Insecure defaults and lack of customization of JWT secret leads to insecure authentication settings in reaper

[gugu]

What happened?

During debug of another bug I noticed that JWT secret of my reaper installation is default MySecretKeyForJWTWhichMustBeLongEnoughForHS256Algorithm, which makes authentication useless.

Did you expect to see something different?

I expect random jwt secret generated instead of default one

How to reproduce it (as minimally and precisely as possible):

Check JWT secret of default authenticated installation of k8ssandra-operator’s reaper

Environment

• K8ssandra Operator version:

  Insert image tag or Git SHA here

• Kubernetes version information:

  kubectl version

• Kubernetes cluster kind:

  insert how you created your cluster: kops, bootkube, etc.

• Manifests:

insert manifests relevant to the issue

• K8ssandra Operator Logs:

insert K8ssandra Operator logs relevant to the issue here

Anything else we need to know?:

[burmanm]

Hey, k8ssandra-operator does not indeed expose JWT settings. But you can modify this JWT secret through AdditionalEnvVars in the Reaper's CRD section. Just add there JWT_SECRET and it should end up rendered in the Reaper's configuration.

[gugu]

Yes, but I noticed this during reaper JWT token debug. I expect there are some installations where users expect their authentication to authenticate. From the software design point of view I'd like to propose either to add proper documentation or random env generator.

Also, AdditionalEnvVars is not the best storage for secrets, secrets are better suited for this