|
| 1 | +--- |
| 2 | +title: Updating the credentials for GitHub Actions storage |
| 3 | +shortTitle: Updating credentials for Actions storage |
| 4 | +intro: If your credentials for connecting to GitHub Actions storage change, you must update the credentials in the configuration on GitHub Enterprise Server. |
| 5 | +versions: |
| 6 | + ghes: '*' |
| 7 | +contentType: how-tos |
| 8 | +category: |
| 9 | + - Enable GitHub features for your enterprise |
| 10 | +--- |
| 11 | + |
| 12 | +## Updating the credential secret for your storage provider |
| 13 | +To update the credential secret for your {% data variables.product.prodname_actions %} storage provider on {% data variables.product.prodname_ghe_server %}, you have two options. |
| 14 | + |
| 15 | +> [!WARNING] |
| 16 | +> This process is only for updating the secret key used to authenticate to your existing external storage provider. It assumes that your networking configuration, storage provider, and storage account remain unchanged. |
| 17 | +> |
| 18 | +> Do not use this process to switch between credential-based and OIDC-based authentication in the management console. Changing the authentication method for {% data variables.product.prodname_actions %} storage may result in data loss. |
| 19 | +
|
| 20 | +1. Enable maintenance mode on the server. |
| 21 | +1. Update the secret or obtain the updated secret from the storage provider. |
| 22 | +1. Use the UI or CLI option below to update the {% data variables.product.prodname_actions %} storage provider credential for {% data variables.product.prodname_ghe_server %}. |
| 23 | + |
| 24 | +### Updating the credential secret using the management console |
| 25 | +1. Navigate to the Actions section of the **Management Console**. For more information, see [AUTOTITLE](/admin/administering-your-instance/administering-your-instance-from-the-web-ui/accessing-the-management-console). |
| 26 | +1. Update the secret, or in the case of Azure Blob storage, the secret within the connection string, and then click `Test storage settings` to confirm that {% data variables.product.prodname_ghe_server %} is still able to successfully connect to the storage. |
| 27 | +1. Click `Save settings` and wait for the services to fully restart. |
| 28 | + |
| 29 | +### Updating the credential secret using the command line |
| 30 | +1. Run the `ghe-actions-precheck` command to test the new Actions storage credentials and update the configuration on your {% data variables.product.prodname_ghe_server %}. For more information, see [AUTOTITLE](/admin/administering-your-instance/administering-your-instance-from-the-command-line/command-line-utilities#ghe-actions-precheck) |
| 31 | +1. After the Actions storage connection test is successful, you'll prompted to type `Yes` or `No` to configure Actions storage with these settings. Type `Yes` and Enter. |
| 32 | +1. You'll see a prompt about overwriting the existing Actions storage configuration. Type `Yes` and Enter. |
| 33 | + |
| 34 | +## Identifying authentication failures for {% data variables.product.prodname_actions %} storage |
| 35 | +If {% data variables.product.prodname_ghe_server %} can't connect to your {% data variables.product.prodname_actions %} storage provider because of an incorrect secret or connection string, you'll see an `Access Denied` or authentication-related exception. This exception can appear in two situations: |
| 36 | + |
| 37 | +* When running `ghe-check-blob-connection`, the command will report the authentication failure directly in its output. |
| 38 | +* When `ghe-config-apply` runs, either triggered by clicking "Save settings" in the management console, or by running `ghe-config-apply` manually from the command line. The exception will appear in the `/data/user/common/ghe-config.log` file. When this occurs, `ghe-config-apply` won't complete, which can cause an unexpected outage of services on your appliance. |
| 39 | + |
| 40 | +Once the storage provider configuration on {% data variables.product.prodname_ghe_server %} is updated with the correct secret or connection string, you can run `ghe-config-apply` to ensure the job re-runs and completes successfully. |
| 41 | + |
| 42 | +> [!NOTE] Connection failures can also result from other causes, such as network issues or misconfigured storage endpoints. If the error doesn't appear to be authentication-related, review the full error output for additional details. |
| 43 | +
|
| 44 | +For more information on `ghe-check-blob-connection`, see [AUTOTITLE](/admin/administering-your-instance/administering-your-instance-from-the-command-line/command-line-utilities#ghe-check-blob-connection). |
| 45 | +For more information on `ghe-config-apply`, see [AUTOTITLE](/admin/administering-your-instance/administering-your-instance-from-the-command-line/command-line-utilities#ghe-config-apply). |
0 commit comments