Rotating Access Keys for IAM User-based Portworx Installations on AWS

This procedure applies to Portworx installation adhering to the following installation method (under “Attach policy to your AWS user account” tab): https://docs.portworx.com/portworx-enterprise/platform/kubernetes/aws-eks/eks/install/aws-eks#attach-iam-policy

First, you'll need to create a new access key for the IAM user that the Portworx cluster is configured to use. Once created, note the generated values for the new access key ID and secret access key.  These values will be used to replace the old access key.

The values for the access key ID and the secret access key are specified using environment variables named AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, respectively, in the spec.env stanza of your StorageCluster specification. 

Replace the existing values with the new values obtained in step (1) by editing your StorageCluster. Before saving changes, verify that the update strategy of your StorageCluster (spec.updateStrategy.type) is set to RollingUpdate. Once verified, save the access-related configuration changes. These changes will trigger a rolling restart of relevant Portworx-related pods. 

kubectl edit stc <storagecluster name> -n <namespace>

apiVersion: core.libopenstorage.org/v1
kind: StorageCluster
metadata:
  name: portworx-cluster
  namespace: kube-system
spec:
  ...
  ...
  ...
  env:
    - name: AWS_ACCESS_KEY_ID
      value: "<your-new-AWS_ACCESS_KEY_ID>"
    - name: AWS_SECRET_ACCESS_KEY
      value: "<your-new-AWS_SECRET_ACCESS_KEY>"
  ...
  ...
  ...
  updateStrategy:
    rollingUpdate:
      disruption:
        allow: true
      maxUnavailable: 1
    type: RollingUpdate

After saving the changes to your StorageCluster, validate that the Portworx pods have restarted and are running with the new credentials. Once confirmed, you can safely remove the old access key associated with the IAM user, given the user was not used by any other applications.

kubectl get pods -n portworx -l name=portworx
NAME                      READY   STATUS    RESTARTS   AGE
instant-tb-251803-dcmtc   1/1     Running   0          3m59s
instant-tb-251803-qpl4p   1/1     Running   0          3m8s
instant-tb-251803-r4cpz   1/1     Running   0          2m11s