How to rotate credentials for service principal-based Portworx Installations on AKS

1. Create a new Service Principal

• In Azure, create a new Service Principal to replace the original Service Principal and assign the same role to it as the original Service Principal.
  • Creating a new Service Principal with the required role can be done as per steps 1 and 2 of this document
    
    

2. Update Credentials in Portworx

• Delete the existing px-azure secret
• Recreate the px-azure secret with the tenant ID, client ID, and client secret for your newly created Service Principal in the Portworx installation namespace.
  • Recreating the secret can be done as per step 3 of this document

3. Perform a Rolling Restart of Pods

• Perform a rolling update of all Portworx-related pods in your cluster.
  •  Confirm your storage cluster spec (stc) has the default setting updateStrategy set to RollingUpdate. See example command:
    
    

kubectl get storagecluster <yourstc-name> -n <namespace> -o jsonpath='{.spec.updateStrategy.type}'

RollingUpdate

• • Patch your storagecluster object. This command will patch your portworx storage cluster spec (stc) adding a dummy environment variable so to trigger the rolling update:

kubectl patch stc <px-cluster-name> -n <namespace> --type "json" -p '[{"op":"add","path":"/spec/env/-","value":{"name":"DUMMY","value":"dummy"}}]'

• This refreshes all services with the new credentials while keeping workloads online.
  
  
• This process is designed to be non-intrusive and should not cause downtime. 

• • Validate that your Portworx-related pods restarted (example):

kubectl get pods -n portworx -l name=portworx

NAME                      READY   STATUS    RESTARTS   AGE

instant-tb-251803-dcmtc   1/1     Running   0          3m59s

instant-tb-251803-qpl4p   1/1     Running   0          3m8s

instant-tb-251803-r4cpz   1/1     Running   0          2m11s

4. Delete the original Service Principal

• Once transitioned to the new Service Principal, remove/delete the old Service Principal
  • If the same Service Principal was used for more than one Portworx installation, ensure that all clusters are using the new Service Principal before removing the original one.