feat: store kibana secrets

[shemau]

Description

Store kibana account secrets in secrets manager, when secrets manager is supplied to a deployable architecture.

#529

Release required?

• No release
• Patch release (x.x.X)
• Minor release (x.X.x)
• Major release (X.x.x)

Release notes content

Run the pipeline

If the CI pipeline doesn't run when you create the PR, the PR requires a user with GitHub collaborators access to run the pipeline.

Run the CI pipeline when the PR is ready for review and you expect tests to pass. Add a comment to the PR with the following text:

/run pipeline

Checklist for reviewers

• If relevant, a test for the change is included or updated with this PR.
• If relevant, documentation for the change is included or updated with this PR.

For mergers

• Use a conventional commit message to set the release level. Follow the guidelines.
• Include information that users need to know about the PR in the commit message. The commit message becomes part of the GitHub release notes.
• Use the Squash and merge option.

[shemau]

Some TODO: remain in the variable validation sections.

[shemau]

From the fully configurable test:

 2025/10/15 09:42:26 Terraform apply |   # module.secrets_manager_service_credentials[0].module.secrets["els-fc-da-u3i-kibana-app-password"].ibm_sm_arbitrary_secret.arbitrary_secret[0] will be created
 2025/10/15 09:42:26 Terraform apply |   + resource "ibm_sm_arbitrary_secret" "arbitrary_secret" {
 2025/10/15 09:42:26 Terraform apply |       + created_at        = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + created_by        = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + crn               = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + custom_metadata   = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + downloaded        = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + endpoint_type     = "private"
 2025/10/15 09:42:26 Terraform apply |       + id                = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + instance_id       = "79c6d411-c18f-4670-b009-b0044a238667"
 2025/10/15 09:42:26 Terraform apply |       + labels            = []
 2025/10/15 09:42:26 Terraform apply |       + locks_total       = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + name              = "els-fc-da-u3i-kibana-app-password"
 2025/10/15 09:42:26 Terraform apply |       + payload           = (sensitive value)
 2025/10/15 09:42:26 Terraform apply |       + region            = "us-south"
 2025/10/15 09:42:26 Terraform apply |       + retrieved_at      = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + secret_group_id   = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + secret_id         = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + secret_type       = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + state             = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + state_description = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + updated_at        = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + versions_total    = (known after apply)
 2025/10/15 09:42:26 Terraform apply |     }
 2025/10/15 09:42:26 Terraform apply | 
 2025/10/15 09:42:26 Terraform apply |   # module.secrets_manager_service_credentials[0].module.secrets["els-fc-da-u3i-kibana-system-password"].ibm_sm_arbitrary_secret.arbitrary_secret[0] will be created
 2025/10/15 09:42:26 Terraform apply |   + resource "ibm_sm_arbitrary_secret" "arbitrary_secret" {
 2025/10/15 09:42:26 Terraform apply |       + created_at        = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + created_by        = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + crn               = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + custom_metadata   = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + downloaded        = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + endpoint_type     = "private"
 2025/10/15 09:42:26 Terraform apply |       + id                = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + instance_id       = "79c6d411-c18f-4670-b009-b0044a238667"
 2025/10/15 09:42:26 Terraform apply |       + labels            = []
 2025/10/15 09:42:26 Terraform apply |       + locks_total       = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + name              = "els-fc-da-u3i-kibana-system-password"
 2025/10/15 09:42:26 Terraform apply |       + payload           = (sensitive value)
 2025/10/15 09:42:26 Terraform apply |       + region            = "us-south"
 2025/10/15 09:42:26 Terraform apply |       + retrieved_at      = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + secret_group_id   = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + secret_id         = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + secret_type       = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + state             = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + state_description = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + updated_at        = (known after apply)
 2025/10/15 09:42:26 Terraform apply |       + versions_total    = (known after apply)
 2025/10/15 09:42:26 Terraform apply |     }

The kibana system and app login password secrets are added as secrets manager secrets.

[shemau]

During a manual run the secrets were intercepted in secrets manager and had expected random values in them.

[shemau]

/run pipeline

[daniel-butler-irl]

@shemau looks good, but are upgrades safe? I think so just double checking

[shemau]

It is safe upgrading with no migration issues. The original secret is still in the secrets array. The two passwords already exist and remain unchanged, they are just added to the secrets array. The upgrade (assuming kibana is on AND a secret manager CRN is passed) will just add two new secret resources.

[shemau]

/run pipeline

[shemau]

This change does not include any password generation rules. It fails with

         2025/10/20 10:13:53 Terraform plan |   + admin_pass = (sensitive value)
         2025/10/20 10:13:53 Terraform plan | 
         2025/10/20 10:13:53 Terraform plan | Error: database user (admin) validation error:
         2025/10/20 10:13:53 Terraform plan | password must contain at least one lower case letter

re-running to see if this always happens, or if there is intermittent issue with a very small chance that all 32 characters are not lower case.

[shemau]

/run pipeline

[terraform-ibm-modules-ops]

🎉 This PR is included in version 2.4.0 🎉

The release is available on:

• GitHub release
• v2.4.0

Your semantic-release bot 📦🚀