How to rotate Oracle Cloud credentials in Portworx installations on OKE

This procedure applies to Portworx installation adhering to the following installation method: https://docs.portworx.com/portworx-enterprise/platform/kubernetes/oke/install

First, you'll need to create a new Oracle API signing key and obtain its fingerprint. You also need to know the new Oracle user OCID. This new key and user will replace the old ones.

Portworx uses a Kubernetes secret to store the OCI API key and user information. You'll need to update this secret with your new credentials.

• Delete the existing secret: Remove the old ociapikey secret from the Portworx installation namespace.
• Create the new secret: Recreate the ociapikey secret with the new API key file, user OCID, and fingerprint. The command will look similar to this:

kubectl create secret generic ociapikey --from-file=oci_api_key.pem=<path to your new key file> --from-literal=user-ocid=<your new user OCID> --from-literal=fingerprint=<your new fingerprint> -n <namespace>

To ensure the Portworx pods pick up the new secret, you must trigger a rolling update.

• Confirm update strategy: Verify that your storage cluster spec (stc) is set to RollingUpdate. You can use a kubectl get command to check this.
• Trigger the restart: Use kubectl patch to add a temporary, dummy environment variable to the stc. This action will force the pods to restart one by one, ensuring no downtime.

kubectl patch stc <px-cluster-name> -n <namespace> --type "json" -p '[{"op":"add","path":"/spec/env/-","value":{"name":"DUMMY","value":"dummy"}}]'

After patching the soragecluster (stc), validate that the Portworx pods have restarted and are running with the new credentials. Once confirmed, you can safely remove the old OCI API signing key and user from your Oracle Cloud Infrastructure account.

kubectl get pods -n portworx -l name=portworx

NAME                      READY   STATUS    RESTARTS   AGE

instant-tb-251803-dcmtc   1/1     Running   0          3m59s

instant-tb-251803-qpl4p   1/1     Running   0          3m8s

instant-tb-251803-r4cpz   1/1     Running   0          2m11s