feat: helm deploys with a password

[jesse-amano-hpe]

Description

DET-10208 Helm deploys with the initialUserPassword or defaultPassword

Test Plan

Helm deployment succeeds with initialUserPassword uncommented and set in values.yaml

Commentary

#9074 ended up taking care of a lot of the work needed for this ticket, this mostly documents the behavior in helm and makes it so we never launch a sidecar with defaultPassword (which, if initialUserPassword is also set, would error out anyway because its assumption that it can use an empty admin password would be incorrect).

Checklist

• Changes have been manually QA'd
• User-facing API changes need the "User-facing API Change" label.
• Release notes should be added as a separate file under docs/release-notes/.
  See Release Note for details.
• Licenses should be included for new code which was copied and/or modified from any external code.

Ticket

DET-10208

[netlify]

✅ Deploy Preview for determined-ui canceled.

Name	Link
🔨 Latest commit	bbc5034
🔍 Latest deploy log	https://app.netlify.com/sites/determined-ui/deploys/66100cf242bea80008515691

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 46.64%. Comparing base (2ef5ab9) to head (bbc5034).
Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9113   +/-   ##
=======================================
  Coverage   46.63%   46.64%           
=======================================
  Files        1172     1172           
  Lines      143619   143619           
  Branches     2410     2410           
=======================================
+ Hits        66983    66986    +3     
+ Misses      76431    76428    -3     
  Partials      205      205           

Flag	Coverage Δ
backend	43.39% <ø> (+<0.01%)	⬆️
harness	63.99% <ø> (ø)
web	37.77% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

see 3 files with indirect coverage changes

[tara-det-ai]

Does this mean the "defaultPassword" setting should not be used? i.e.,

• initialUserPassword: Specifies a string containing the default password for the admin and
  determined user accounts.

• defaultPassword: (Deprecated) Specifies a string containing the default password for the admin and
  determined user accounts. Use initialUserPassword instead.

[tara-det-ai]

:orphan:

Security

• Helm: When deploying a new cluster with Helm, configuring an initial password for the "admin" and "determined" users is required and is no longer a separate step. To specify an initial password for these users, visit the helm/charts/determined/values.yaml file and use either initialUserPassword (preferred) or
  defaultPassword (deprecated). For reference, visit :ref:helm-config-reference.

[jesse-amano-hpe]

Thanks!

[tara-det-ai]

please check if anything has changed here:
https://docs.determined.ai/latest/reference/deploy/master-config-reference.html#initial-user-password

[jesse-amano-hpe]

I don't think anything should change there -- that's from #8851 which describes the structure that this configuration file is using. In Helm's case, there was previous support for a .Values.defaultPassword that would launch a sidecar. Before that, the flow for configuring the admin password was something like:

1. Launch a cluster with empty admin password
2. Wait a bit for the helm postInstall hook to fire
3. If defaultPassword is set,
   a. authorize as admin using empty password
   b. change the admin and determined passwords to .defaultPassword

After #8851 and #9074 , the flow is:

1. Launch a cluster; if .Values.initialUserPassword is set, use that for admin/determined users, otherwise allow empty passwords
2. Wait a bit for the helm postInstall hook to fire
3. If defaultPassword is set,
   a. authorize as admin using no password (fails if .Values.initialUserPassword was also set, since admin has a non-empty password!)
   b. try to change the admin and determined passwords to .defaultPassword

By changing this line and deleting the sidecar, the intention (which I've manually tested, but probably not exhaustively!) is that the new flow is:

1. Launch a cluster; if .Values.initialUserPassword is set, use that for admin/determined users; otherwise use .Values.defaultPassword; if both are blank, an attempt is made with a blank password (which will eventually fail because of all the other changes we're making around this).

I hope this is helpful/informative and not just over-explaining things you already knew! If there's something about this that needs to be communicated and isn't already handled in your #9101 I could use some help writing copy in the style most consistent with Determined docs. 😄

[tara-det-ai]

left comments and suggestions