Skip to content

Commit 4fad130

Browse files
K8s: docs issue 1105 (#1108)
* new username in "update rec cred secret" step * fix step and code formating * fix similar command issue
1 parent a3a1b57 commit 4fad130

File tree

1 file changed

+76
-72
lines changed

1 file changed

+76
-72
lines changed

content/operate/kubernetes/security/manage-rec-credentials.md

Lines changed: 76 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -44,107 +44,111 @@ The credentials can be used to access the Redis Enterprise admin console or the
4444

4545
1. Access a [pod](https://kubernetes.io/docs/concepts/workloads/pods/) running a Redis Enterprise cluster.
4646

47-
```bash
48-
kubectl exec -it <rec-resource-name>-0 bash
49-
```
47+
```sh
48+
kubectl exec -it <rec-resource-name>-0 bash
49+
```
5050

51-
1. Add a new password for the existing user.
51+
2. Add a new password for the existing user.
52+
53+
```bash
54+
REC_USER="`cat /opt/redislabs/credentials/username`" \
55+
REC_PASSWORD="`cat /opt/redislabs/credentials/password`" \
56+
curl -k --request POST \
57+
--url https://localhost:9443/v1/users/password \
58+
-u "$REC_USER:$REC_PASSWORD" \
59+
--header 'Content-Type: application/json' \
60+
--data "{\"username\":\"$REC_USER\", \
61+
\"old_password\":\"$REC_PASSWORD\", \
62+
\"new_password\":\"<NEW PASSWORD>\"}"
63+
```
5264

53-
```bash
54-
REC_USER="`cat /opt/redislabs/credentials/username`" \
55-
REC_PASSWORD="`cat /opt/redislabs/credentials/password`" \
56-
curl -k --request POST \
57-
--url https://localhost:9443/v1/users/password \
58-
-u "$REC_USER:$REC_PASSWORD" \
59-
--header 'Content-Type: application/json' \
60-
--data "{\"username\":\"$REC_USER\", \
61-
\"old_password\":\"$REC_PASSWORD\", \
62-
\"new_password\":\"<NEW PASSWORD>\"}"
63-
```
65+
3. From outside the pod, update the REC credential secret.
6466

65-
1. From outside the pod, update the REC credential secret.
67+
3a. Save the existing username to a text file.
6668

67-
1. Save the existing username to a text file .
68-
```bash
69-
echo -n "<current_username>" > username
70-
```
69+
```sh
70+
echo -n "<current_username>" > username
71+
```
7172

72-
1. Save the new password to a text file.
73-
```bash
74-
echo -n "<new_password>" > password
75-
```
73+
3b. Save the new password to a text file.
7674

77-
1. Update the REC credential secret.
78-
```bash
79-
kubectl create secret generic <cluster_secret_name> \
80-
--from-file=./username \
81-
--from-file=./password --dry-run \
82-
-o yaml
83-
kubectl apply -f
84-
```
75+
```sh
76+
echo -n "<new_password>" > password
77+
```
8578

86-
1. Wait five minutes for all the components to read the new password from the updated secret. If you proceed to the next step too soon, the account could get locked.
79+
3c. Update the REC credential secret.
8780

88-
1. Access a pod running a Redis Enterprise cluster again.
81+
```sh
82+
kubectl create secret generic <cluster_secret_name> \
83+
--from-file=./username \
84+
--from-file=./password --dry-run \
85+
-o yaml | \
86+
kubectl apply -f
87+
```
8988

90-
```bash
91-
kubectl exec -it <rec-resource-name>-0 bash
92-
```
89+
4. Wait five minutes for all the components to read the new password from the updated secret. If you proceed to the next step too soon, the account could get locked.
9390

94-
1. Remove the previous password to ensure only the new one applies.
91+
5. Access a pod running a Redis Enterprise cluster again.
9592

96-
```sh
97-
REC_USER="`cat /opt/redislabs/credentials/username`"; \
98-
REC_PASSWORD="`cat /opt/redislabs/credentials/password`"; \
99-
curl -k --request DELETE \
100-
--url https://localhost:9443/v1/users/password \
101-
-u "$REC_USER:$REC_PASSWORD" \
102-
--header 'Content-Type: application/json' \
103-
--data "{\"username\":\"$REC_USER\", \
104-
\"old_password\":\"<OLD PASSWORD\"}"
105-
```
93+
```sh
94+
kubectl exec -it <rec-resource-name>-0 bash
95+
```
96+
97+
6. Remove the previous password to ensure only the new one applies.
10698

107-
{{<note>}} The username for the K8s secret is the email displayed on the Redis Enterprise admin console. {{</note>}}
99+
```sh
100+
REC_USER="`cat /opt/redislabs/credentials/username`"; \
101+
REC_PASSWORD="`cat /opt/redislabs/credentials/password`"; \
102+
curl -k --request DELETE \
103+
--url https://localhost:9443/v1/users/password \
104+
-u "$REC_USER:$REC_PASSWORD" \
105+
--header 'Content-Type: application/json' \
106+
--data "{\"username\":\"$REC_USER\", \
107+
\"old_password\":\"<OLD PASSWORD\"}"
108+
```
109+
110+
{{<note>}} The username for the K8s secret is the email displayed on the Redis Enterprise admin console. {{</note>}}
108111

109112
### Change both the REC username and password
110113

111114
1. [Connect to the admin console]({{< relref "/operate/kubernetes/re-clusters/connect-to-admin-console.md" >}})
112115

113-
1. [Add another admin user]({{< relref "/operate/rs/security/access-control/create-users" >}}) and choose a new password.
116+
2. [Add another admin user]({{< relref "/operate/rs/security/access-control/create-users" >}}) and choose a new password.
114117

115-
1. Specify the new username in the `username` field of your REC custom resource spec.
118+
3. Specify the new username in the `username` field of your REC custom resource spec.
116119

117-
1. Update the REC credential secret:
120+
4. Update the REC credential secret:
118121

119-
1. Save the existing username to a text file.
122+
4a. Save the new username to a text file.
120123

121-
```bash
122-
echo -n "<current_username>" > username
123-
```
124+
```sh
125+
echo -n "<new_username>" > username
126+
```
124127

125-
1. Save the new password to a text file.
128+
4b. Save the new password to a text file.
126129

127-
```bash
128-
echo -n "<new_password>" > password
129-
```
130+
```sh
131+
echo -n "<new_password>" > password
132+
```
130133

131-
1. Update the REC credential secret.
134+
4c. Update the REC credential secret.
132135

133-
```bash
134-
kubectl create secret generic <cluster_secret_name> \
135-
--from-file=./username \
136-
--from-file=./password --dry-run \
137-
-o yaml
138-
kubectl apply -f
139-
```
136+
```sh
137+
kubectl create secret generic <cluster_secret_name> \
138+
--save-config \
139+
--dry-run=client \
140+
--from-file=./username --from-file=./password \
141+
-o yaml | \
142+
kubectl apply -f
143+
```
140144

141-
1. Wait five minutes for all the components to read the new password from the updated secret. If you proceed to the next step too soon, the account could get locked.
145+
5. Wait five minutes for all the components to read the new password from the updated secret. If you proceed to the next step too soon, the account could get locked.
142146

143-
1. Delete the previous admin user from the cluster.
147+
6. Delete the previous admin user from the cluster.
144148

145-
{{<note>}}
149+
{{<note>}}
146150
The operator may log errors in the time between updating the username in the REC spec and the secret update.
147-
{{</note>}}
151+
{{</note>}}
148152

149153
### Update the credentials secret in Vault
150154

0 commit comments

Comments
 (0)