Feedback on hard-coded usernames and passwords in Chef scripts

[akondasif]

Greetings,

I am a security researcher, who is looking for security smells in Chef scripts.
I found instances where usernames and passwords are specified within a Chef script.
According to the Common Weakness Enumeration organization this is a security weakness
(CWE-798: Hard-coded credentials https://cwe.mitre.org/data/definitions/798.html).

I am trying to find out if you agree with the findings and the reasons the usernames and passwords were introduced. Any feedback is appreciated.

Source:

1. https://github.com/criteo-cookbooks/rundeck-server/blob/master/attributes/default.rb