Each backend component that requires an admin or integration user will have their password change process documented here. Please follow the steps in order to update/change a password accordingly.
You are expected to have access directly to the Kubernetes or Openshift pods and have the ability to delete/create pods and deployments to progress this this.
This is also considered a DISRUPTIVE change and will cause outage on certain components during the update process.
1. Updating Postgres Password (Deployments using Keycloak)
Before updating the Postgres password at the secret level, you will need to first update the instance password.
This is because even if you update the secret, the database instance was already created prior to the secret update and hence would have created the relevant admin or integration users with the current secret.
Before undertaking this change, please ensure there is no one using the platform or if anyone is using the platform you will need to notify them of a disruption. Changing the password of the instance will cause a cascading effect and the following components will cease to function and go into a CrashLoop:
keycloak
This may also cause a cascading effect that will cause the following to go into a pending state due to health checks:
keycloak-internal-gateway
1.1. Changing the Password on the Existing Instance
Log into your Postgres pod and access the psql command line
kubectl exec -it <keycloak postgres pod> /bin/bash bash psql -U postgres -d postgres OR oc rsh <keycloak postgres pod> bash psql -U postgres -d postgres
Once you are in update the postgres user password to the new password using the following Postgres SQL command
\password postgres
It will prompt you for the new password. Once this is complete, proceed to the next section to validate the change.
1.2. Updating Deployment Specifications and Re-Deploy
Update the POSTGRES_PASSWORD variable in the secrets yaml for Postgres keycloak-credentials.yaml to the new password.
Apply the secrets change using
kubectl apply -f keycloak/k8s/keycloak-credentials.yaml OR oc apply -f keycloak/k8s/keycloak-credentials.yaml
Validate the secrets was updated using
kubectl get secrets OR oc get secrets
Once the change has been applied you will need to restart all dependant pods on this secret in the next section.
1.3. Restart Dependant Pods
You will need to restart the following pods to take on the new Postgres password
keycloak
These pods should no longer be in a CrashLoop state after the restart. The keycloak-internal-gateway should also stabilise.
2.Updating Postgres Password (Older versions - Non Keycloak)
Before updating the Postgres password at the secret level, you will need to first update the instance password.
This is because even if you update the secret, the database instance was already created prior to the secret update and hence would have created the relevant admin or integration users with the current secret.
Before undertaking this change, please ensure there is no one using the platform or if anyone is using the platform you will need to notify them of a disruption. Changing the password of the instance will cause a cascading effect and the following components will cease to function and go into a CrashLoop:
cerebrum-api-server
cerebrum-batch
cerebrum-scheduler
cerebrum-worker
2.1. Changing the Password on the Existing Instance
Log into your Postgres pod and access the psql command line
kubectl exec -it <postgres pod> /bin/bash bash psql -U postgres -d postgres OR oc rsh <postgres pod> bash psql -U postgres -d postgres
Once you are in update the postgres user password to the new password using the following Postgres SQL command
\password postgres
It will prompt you for the new password. Once this is complete, proceed to the next section to validate the change.
2.2. Updating Deployment Specifications and Re-Deploy
Update the POSTGRES_PASS variable in the secrets yaml for Postgres credentials.yaml to the new password.
Apply the secrets change using
kubectl apply -f postgres/k8s/credentails.yaml OR oc apply -f postgres/k8s/credentails.yaml
Validate the secrets was updated using
kubectl get secrets OR oc get secrets
Once the change has been applied you will need to restart all dependant pods on this secret in the next section.
2.3. Restart Dependant Pods
You will need to restart the following pods to take on the new Postgres password
cerebrum-api-server
cerebrum-batch
cerebrum-scheduler
cerebrum-worker
These pods should no longer be in a CrashLoop state after the restart.