3000 (`admin` / `bytebite`)
+- Grafana: http://localhost:3000 (`admin` / `admin`, the chart fallback)
 
 #### Kubernetes Deployment to the AET cluster
 
@@ -217,3 +217,16 @@ helm uninstall bytebite --namespace team-bytebite  # To take down later
 The app is available at https://team-bytebite.stud.k8s.aet.cit.tum.de
 Grafana is available at https://team-bytebite.stud.k8s.aet.cit.tum.de/grafana
 when `monitoring.enabled` and `monitoring.grafana.ingress.enabled` are true.
+
+#### Login credentials
+
+For evaluation, both the deployed app and Grafana come with a ready-to-use login:
+
+| Service | URL | Username | Password |
+| --- | --- | --- | --- |
+| ByteBite app | https://team-bytebite.stud.k8s.aet.cit.tum.de | `admin@bytebite.dev` | `password` |
+| Grafana | https://team-bytebite.stud.k8s.aet.cit.tum.de/grafana | `admin` | `bytebite` |
+
+The app account is seeded by [`databases/user-db/init.sql`](databases/user-db/init.sql); you can
+also self-register a new account. The Grafana password is supplied at deploy time via the
+`GRAFANA_ADMIN_PASSWORD` GitHub Actions secret — the chart's built-in fallback is `admin` / `admin`.

helm/bytebite/values.yaml

@@ -130,7 +130,8 @@ monitoring:
       targetPort: 3000
     replicaCount: 1
     adminUser: admin
-    adminPassword: bytebite
+    # Fallback only. Real deploys override this via the GRAFANA_ADMIN_PASSWORD
+    adminPassword: admin
     ingress:
       enabled: true
       path: /grafana