Generate random password for Grafana (#2289)

src/_nebari/stages/kubernetes_services/template/modules/kubernetes/services/monitoring/main.tf

@@ -1,3 +1,8 @@
+resource "random_password" "grafana_admin_password" {
+  length  = 32
+  special = false
+}
+
 resource "helm_release" "prometheus-grafana" {
   name       = "nebari"
   namespace  = var.namespace
@@ -176,6 +181,9 @@ resource "helm_release" "prometheus-grafana" {
           "${var.node-group.key}" = var.node-group.value
         }
 
+        # Avoid using the default password, as that's a security risk
+        adminPassword : random_password.grafana_admin_password.result
+
         sidecar = {
           dashboards = {
             annotations = {

tests/tests_deployment/test_grafana_api.py

@@ -0,0 +1,18 @@
+import base64
+
+import pytest
+import requests
+
+from tests.tests_deployment import constants
+
+
+@pytest.mark.filterwarnings("ignore::urllib3.exceptions.InsecureRequestWarning")
+def test_grafana_api_not_accessible_with_default_credentials():
+    """Making sure that Grafana's API is not accessible on default user/pass"""
+    user_pass_b64_encoded = base64.b64encode(b"admin:prom-operator").decode()
+    response = requests.get(
+        f"https://{constants.NEBARI_HOSTNAME}/monitoring/api/datasources",
+        headers={"Authorization": f"Basic {user_pass_b64_encoded}"},
+        verify=False,
+    )
+    assert response.status_code == 401