Web UI Login Accounts
The data lake includes multiple web screens where people log in via browser. They use different accounts from service accounts (Passwords · API Keys), are stored separately, and the method to change them differs by screen.
| Screen | Address | Account Variables | Change Method |
|---|---|---|---|
| Admin Console | https://<server-ip>:4950/ | PP_DATALAKE_ADMIN_USER / PP_DATALAKE_ADMIN_PASSWORD | passwd.sh |
| Data Gateway Console | https://<server-ip>:5501/ | PP_DATA_GATEWAY_WEB_USER / PP_DATA_GATEWAY_WEB_PASSWORD | Sidecar + restart |
| CEP Console | https://<server-ip>:7401/ | PP_CEP_WEB_USER / PP_CEP_WEB_PASSWORD | Sidecar + restart |
| Grafana | https://<server-ip>:3000/ | Grafana native account | Within Grafana UI |
| Kestra | https://<server-ip>:8380/ | PP_KESTRA_ADMIN_EMAIL / PP_KESTRA_ADMIN_PASSWORD | Sidecar + restart |
| MinIO Console | http://<server-ip>:9001/ | PP_MINIO_USER / PP_MINIO_PASSWORD | passwd.sh (same value as service account) |
| Temporal UI · Spark UI | http://<server-ip>:8233/ · :4440/ | No login | Open only on air-gapped network |
Default values are listed in Initial Password Change. This page does not include those values.
Admin Console (:4950 · :4949)
| Variable | Default | Description |
|---|---|---|
PP_DATALAKE_ADMIN_USER | admin | Login name. Can be changed, but passwd.sh handles passwords only |
PP_DATALAKE_ADMIN_PASSWORD | Development default for installations after 2026-09-05; empty before | If empty, only the console shuts down and the stack starts normally |
PP_DATALAKE_ADMIN_API_KEY | None | X-API-Key when the machine calls log endpoints. If empty, key authentication only is disabled |
cd /opt/kopens/plantpulse-platform-docker
bin/passwd.sh PP_DATALAKE_ADMIN_PASSWORD # 프롬프트로 새 값
--list If this key is missing in an older installation package, edit the sidecar directly. There is no separate server-side account in this case, so file editing is sufficient.
sudo vi /etc/kopens/plantpulse-platform.env
# PP_DATALAKE_ADMIN_PASSWORD=<새비밀번호>
cd /opt/kopens/plantpulse-platform-docker/bin
./restart-datalake.sh
This means PP_DATALAKE_ADMIN_PASSWORD is empty. It is not a failure, but an omission during commissioning. Add the value using the method above and restart to open it. pd doctor also reports the same name as "Choice secret not set".
Two Query Consoles — Data Gateway · CEP
The Data Gateway Console (SQL execution) and CEP Console (EQL rules) each have their own browser login. Passwords have no default value, and if empty, only that one console denies login. The data lake starts normally and other consoles are unaffected.
| Variable | Default | Rendered At |
|---|---|---|
PP_DATA_GATEWAY_WEB_USER / PP_DATA_GATEWAY_WEB_PASSWORD | admin / None | plantpulse-data-gateway/config/plantpulse-jdbc.properties in data.gateway.web.* |
PP_CEP_WEB_USER / PP_CEP_WEB_PASSWORD | admin / None | plantpulse-cep/config/plantpulse-cep.properties in cep.web.* |
These two are not rotation targets (decision made 2026-09-07). passwd.sh has no key, and if you add one it will reject it. Write to the sidecar and restart — there is no server-side account, so that is the end.
sudo vi /etc/kopens/plantpulse-platform.env
# PP_DATA_GATEWAY_WEB_PASSWORD=<새비밀번호>
# PP_CEP_WEB_PASSWORD=<새비밀번호>
cd /opt/kopens/plantpulse-platform-docker/bin
./restart-datalake.sh
Re-running install.sh will show "this feature is off" list with these two names and the file to edit.
The old plantpulse-sql SQL screen on port 4000 is deprecated (2026-09-07). The place to execute SQL is the Data Gateway Console https://<server-ip>:5501/, opened as a card from the Admin Console's "Tools" screen.
Grafana (:3000)
Time series dashboard. Responds to TLS only — opening with http:// returns 400.
Grafana's admin account is in Grafana's own database. The data lake does not read environment variables like PP_GRAFANA_* — the Grafana startup script passes no values and simply starts the server. Therefore, the place to change it is within Grafana: Login → bottom-left Profile → Change password. See Initial Password Change for defaults.
Grafana's data directory (plantpulse-timeseries/dashboard/data) is inside the image tree and is not a volume. Changes made in the UI and dashboard edits remain only in the container's write layer, and after operations that recreate the container like update.sh · restart-datalake.sh, the image reverts to the values it contains. This is reported as a product defect. Until a fix is released, verify the Grafana password again after recreation.
Kestra (:8380)
Data pipeline engine. Responds to TLS only.
| Variable | Default |
|---|---|
PP_KESTRA_ADMIN_EMAIL | admin@plantpulse.io |
PP_KESTRA_ADMIN_PASSWORD | Development default — Initial Password Change |
PP_KESTRA_DB_PASSWORD is a different value. It is the backend account Kestra uses when connecting to PostgreSQL, not the account people use to log in.
A defect has been reported where the warehouse service submitting S3 archives hardcodes a Kestra account in its own startup script. If archives silently stop after changing the Kestra password, that is it → Initial Password Change — Kestra
MinIO Console (:9001)
Object storage admin screen. Login account uses the same value as the service account (PP_MINIO_USER / PP_MINIO_PASSWORD), so changing it with passwd.sh PP_MINIO_PASSWORD also changes the console login. pd monitors the S3 API port 9000; the screen people open is on port 9001.