How do I generate a password hash?

[VictorKrasnov]

Describe the bug

Documentation:

Since Topology Operator v1.15.0, it is possible to provide the user password using a SHA-512 hash. Other hash algorithms are not supported in the Topology Operator resource. To create a user with a password hash, use the field passwordHash in the credentials Secret:

apiVersion: v1
kind: Secret
metadata:
  name: my-user-credentials # IMPORTANT: this Secret name must match .spec.importCredentialsSecret.name field in User object
type: Opaque
stringData:
  username: my-user
  passwordHash: tLXSw/gQg2QVPehN+O5wpRx6o22OKMX2OuO5nb0mrametb29utktQXy6caRkxk9QwNxxwgPC7qZ2psKy48GPI0sC6TQ= # SHA-512 hash of "foobarbaz"

Reproduction steps

Commands like:

echo -n 'foobarbaz' | openssl dgst -sha512 -binary | base64

Produces values like:

yzd8ELD1piyANiWnmdnpCL5F52f10UfUdEkHywVZeqTt0ymgrxR63Qz0GB7TKPoeeZQmWCaz7T1+9vBnypkYWg==

Expected behavior

But how to get token like documentation example, starts with:
tLXSw/gQg2QVPehN+.....?????

Additional context

No response

[michaelklishin]

@VictorKrasnov there is a dedicated doc guide on Credentials and Passwords, which has a section titled Computing Password Hashes.

Several HTTP API clients even include helpers for producing salted hashes:

• rabbit-hole
• Rust HTTP API client

and then there is

rabbitmqctl hash_password

rabbitmqctl help hash_password

which only supports the default hashing algorithm (SHA-256) but requires as little effort as it gets.

All it does is delegate to the rabbit_password module shared with the server, so adding support for the hashing algorithm should be fairly trivial. You are welcome to contribute it.