Custom passwords/ssh keys for nodes.

[a-v-popov]

It would seem that currently nodes are using predefined users/passwords and ssh keys. Including those for vagrant.
What would it take to change these on per netlab installation basis and what sort of gremlins I should expect if I do this?
To be more specific I am currently using fortios with libvirt and frr with clab, but I am also curious about general picture.

[ipspace]

You can set ansible_username and ansible_ssh_pass on any node or group to overwrite the defaults (or change defaults in defaults.devices....). However, you have to make sure that whatever you're using matches what the Vagrant box was created with (in case of VMs) or what containerlab (or vrnetlab) configures in the containers.

Vagrantfile definitions typically rely on Vagrant "insecure key" and assume vagrant user to log into the VM, so there's no question of what the username/password should be. If that's not the case (for example, with Cumulus NVUE), you have to check whether the per-device Vagrant template uses the ansible_username and ansible_ssh_pass node variables (the Cumulus NVUE one does not).

[a-v-popov]

Vagrantfile definitions typically rely on Vagrant "insecure key" and assume vagrant user to log into the VM, so there's no question of what the username/password should be.

From vagrant docs:

If you are creating a base box for private use, you should try not to follow these, as they open up your base box to security risks (known users, passwords, private keys, etc.).
https://developer.hashicorp.com/vagrant/docs/boxes/base#default-user-settings

Is there any good reason not to use ansible_xxx in vagrant file? Some devices seems to do this, while some seems to be using vagrant well-known user/password instead, and some apply both.

[ipspace]

We're assuming that people use netlab to build labs -- throwaway infrastructure with no security requirements. If your environment differs from that, you can always build different Vagrant boxes and modify Vagrant templates to use ansible_username and ansible_ssh_pass.

The "good reason" is simple: this is a volunteer project and there are other things that are worth solving.