arrow-left

All pages
gitbookPowered by GitBook
1 of 1

Loading...

Rotating Credentials

This guide demonstrates how to update credentials referenced in the Immuta Enterprise Helm chart (IEHC).

circle-info

Kubernetes namespace

The following section(s) presume the IEHC was deployed into namespace immuta and that the current namespace is immuta.

hashtag
Kubernetes secrets

hashtag
Edit secrets

circle-info

Using an alternative editor

Set environment variable KUBE_EDITOR to specify an alternative text editor.

  1. Validate that secret immuta-secret exists in the current namespace.

  2. Edit secret immuta-secret in place.

  3. Edit secret immuta-legacy-secret in place. Skip this step if the legacy query engine and fingerprint services are disabled (the default).

hashtag
Legacy query engine

circle-info

Considerations when using the legacy query engine

The following section is only necessary if the .

  1. Validate that secret immuta-legacy-secret exists in the current namespace.

  2. Get the query engine replica count, this value will be referenced in subsequent step(s).

  3. Scale the replica count down to 1.

hashtag
Apply Helm values

  1. Update credentials in the immuta-values.yaml file.

  2. Perform a to apply the changes made to immuta-values.yaml. Update the with your own release name.

  • Restart pods.

  • Get the query engine pod name, this value will be referenced in subsequent step(s).

  • Update the placeholder value with a query engine superuser password.

  • Update the placeholder value with a query engine replication password.

  • Update the placeholder value with a query engine feature password.

  • Scale the replica count back up to the previous value by updating the placeholder value.

  • legacy query engine and fingerprint services have been enabled
    Helm upgradearrow-up-right
    placeholder value
    kubectl rollout restart deployment --all --selector "app.kubernetes.io/component=audit,app.kubernetes.io/component=secure"
    kubectl get pod --selector "app.kubernetes.io/component=query-engine"
    kubectl exec pod/<query-engine-pod-name> -- \
        psql -d immuta -c \
        "ALTER USER postgres WITH ENCRYPTED PASSWORD '<new-patroni-superuser-password>'"
    kubectl exec pod/<query-engine-pod-name> -- \
        psql -d immuta -c \
        "ALTER USER replicator WITH ENCRYPTED PASSWORD '<new-patroni-replication-password>'"
    kubectl exec pod/<query-engine-pod-name> -- \
        psql -d immuta -c \
        "ALTER USER feature_service WITH ENCRYPTED PASSWORD '<new-immuta-feature-password>'"
    kubectl scale statefulset --all --replicas <query-engine-previous-replica-count> --selector "app.kubernetes.io/component=query-engine"
    kubectl get secret/immuta-secret
    kubectl edit secret/immuta-secret
    kubectl get secret/immuta-legacy-secret
    kubectl get statefulset --selector "app.kubernetes.io/component=query-engine" --output name
    kubectl scale statefulset --all --replicas 1 --selector "app.kubernetes.io/component=query-engine"
    helm upgrade <release-name> oci://ocir.immuta.com/stable/immuta-enterprise --values immuta-values.yaml --version 2024.2.20
    kubectl edit secret/immuta-legacy-secret