Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1t0ERi-00A9yT-Iq for pgadmin-support@arkaria.postgresql.org; Mon, 14 Oct 2024 06:20:46 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1t0ERg-00AUEv-Oy for pgadmin-support@arkaria.postgresql.org; Mon, 14 Oct 2024 06:20:45 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1t0ERg-00AUE8-EW for pgadmin-support@lists.postgresql.org; Mon, 14 Oct 2024 06:20:44 +0000 Received: from mail-yw1-x1133.google.com ([2607:f8b0:4864:20::1133]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94.2) (envelope-from ) id 1t0ERc-000xYe-LC for pgadmin-support@lists.postgresql.org; Mon, 14 Oct 2024 06:20:44 +0000 Received: by mail-yw1-x1133.google.com with SMTP id 00721157ae682-6e330b7752cso24026897b3.1 for ; Sun, 13 Oct 2024 23:20:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=enterprisedb.com; s=google; t=1728886839; x=1729491639; darn=lists.postgresql.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=HlTQ/nOtULgv4DUA5X1UETswCEbdFPt34aAShS0Oh+A=; b=D1UHXg87ZYRl+EMbrtRbYy6UZbf9RbCG14cPjoXSckPlJ32/NGWQLBRJcTmmKp7Xbq GQy+5HXympfVYeZhCgwvbMCtx/snCziwqxt7ZeyisgqojwmjtcaZjcdKRXNw1aCl/P8P 6izuSPRzFBKpR8kIUxBSIsSEBgI+szKWYmgMjpYu3xWyuU/L0gAaT6MTERquqoLANenX SxjVUMCFOOWDgB/0Uv0mfXGM3UWnzYNBikqjCSasSFc1Y8BvFzWfXHyQoRUfM3dIPoSd gZcADR9CdE/2sRVi9zIDd9ghUPTluAeji5DILZhjrWXHZDAPJUCFA/mAhAw426vpL8zg 0qfQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1728886839; x=1729491639; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=HlTQ/nOtULgv4DUA5X1UETswCEbdFPt34aAShS0Oh+A=; b=UKWxY06J5arbh3wqA+Vjyv6jZYeE+IqgPwkqA9zlXeaP25M3cytcocB7NTX/uKXq5C AIRR28QMbB8x/7QjDhDEMNMn8lAOKX5aQqwDEd1h0xlq+W+e6GI20PcH/2xs6nzVmfW9 QATolLHF5Z7m5wkb2Gmu6pmwC03zieTWb8Fli+SJclpO4xVaXmtWjLeWlGsnKDp8ljHE O4dYlW+F+t6ce9lode/+vao1tj+jxup4Y9gi4SI5NHVrR77T09aNgfzFEyMrtnY+U+ul KYb9VfHBCN4SittnjwsAN7cd9cnaShrPXy8KlZQetSe+cKF0BWuxDE1g4g/EG7U/B5WX gfPA== X-Gm-Message-State: AOJu0Ywd7pRaIMGgkeG8E16wIARK7czThKTPeepcIZ2D60gAiOph+RTX vQv3wO59vK2jLdBRQLTGyX5i2fETK7QBs3bMPqiTzu3pSeDVaH6WIQtRSUK8AP5KNlKA4v5LPgs KdXLpEzSwS5zrHBfdoO12T3SPYKM05yVnvIgz X-Google-Smtp-Source: AGHT+IEMlvnd1SET127BUPMw8IXbShdpTI+9/wfSQGT4naZEqYnXuXGYkvPCE/YeDZYyuoG5Xrxfi/S051+V7wWvbC4= X-Received: by 2002:a05:690c:55c4:b0:6e2:93ae:7d6a with SMTP id 00721157ae682-6e344ccb1edmr56954977b3.14.1728886839473; Sun, 13 Oct 2024 23:20:39 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Khushboo Vashi Date: Mon, 14 Oct 2024 11:50:28 +0530 Message-ID: Subject: Re: pgAdmin in Kubernetes vs master password To: Morten Bonnerup Rasmussen Cc: "pgadmin-support@lists.postgresql.org" Content-Type: multipart/related; boundary="000000000000ecb186062469d5d3" List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --000000000000ecb186062469d5d3 Content-Type: multipart/alternative; boundary="000000000000ecb185062469d5d2" --000000000000ecb185062469d5d2 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, Oct 11, 2024 at 2:00=E2=80=AFPM Morten Bonnerup Rasmussen < morten.rasmussen@bestseller.com> wrote: > Hi > > We are working on offering pgAdmin as a centrally managed tool to our > developers. > It is deployed in Kubernetes, based on this guide, with OAUTH2 enabled > (Entra ID): > Deploying pgAdmin on Kubernetes | EDB (enterprisedb.com) > > > But when the service is restarted, we get the master password prompt. > I get this and can provide it. But if one of our developers is the first > one to connect and they are prompted, this becomes problematic. They have > no idea what the master password is. > > If you are using pgAdmin in web based multiuser mode with OAuth2, we woul= d recommend to use the master password and the reasons are mentioned here: https://www.pgadmin.org/docs/pgadmin4/8.12/master_password.html You can share this documentation with your developers to understand the importance of it. What is the best way to manage this challenge? > We could disable usage of master password, but it looks like this would > reduce security. > Is it not possible to save it as a secret and provide as a parameter > during startup, similar to the default pgadmin user/password? > > > > MORTEN BONNERUP RASMUSSEN > > TECH RELIABILITY SERVICES / SPECIALIST > > P > > > +4599423174 > > M > > > +4530853174 > > E > > > MORTEN.RASMUSSEN@BESTSELLER.COM > > W > > > BESTSELLER.COM > > BESTSELLER A/S > > FREDSKOVVEJ 1, 7330 BRANDE > > DENMARK > > > > > --000000000000ecb185062469d5d2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, Oct 11, 2024 at 2:00=E2=80=AF= PM Morten Bonnerup Rasmussen <morten.rasmussen@bestseller.com> wrote:
You can share this documenta= tion=C2=A0with your developers to understand the importance of it.

What is the best way to manage this challenge?
We could disable usage of master password, but it looks like this would red= uce security.
Is it not possible=C2=A0to save it as a secret and provide as a parameter d= uring startup, similar to the default pgadmin user/password?



MORTEN BONNERUP RASMUSSEN

TECH RELIABILITY SERVICES =C2=A0 / =C2=A0 SPECIALIST

P

 =C2=A0

+4599423174

M

 =C2=A0

+4530853174

E

 =C2=A0

MORTEN.RASMUSSEN@BESTSELLER.COM<= /a>

W

 =C2=A0

BESTSELLER.COM

BESTSELLER A/S

FREDSKOVVEJ 1, 7330 BRANDE

DENMARK



=C2=A0
--000000000000ecb185062469d5d2-- --000000000000ecb186062469d5d3 Content-Type: image/png; name="u72xn3tdbm9ocd13img_O6hRpn64oQHurSjbv3.png" Content-Disposition: inline; filename="u72xn3tdbm9ocd13img_O6hRpn64oQHurSjbv3.png" Content-Transfer-Encoding: base64 Content-ID: X-Attachment-Id: ii_19289a9f4bfd46a0faa1 iVBORw0KGgoAAAANSUhEUgAAAPEAAAASCAYAAACKGzglAAAACXBIWXMAAAsSAAALEgHS3X78AAAG eklEQVR4nO2c3XHjNhDHf86YY7zZHZgdnDoQrwL7KhCvAisVnFyBlQpCV3ByBaYriK6CyBVEesMM H5IHLE4QRYCgZEqWL/8ZjQUKXCwX2A/sgj47v7hIgZxtLICy0nrR8NsWEqVyIG3ptqi0LlropMAE yIBr4BWYA9NK63LP8X+i0noSoJUBY+HhEvghPExi5JEo5aXtoGx5npT1vAT7eu7PWcujiJ1Hz/he hOQodHy/l8C80nrZha9TgMgulWbvz3h2fnGRAc+BPi/AbRsjiVIlMGwZ76XSOgvQGGAm99LT5Y9K 6/Ee4/9EpfWZh04O/Om5bQWMIwzRvxEs3EcYkueYvp77S9by+LyDEXDH98InR4dOmyy8c7oDrTq8 660DreCadeilGOdzy/b6XQEzAk5AjN23trGb+D5vYw6zEGYYr9QbEqWu2FbgH8Anp32XKDXruiA7 8JCxqcArYImJCBDepsLDh/MgR8JdotSyg5FaAVOnnWHW6CMmerRoMwxfMJHGDcZRlQ19Yo1Lznrd WFolxhunGMUeyffMQ6bArLWJtCcenr4IX0PgCSjqSvwoxJDBrGUYJkoNKq3noYdx8Dsm/KwjtPBd C/YKZJXWiwbvnOMX+JXTHgAP8t19rhBy5/sTkFdaL2uTdCm8xtAD+Oy5voi8/z0gVn5tsLK4wixS a6BvWS/eNhSuwosHG8r10rmehYhUWs8SpZYYJS6bjEgbDelzi1kbK0zEWjb0mQL/tPCzwDiIW2lP Pf1mohNDZItZV+KFw0Qp3vFO2lfEY76Dt0yd7z/3cJXWc3mwzPLYdHPdwCRKuc1FJD8uD1PrbSut C6Fnf2/kwcNXzLjvHbHyC6KmZHPgb2l+arxhGz6P2YQZHXIkHkwJrHvRj0Kamc/JiSP4sScvXrSF 08cKGTcEJ5NfHpmH4sDjf2hIlGWbq8h7sg70Gz1ZF1Raz1q62OjxMSJKzfflx4ffWn7PnO99K7Qr sNyGFQeGy8NEwpb/0QNq81sei489kcnfVoNRaT3vsB3thLonzmSPcYWxMjah89SRgbxhPxEsL0nY /ITZo1wC3xOlXjECKg6USCowe+trTIj3V6LUi1zfKZnlKbF0LvkcGVnTc+yQMbf9B5h5BuOFO9F5 R0hheyt3aNSVeMh2meaVyCydg1HDNasMIeSYCbX78GtMcuohUeoRU97pTZll75Jh+LRysDKZJkpN uy5ctssGYDzPYicmj4OmdQHdlW+rhIKZ06MqAc1OB4yxLQ7MC5hEcnQ5LabEdA3MEqWyvr2h0B9L Ni+Xj40GRsCgbz7EQ2YSSo9Z73sugW+JUmmldd7X+L8YUk7LmB0Kr4QdXoZjVOtKfF9pPZGs2y0m lL3EhJZWsWLQ+XCBC1GkCWZfmu/Bx84Q75CLLMasvcgoUaqMtdBthyFOBJ0Pm3jwmc3y0jUHms8W FG/0fG+FRctBoAmOEjcmtiqtl7JI3eTDMRJNHJsPkcUEuD8WDx8FldalZHxd+Y3EUJ4iFhBXT+4T wex0zZv6jkK+CRKlBolSmXzSY/DhjJ81LCyXh1NddO8CEmk9OpdO1SiW8jdv65golfZV7Qgq8YFL LFPMWd1naom0ulL3iGfnk9V+OxQPvwo2SorHYiIEUbwyoAczTHZ9FKErUyJKUbugvidOndBgwGb2 8aUD3UHtxJTFMpCJnLOO8+8SpRaYzX3K5ia/t5MvbJ7VLhKlcjnmZvMDLq9RCIRaiw5lptRHJzL3 sMt8vOX4TffNEqVWmMhqKAnDxS60ekSKWZONkZdUMyaYCkqZKNV47NKh1UtCtq7EI5rLQ9DNijx4 rr/gPwBuExw2XH7w0OnFmgkmwHf5bmvVTf268OB7E+ie+BJNaF5iEme7zMdbju9DybpeXDeUQYhh HbAOxcdiaOYRJ63s/bk0G+vgRIT5ldZT8cIj4FnOFZQYQ5+yPnPxiYAjlGjTPpNNXs0ajhPnrOds nCiVxpSY7Ot3rYLZB3IMLyP8KuJjn3U78Q5f8b+KCPD1HXqMU8WMtRLndDOO32vtG4dWjGFx7/fV waNQaZ0nShWYbeBNA61XTA5gEiCTs1lH/4ZR1qzWz12bN8DN2fnFhbUUaa3zkg4vMog1akv4tIZv Tkknwwgj6p8CeOjYfUqX0NV9N3SAsaBd/ylAFjFMkKca/174ZLLvfOw7vkMn8/Wtj/FBXhZx/ylA 7HZlL/wHf0D1oTZSnNYAAAAASUVORK5CYII= --000000000000ecb186062469d5d3--