OSS Admin - rotate credentials

[Isan-Rivkin]

The problem

Currently in when using OSS (No ACL) there is no sane way on how to rotate the single admin credentials.
In cases of credentials leak or lost there one would need to rotate those credentials, without this option it's hard to rely on the server for long term.

Expected new behavior

Introduce (and document) a way rotating credentials.
To be clear, there's is single user - rotate those credentials (i.e admin with a single set of creds).
Can reuse $lakefs superuser and in the backend allow setting credentials.

[itaiad200]

@talSofer need a better understanding of the requirements. Do we need to rotate or replace the admin creds?

[Isan-Rivkin]

@talSofer need a better understanding of the requirements. Do we need to rotate or replace the admin creds?

@talSofer I'd like to add to Itai's question some context:

We have replace credentials already, it's just not documented but pretty straight forward (and easy!).
The downside of replace (single pair of credentials allowed) is down-time to lakeFS users while doing this until all the users update to use the new credential set.

Rotate does not exist and it means allowing 2 pairs of credentials and allowing users to essentially rotating them on the fly and gradually replacing for clients using one or the other.

A note about lost credentials: we don't have a way of overriding credentials unless you delete the user but, to delete the user you need the credentials (so essentially you're locked out). I think this is an acceptable tradeoff in terms of security. Otherwise anyone with access to lakeFS server binary will be able to replace the user.

With that in mind, when I created the issue I wasn't aware of replace.
We can simply update the documentation for replace in lakeFS or extend and develop rotation.

WDYT?

[talSofer]

@Isan-Rivkin thanks for elaborating on this.
I prefer to do credentials replacement, but have two clarification questions:

1. What's the current (undocumented) way of doing this?
2. Does your note about lost credentials mean we can only replace the secret access key, and not the access key?