Pulp

My proposed solution is this:

1. For initial install, always set it.
2. For upgrades or re-running the installer for any other reason, let it be determined by a variable like "pulp_always_reset_admin_pw"
3. Ignore whether or not migrations were run.

Since the health check tests seem to need the password, it looks like we assume that the installer needs to know the current pulp admin password anyway. So we could go a step further and say, that the password is managed by the installer. We can than add a test whether the password still works and (re-)set it. I'd say the variable should be named pulp_admin_password in that case.

On the other hand, i don't think the status endpoint (used in the health check) needs the password. So we could use the set-only-if-touched-file-is-absent approach. We would instruct the user to delete that file in order to reset the password via the installer.