Web Console Login Accounts
The data lake includes several screens that users log into through a browser. These are separate from service accounts (Changing Passwords · API Keys), and the method for changing them differs by screen.
| Screen | Address | Account Variable | How to Change |
|---|---|---|---|
| Management Console | https://<server-ip>:4950/ | PP_DATALAKE_ADMIN_USER / PP_DATALAKE_ADMIN_PASSWORD | passwd.sh |
| Data Gateway Console | https://<server-ip>:5501/ | PP_DATA_GATEWAY_WEB_USER / PP_DATA_GATEWAY_WEB_PASSWORD | Sidecar + Restart |
| CEP Console | https://<server-ip>:7401/ | PP_CEP_WEB_USER / PP_CEP_WEB_PASSWORD | Sidecar + Restart |
| PlantPulse Dashboard | https://<server-ip>:3000/ | PlantPulse Dashboard's own account | Within the PlantPulse Dashboard interface |
| Kestra | https://<server-ip>:8380/ | PP_KESTRA_ADMIN_EMAIL / PP_KESTRA_ADMIN_PASSWORD | Sidecar + Restart |
| RustFS Console | http://<server-ip>:9001/ | PP_S3_USER / PP_S3_PASSWORD | passwd.sh (same values as the service account) |
| Temporal UI · Spark UI | http://<server-ip>:8233/ · :4440/ | No login | Keep them accessible only on the private network |
The list of default values is in Initial Password Change. This page does not include the actual values.
Management Console (:4950 · :4949)
| Variable | Default Value | Description |
|---|---|---|
PP_DATALAKE_ADMIN_USER | admin | Login name. It can be changed, but passwd.sh only handles the password |
PP_DATALAKE_ADMIN_PASSWORD | For installations dated after 2026-09-05, the development default value; for older ones, empty | If empty, only the console is disabled; the rest of the stack starts normally |
PP_DATALAKE_ADMIN_API_KEY | None | The X-API-Key used when a machine calls the log endpoint. If empty, only key authentication is disabled |
cd /opt/kopens/plantpulse-platform-docker
bin/passwd.sh PP_DATALAKE_ADMIN_PASSWORD # 프롬프트로 새 값
For older installation packages that lack this key in --list, edit the sidecar directly. There is no separate server-side account, so in this case, editing the file is sufficient.
sudo vi /etc/kopens/plantpulse-platform.env
# PP_DATALAKE_ADMIN_PASSWORD=<새비밀번호>
cd /opt/kopens/plantpulse-platform-docker/bin
./restart-datalake.sh
This means PP_DATALAKE_ADMIN_PASSWORD is empty. It's not an error; it's something that was missed during commissioning. Set the value as described above and restart, and it will open. pd doctor also reports the same name as «Selected secret not configured».
Query Consoles Two — Data Gateway · CEP
The Data Gateway Console (SQL execution) and the CEP Console (EQL rules) each have their own browser login. The password has no default value, and if it is left empty, only that console refuses login. The data lake comes up, and the other consoles are unaffected.
| Variable | Default Value | Where It's Rendered |
|---|---|---|
PP_DATA_GATEWAY_WEB_USER / PP_DATA_GATEWAY_WEB_PASSWORD | admin / None | plantpulse-data-gateway/config/plantpulse-jdbc.properties's data.gateway.web.* |
PP_CEP_WEB_USER / PP_CEP_WEB_PASSWORD | admin / None | plantpulse-cep/config/plantpulse-cep.properties's cep.web.* |
These two are decided not to be rotation targets (2026-09-07). passwd.sh has no key for them, and providing one will cause a rejection. Write them in the sidecar and restart — since there is no server-side account, that's the end of it.
sudo vi /etc/kopens/plantpulse-platform.env
# PP_DATA_GATEWAY_WEB_PASSWORD=<새비밀번호>
# PP_CEP_WEB_PASSWORD=<새비밀번호>
cd /opt/kopens/plantpulse-platform-docker/bin
./restart-datalake.sh
When install.sh is run again, it will list these two names and the file to write them into, under the «This feature is disabled» list.
The place where SQL is executed is the Data Gateway Console https://<server-ip>:5501/, and it opens as a card on the «Tools» screen in the Management Console.
PlantPulse Dashboard (:3000)
A time series dashboard. It only responds over TLS — accessing it with http:// returns a 400 error.
The PlantPulse Dashboard administrator account is stored in PlantPulse Dashboard's own repository (from 2026-09-08, the grafana DB in PostgreSQL). 🔴 There is no environment variable that sets the administrator account — the value in the configuration file is only referenced when there are no users in the repository, and once a user is created, the repository takes precedence. So the place to change it is in the PlantPulse Dashboard interface: log in → profile at the bottom left → Change password. For the default, see Initial Password Change.
The PlantPulse Dashboard variables that the data lake reads are only the two for repository access (PP_GRAFANA_DB_USER · PP_GRAFANA_DB_PASSWORD), and the rest are required for startup.
The bundled dashboards are read-only (2026-09-08 decision). To modify them, use Save as to create a copy and edit that one — the copy is yours and will not be overwritten by upgrades.
PlantPulse Dashboard's data directory (plantpulse-timeseries/dashboard/data) is inside the image tree and is not a volume. Passwords changed in the interface and dashboard edits are stored only in the container's writable layer, so after operations that recreate the container, such as update.sh · restart-datalake.sh, it reverts to the values baked into the image. This has been reported as a product defect. Until a fix is released, please re-check the PlantPulse Dashboard password after recreation.
Kestra (:8380)
The data pipeline engine. It only responds over TLS.
| Variable | Default Value |
|---|---|
PP_KESTRA_ADMIN_EMAIL | admin@plantpulse.io |
PP_KESTRA_ADMIN_PASSWORD | Development default — Initial Password Change |
PP_KESTRA_DB_PASSWORD is a different value. It's the backend account used when Kestra connects to PostgreSQL, not a login account for people.
Before 2026-09-04, the warehouse hardcoded the Kestra account in its startup script, so changing this password silently stopped the S3 archive. That path is gone now — the archive and optimization are handled by Temporal workers, and the warehouse does not have Kestra credentials → Initial Password Change — Kestra
RustFS Console (:9001)
The management screen for object storage. The login account uses the same values as the service account (PP_S3_USER / PP_S3_PASSWORD), so changing them via passwd.sh PP_S3_PASSWORD also changes the console login. What pd monitors is the S3 API port 9000, while the screen for people is on 9001.