Updating Passwords in Vault
This guide demonstrates the process of updating the passwords in the Vault.
Step 1: Log In To the Vault
To update the secret in the vault, follow the below steps
kubectl -n vault exec -it vault-0 -- sh
vault login
Input the token that was generated during the vault initialization to login.
Step 2: Patch the Secret In the Vault
Use the following command to update the value in the secret.
vault kv patch secret/<secret name> <key>=<value>
an example is given below:-
vault kv patch secret/postgresql postgres-password=postgresql464
/ $ vault kv patch secret/postgresql postgres-password=postgresql464
===== Secret Path =====
secret/data/postgresql
======= Metadata =======
Key Value
--- -----
created_time 2024-09-16T08:49:51.954215622Z
custom_metadata <nil>
deletion_time n/a
destroyed false
version 2
Information Regarding Keycloak:
There are two admin users for Keycloak:
Master Realm Admin (Super Admin)
Expertflow Realm Admin
Admin 1’s Password: Stored as
admin-password
in thevault-external
secret of Vault.Admin 2’s Password: Stored as
password
in thevault-external
secret and asKEYCLOAK_PASSWORD_ADMIN
in theef-connection-env
secret of Vault.
To update any of the passwords mentioned above, follow these steps:
Update the password in the Keycloak web interface.
Update the corresponding key-value pairs in Vault for all relevant secrets. For example, update the
vault-external
andef-connection-env
secrets for Admin 2’s password.
Important: No password is automatically injected from Vault to Keycloak; you must update it manually in the interface.
Step 2: Reflect The Changes In Namespace
Changes in the secret will be reflected by following these steps:-
Delete the secret in the namespace:-
Follow this command to delete the secret:-
kubectl get secret -n <namespace>
kubectl delete secret -n <namespace> <secret-name>
An example is given below:-
kubectl get secret -n ef-external
root@efcx:~# kubectl get secrets -n ef-external
NAME TYPE DATA AGE
ef-postgresql-crt kubernetes.io/tls 3 3d9h
expertflow-reg-cred kubernetes.io/dockerconfigjson 1 3d9h
minio Opaque 2 3d9h
minio-crt kubernetes.io/tls 3 3d9h
mongo-mongodb-ca Opaque 3 3d9h
mongodb Opaque 1 3d9h
postgresql Opaque 2 3d9h
redis Opaque 1 3d9h
redis-crt kubernetes.io/tls 3 3d9h
sh.helm.release.v1.ef-postgresql.v1 helm.sh/release.v1 1 3d9h
sh.helm.release.v1.keycloak.v1 helm.sh/release.v1 1 3d9h
sh.helm.release.v1.minio.v1 helm.sh/release.v1 1 3d9h
sh.helm.release.v1.mongo.v1 helm.sh/release.v1 1 3d9h
sh.helm.release.v1.redis.v1 helm.sh/release.v1 1 3d9h
vault-external Opaque 2 3d9h
kubectl delete secret -n ef-external postgresql
root@efcx:~# kubectl delete secret -n ef-external postgresql
secret "postgresql" deleted
Restart Pods in the namespace:-
kubectl get pod -n ef-external
root@efcx:~# k get pods -n ef-external
NAME READY STATUS RESTARTS AGE
ef-amq-0 1/1 Running 1 (122m ago) 7h31m
ef-postgresql-0 0/1 Unknown 0 34h
keycloak-0 0/1 Unknown 0 34h
minio-84cfcdbd48-8n6g2 0/1 Unknown 0 34h
mongo-mongodb-0 0/1 Unknown 0 34h
redis-master-0 0/1 Unknown 0 34h
kubectl delete pod -n ef-external ef-postgresql-0
root@efcx:~# k delete pod -n ef-external ef-postgresql-0
pod "ef-postgresql-0" deleted
Pods will now be using the updated secrets.