Passwords
During installation TrinityX generates a random password for every service that needs one, so that no service is left on a shared default. The passwords are stored on the controller under /etc/trinity/passwords/, with one file per service, named after the service that uses it.
root only. Keep them on the controller, back them up securely, and do not copy them onto shared or world-readable locations.
What is generated and where
| Service | File | Used for |
|---|---|---|
| OpenLDAP | openldap/root.txt |
Directory manager / LDAP root bind |
| 389 Directory Server | ds389/root.txt |
LDAP root bind when the 389-ds backend is used instead of OpenLDAP |
| MariaDB | mysql/root.txt |
Database root account |
| MariaDB (per service) | mysql/<user>.txt |
Service database accounts, e.g. the Slurm accounting and Kubernetes database users |
| Grafana | grafana/admin.txt |
Grafana admin login |
| Prometheus / Alertmanager | prometheus/admin.txt |
Metrics and alerting web access |
| Compute images | images/<image-name>/root.txt |
root password baked into each built image (with a matching root-salt.txt) |
The exact set depends on which roles were enabled for your cluster; only the services that were installed have a file. Each password is generated with Ansible's password lookup, which produces a random string the first time the playbook runs and then re-uses the stored value on subsequent runs, so re-running the installer does not change existing passwords.
Retrieving a password
The files are plain text, so reading one is a simple cat as root on the controller:
# cat /etc/trinity/passwords/grafana/admin.txt
For a per-image root password, look under the directory named after the image:
# cat /etc/trinity/passwords/images/compute/root.txt
Node access
By default the controller's SSH public key is exported into every image, so the controller can log in to its nodes over SSH without a password. In an HA setup the shared cluster key is exported as well, allowing either controller to reach the nodes. The per-image root password above is the local console fallback for a node.
See Post-installation for the first tasks after an install and User management for managing the LDAP user and admin accounts.