Rotação de Credenciais de Armazenamento de Blobs

Gire credenciais de armazenamento de blob para o Process Mining no Automation Suite no OpenShift.

Introdução

Para rotacionar as credenciais de armazenamento de blobs para o Process Mining no Automation Suite, um administrador precisará ter acesso aos segredos do cluster Kubernetes usando kubectl, oc, Len ou outra ferramenta. Os segredos armazenados devem ser atualizados com as novas credenciais, e os pods para o Airflow e o Process Mining precisam ser reiniciados para garantir que todos os pods para esses serviços recebam as novas credenciais.

Observação:

As credenciais de armazenamento precisam ser atualizadas no namespace. <uipath>

Observação:

The stored secret values are base 64 encoded. If using kubectl you will need to encode the values before updating them in the cluster. If using Lens (k8slens) then the Lens tooling can do the decode/encode automatically.

Exemplos

O seguinte exemplo mostra como atualizar segredos:

oc patch secret processmining-external-storage-secret -n <uipath> -p "{\"data\":{\"ACCOUNTKEY\":\"<new_key_b64>\"}}"

Segredos do Ceph

Espaço de nomes UiPath

• processmining-service-rook-ceph-secret.OBJECT_STORAGE_ACCESSKEY
• processmining-service-rook-ceph-secret.OBJECT_STORAGE_SECRETKEY

Segredos do Minio

Espaço de nomes UiPath

• processmining-external-storage-secret.ACCESSKEY
• processmining-external-storage-secret.SECRETKEY

Segredos S3

Espaço de nomes UiPath

• processmining-external-storage-secret.ACCESSKEY
• processmining-external-storage-secret.SECRETKEY

Segredos do Azure

Espaço de nomes UiPath

• processmining-external-storage-secret.ACCOUNTNAME
• processmining-external-storage-secret.ACCOUNTKEY

Observação:

Azure connection string is URL encoded; the string will need to be decoded, have the access key updated, then re-encoded.

urlencode -d "wasb%3A%2F%2Fazureuser%40%3Fextra__wasb__connection_string%3DDefaultEndpointsProtocol%3Dhttps%3BEndpointSuffix%3Dcore.windows.net%3BAccountName%3Dazureuser%3BAccountKey%3DACCOUNT_KEY%3BBlobEndpoint%3Dhttps%3A%2F%2Fexample.blob.core.windows.net%2F%3BFileEndpoint%3Dhttps%3A%2F%2Fexample.file.core.windows.net%2F%3BQueueEndpoint%3Dhttps%3A%2F%2Fexample.queue.core.windows.net%2F%3BTableEndpoint%3Dhttps%3A%2F%2Fexample.table.core.windows.net%2F%26extra__wasb__sas_token%3D%26extra__wasb__shared_access_key%3D%26extra__wasb__tenant_id%3D"
urlencode "wasb://azureuser@?extra__wasb__connection_string=DefaultEndpointsProtocol=https;EndpointSuffix=core.windows.net;AccountName=azureuser;AccountKey=ACCOUNT_KEY;BlobEndpoint=https://example.blob.core.windows.net/;FileEndpoint=https://example.file.core.windows.net/;QueueEndpoint=https://example.queue.core.windows.net/;TableEndpoint=https://example.table.core.windows.net/&extra__wasb__sas_token=&extra__wasb__shared_access_key=&extra__wasb__tenant_id="