|
1 | 1 | # Management of the Redis Enterprise Cluster credentials |
2 | | -## Background |
3 | | -When the operator creates a Redis Enterprise Cluster (REC) it generates random credentials that are used by the operator to perform operations on the Redis Enterprise Cluster using the cluster APIs. |
4 | | -The credentials are saved in a K8s secret (or Vault, see [README](vault/README.md)). When a K8s secret is used, the secret name default to the name of the Redis Enterprise Cluster. |
5 | | -## Using the Redis Enterprise Cluster Credentials |
6 | | -The credentials can be used to access the Redis Enterprise Cluster UI or API. Make sure connectivity is configured to the cluster pods using an appropriate service (or by a solution such as kubectl port forwarding). To inspect the random username and password created by the operator, use kubectl: |
7 | | -``` |
8 | | -$ kubectl get secret rec -o jsonpath='{.data}' |
9 | | -map[password:MVUyTjd1Mm0= username:ZGVtb0ByZWRpc2xhYnMuY29t] |
10 | | -$ echo MVUyTjd1Mm0= | base64 --decode |
11 | | -``` |
12 | | -> Note - other utilities to view secrets are available |
13 | 2 |
|
14 | | -## Changing the Redis Enterprise Cluster Credentials |
15 | | -### Replacing the password |
16 | | -Please follow the following steps: |
17 | | -1. Take note of the current password, see above |
18 | | -2. Exec into a Redis Enterprise Cluster node pod using the following command: |
19 | | - ``` |
20 | | - kubectl exec -it <Redis Enterprise Cluster resource name>-0 bash |
21 | | - ``` |
22 | | -3. Within the pod console, run a command to add the new password as supported for the existing user, replace with the existing credentials and the new password: |
23 | | - ``` |
24 | | - REC_USER="`cat /opt/redislabs/credentials/username`"; REC_PASSWORD="`cat /opt/redislabs/credentials/password`";curl -k --request POST --url https://localhost:9443/v1/users/password -u "$REC_USER:$REC_PASSWORD" --header 'Content-Type: application/json' --data "{\"username\":\"$REC_USER\",\"old_password\":\"$REC_PASSWORD\", \"new_password\":\"<NEW PASSWORD>\"}" |
25 | | - ``` |
26 | | -4. Update the cluster credential secret: using the commands ran outside of the Redis Enterprise Cluster node pod: |
27 | | - > Note: For Vault users, see the instruction described [below](./cluster_credentials.md#creds_with_vault) and proceed to the next step. |
28 | | -
|
29 | | - a. Save the existing username to a text file (replace <current username> with actual). |
30 | | - ``` |
31 | | - echo -n "<current username>" > username |
32 | | - ``` |
33 | | - b. Save the new password to a text file (replace <new password> with actual). |
34 | | - ``` |
35 | | - echo -n "<new password>" > password |
36 | | - ``` |
37 | | - c. Update the secret: |
38 | | - ``` |
39 | | - kubectl create secret generic <cluster secret name> --from-file=./username --from-file=./password --dry-run -o yaml | kubectl apply -f - |
40 | | - ``` |
41 | | -5. Wait 5 minutes to make sure all components have read the new password from the updated secret |
42 | | -6. in case this cluster is participating in Active-Active database via REAADB follow the instructions [here](active_active_database_readme.md) under `Update existing participating cluster (RERC) secret`. |
43 | | -7. Exec into a Redis Enterprise Cluster node pod (see above) and run the following command to remove the previous password so only the new one applies. Important: replace OLD PASSWORD with the one being replaced, see step 1 above. |
44 | | - ``` |
45 | | - REC_USER="`cat /opt/redislabs/credentials/username`"; REC_PASSWORD="`cat /opt/redislabs/credentials/password`";curl -k --request DELETE --url https://localhost:9443/v1/users/password -u "$REC_USER:$REC_PASSWORD" --header 'Content-Type: application/json' --data "{\"username\":\"$REC_USER\",\"old_password\":\"<OLD PASSWORD\"}" |
46 | | - ``` |
47 | | - > Note: the username to be used with the K8s secret is the email displayed on the Redis Enterprise UI |
48 | | -
|
49 | | - > Note: this procedure is only supported for version 6.0.20-5 or above |
50 | | -### Replacing the password and the username |
51 | | -Please follow the following steps: |
52 | | -1. Log into the Redis Enterprise Cluster UI using the credentials as explained above. |
53 | | -2. Add another admin user, choose a password |
54 | | -3. Set the new username with the Redis Enterprise Cluster spec (username field) |
55 | | -4. Update the cluster credential secret: |
56 | | - > Note: For Vault users, see the instruction described [below](#creds_with_vault) and proceed to the next step. |
57 | | - |
58 | | - a. Save the new username to a text file (replace <new username> with actual). |
59 | | - ``` |
60 | | - echo -n "<new username>" > username |
61 | | - ``` |
62 | | - b. Save the new password to a text file (replace <new password> with actual). |
63 | | - ``` |
64 | | - echo -n "<new password>" > password |
65 | | - ``` |
66 | | - c. Update the secret: |
67 | | - ``` |
68 | | - kubectl create secret generic <cluster secret name> --from-file=./username --from-file=./password --dry-run -o yaml | kubectl apply -f - |
69 | | - ``` |
70 | | - > Note: the username to be used with the K8s secret is the email displayed on the Redis Enterprise UI |
71 | | -5. Wait 5 minutes to make sure all components have read the new password from the updated secret |
72 | | -6. in case this cluster is participating in Active-Active database via REAADB follow the instructions [here](active_active_database_readme.md) under `Update existing participating cluster (RERC) secret`. |
73 | | -7. Delete the previous admin user using the Redis Enterprise Cluster UI |
74 | | - > Note: this procedure is only supported for version 6.0.20-5 or above |
75 | | - > Note: the operator might log errors in the time period between updating the username in the REC spec and the secret update |
76 | | -
|
77 | | -<a name="creds_with_vault"></a> |
78 | | -### Updating the credentials secret in Vault |
79 | | -For users who store secrets in Vault, update the Vault secret containing the Redis Enterprise Cluster's credentials with the following key-value pairs: username:<desired_username>, password:<desired_password>. |
80 | | -For more information about Vault integration with the Redis Enterprise Cluster see [README](vault/README.md#deployment_rec). |
| 3 | +This content has moved to [docs.redis.com](https://docs.redis.com/latest/); see [Manage Redis Enterprise cluster (REC) credentials](https://docs.redis.com/latest/kubernetes/security/manage-rec-credentials/). |
0 commit comments