-
Couldn't load subscription status.
- Fork 169
Update ECK documentation for rotating credentials. #3488
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
Signed-off-by: Michael Montgomery <[email protected]>
deploy-manage/users-roles/cluster-or-deployment-auth/managed-credentials-eck.md
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
Updates ECK documentation to improve the credential rotation process by preventing accidental deletion of Kibana encryption keys. The change refines the kubectl command to exclude Kibana secrets and adds a warning note about previous documentation.
- Modified kubectl command to exclude Kibana secrets when rotating credentials
- Added explanatory note about why Kibana config secrets should not be deleted
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
🔍 Preview links for changed docs |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
approved with a suggestion
deploy-manage/users-roles/cluster-or-deployment-auth/managed-credentials-eck.md
Outdated
Show resolved
Hide resolved
…redentials-eck.md Co-authored-by: shainaraskas <[email protected]>
|
|
||
| ```sh | ||
| kubectl delete secret -l eck.k8s.elastic.co/credentials=true | ||
| kubectl delete secret -l eck.k8s.elastic.co/credentials=true,common.k8s.elastic.co/type!=kibana |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This will no longer be true since ECK 3.2. We are automatically excluding the Kibana form the credentials label.
| :::: | ||
|
|
||
| :::{note} | ||
| When deleting secrets so they can be regenerated, make sure to exclude {{kib}} secrets by specifying `type!=kibana`. {{kib}} secrets contain encryption keys, which should not be deleted. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We should qualify this statement to be true up to version 3.2.
@shainaraskas do you have a recommendation how we should best include instructions that only pertain to older versions of the software, without cluttering the whole docs page with exceptions?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'd suggest:
-
use an applies switch and put your code snippets in there. one tab for 3.0 and one for 3.2 - put your 3.2 tab first.
-
in your note, just preface it with 'In ECK versions 3.1 and earlier ...' 'In ECK versions prior to 3.2 ...'
Question
Related: elastic/cloud-on-k8s#8839