Skip to main content

​
Overview

htpasswd is the default authentication mode. On first install, the Thoras config-controller generates a password and session cookie secret and stores them in the thoras-config-controller Secret. The username is thoras. You can set your own values, pin them for GitOps, or point the chart at a Secret you manage yourself. When you’re ready to integrate with an identity provider, see the dashboard authentication overview for OIDC options.

​
Logging in

The default username is thoras (thorasDashboard.auth.htpasswd.username). Fetch the generated password with:
The Secret appears once config-controller has finished its first reconcile, usually within a minute of install. Until then the dashboard pod reports CreateContainerConfigError. This clears on its own.

​
Setting the password explicitly

Set the values in values.yaml to pin them. The chart stores pinned values in the thoras-helm-values Secret. That Secret is rendered without random generation or Helm lookup, so it is safe for GitOps tools such as Argo CD and Flux.

​
Using an existing Secret

Point the dashboard at a Secret you manage yourself, for example one provisioned by Sealed Secrets, External Secrets, or SOPS.
existingSecret takes precedence over password and cookieSecret.

​
Rotating credentials

The generated credentials are not intended to be rotated in place. If you need control over rotation, take ownership of the values by pinning them in values.yaml or by pointing the chart at an existingSecret you manage. The config-controller watches both and restarts the dashboard automatically when the value changes, so there is no manual kubectl rollout restart step:
  • Pinned in values: change the value in values.yaml and helm upgrade.
  • Existing Secret: update your Secret. The change is picked up within about a minute.
Rotating the cookie secret logs out every active dashboard session.

​
Switching to OIDC

To hand authentication off to your identity provider, see the dashboard authentication overview and pick the guide for your IdP.