|
| 1 | +--- |
| 2 | +Title: Manage Redis Enterprise credentials |
| 3 | +aliases: [/operate/kubernetes/security/manage-rec-credentials/] |
| 4 | +alwaysopen: false |
| 5 | +categories: |
| 6 | +- docs |
| 7 | +- operate |
| 8 | +- kubernetes |
| 9 | +description: Retrieve and rotate Redis Enterprise cluster (REC) admin credentials and Redis Enterprise database (REDB) passwords on Kubernetes. |
| 10 | +linkTitle: Manage credentials |
| 11 | +weight: 93 |
| 12 | +--- |
| 13 | + |
| 14 | +Redis Enterprise for Kubernetes stores both cluster admin credentials and database passwords in Kubernetes [secrets](https://kubernetes.io/docs/concepts/configuration/secret/). The operator reconciles changes to these secrets and applies them to the cluster, so you rotate credentials by updating the secret rather than calling the cluster API directly. |
| 15 | + |
| 16 | +{{<note>}} |
| 17 | +The procedures on this page are supported for operator versions 6.0.20-12 and later. |
| 18 | +{{</note>}} |
| 19 | + |
| 20 | +## Redis Enterprise cluster (REC) credentials |
| 21 | + |
| 22 | +The [`RedisEnterpriseCluster`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_cluster_api" >}}) custom resource generates random admin credentials during cluster creation. The credentials are stored in a Kubernetes secret named by the `clusterCredentialSecretName` field (defaults to the cluster name). |
| 23 | + |
| 24 | +### Retrieve the REC username and password |
| 25 | + |
| 26 | +REC credentials authenticate to the Redis Enterprise admin console or REST API. You need cluster connectivity through a service or port forwarding. |
| 27 | + |
| 28 | +1. Read the secret created by the operator: |
| 29 | + |
| 30 | + ```sh |
| 31 | + kubectl get secret rec -o jsonpath='{.data}' |
| 32 | + ``` |
| 33 | + |
| 34 | + The command outputs the base64-encoded password and username: |
| 35 | + |
| 36 | + ```sh |
| 37 | + map[password:MTIzNDU2NzgK username:ZGVtb0BleGFtcGxlLmNvbQo=] |
| 38 | + ``` |
| 39 | + |
| 40 | +1. Decode each value: |
| 41 | + |
| 42 | + ```sh |
| 43 | + echo MTIzNDU2NzgK | base64 --decode |
| 44 | + ``` |
| 45 | + |
| 46 | + In this example, the plain text password is `12345678` and the username is `demo@example.com`. |
| 47 | + |
| 48 | +### Change the REC password for the current username |
| 49 | + |
| 50 | +1. Open a shell in a Redis Enterprise [pod](https://kubernetes.io/docs/concepts/workloads/pods/): |
| 51 | + |
| 52 | + ```sh |
| 53 | + kubectl exec -it <rec-resource-name>-0 -c redis-enterprise-node -- /bin/bash |
| 54 | + ``` |
| 55 | + |
| 56 | +2. Add a new password for the existing user: |
| 57 | + |
| 58 | + ```bash |
| 59 | + REC_USER="`cat /opt/redislabs/credentials/username`" \ |
| 60 | + REC_PASSWORD="`cat /opt/redislabs/credentials/password`" \ |
| 61 | + curl -k --request POST \ |
| 62 | + --url https://localhost:9443/v1/users/password \ |
| 63 | + -u "$REC_USER:$REC_PASSWORD" \ |
| 64 | + --header 'Content-Type: application/json' \ |
| 65 | + --data "{\"username\":\"$REC_USER\", \ |
| 66 | + \"old_password\":\"$REC_PASSWORD\", \ |
| 67 | + \"new_password\":\"<NEW PASSWORD>\"}" |
| 68 | + ``` |
| 69 | + |
| 70 | +3. From outside the pod, update the REC credential secret: |
| 71 | + |
| 72 | + ```sh |
| 73 | + kubectl create secret generic <cluster_secret_name> \ |
| 74 | + --save-config \ |
| 75 | + --dry-run=client \ |
| 76 | + --from-literal=username=<current-username> \ |
| 77 | + --from-literal=password=<new-password> \ |
| 78 | + -o yaml | \ |
| 79 | + kubectl apply -f - |
| 80 | + ``` |
| 81 | + |
| 82 | +4. Wait five minutes for all components to read the new password. Proceeding too soon can lock the account. |
| 83 | + |
| 84 | +5. Open a shell in the pod again: |
| 85 | + |
| 86 | + ```sh |
| 87 | + kubectl exec -it <rec-resource-name>-0 -c redis-enterprise-node -- /bin/bash |
| 88 | + ``` |
| 89 | + |
| 90 | +6. Remove the previous password so only the new one applies: |
| 91 | + |
| 92 | + ```sh |
| 93 | + REC_USER="`cat /opt/redislabs/credentials/username`"; \ |
| 94 | + REC_PASSWORD="`cat /opt/redislabs/credentials/password`"; \ |
| 95 | + curl -k --request DELETE \ |
| 96 | + --url https://localhost:9443/v1/users/password \ |
| 97 | + -u "$REC_USER:$REC_PASSWORD" \ |
| 98 | + --header 'Content-Type: application/json' \ |
| 99 | + --data "{\"username\":\"$REC_USER\", \ |
| 100 | + \"old_password\":\"<OLD PASSWORD\"}" |
| 101 | + ``` |
| 102 | + |
| 103 | +{{<note>}} |
| 104 | +The username in the K8s secret is the email displayed in the Redis Enterprise admin console. |
| 105 | +{{</note>}} |
| 106 | + |
| 107 | +### Change both the REC username and password |
| 108 | + |
| 109 | +1. [Connect to the admin console]({{< relref "/operate/kubernetes/re-clusters/connect-to-admin-console.md" >}}). |
| 110 | + |
| 111 | +2. [Add another admin user]({{< relref "/operate/rs/security/access-control/create-users" >}}) and choose a new password. |
| 112 | + |
| 113 | +3. Set the new username in the `username` field of your REC custom resource spec. |
| 114 | + |
| 115 | +4. Update the REC credential secret: |
| 116 | + |
| 117 | + ```sh |
| 118 | + kubectl create secret generic <cluster_secret_name> \ |
| 119 | + --save-config \ |
| 120 | + --dry-run=client \ |
| 121 | + --from-literal=username=<new-username> \ |
| 122 | + --from-literal=password=<new-password> \ |
| 123 | + -o yaml | \ |
| 124 | + kubectl apply -f - |
| 125 | + ``` |
| 126 | + |
| 127 | +5. Wait five minutes for all components to read the new password. Proceeding too soon can lock the account. |
| 128 | + |
| 129 | +6. Delete the previous admin user from the cluster. |
| 130 | + |
| 131 | +{{<note>}} |
| 132 | +The operator may log errors between updating the username in the REC spec and updating the secret. |
| 133 | +{{</note>}} |
| 134 | + |
| 135 | +### Update the REC credentials secret in Vault |
| 136 | + |
| 137 | +If you store secrets in HashiCorp Vault, update the REC credential secret with these key-value pairs: |
| 138 | + |
| 139 | +```sh |
| 140 | +username:<desired_username>, password:<desired_password> |
| 141 | +``` |
| 142 | + |
| 143 | +For more details, see [Integrate Redis Enterprise for Kubernetes with HashiCorp Vault](https://github.com/RedisLabs/redis-enterprise-k8s-docs/blob/master/vault/README.md). |
| 144 | + |
| 145 | +## Redis Enterprise database (REDB) password |
| 146 | + |
| 147 | +Each [`RedisEnterpriseDatabase`]({{< relref "/operate/kubernetes/reference/api/redis_enterprise_database_api" >}}) resource has a password stored under the `password` key of the secret named by `spec.databaseSecretName`. If you don't set `databaseSecretName`, the operator creates a secret named `redb-<database-name>` with a random password and updates the REDB spec to reference it. |
| 148 | +
|
| 149 | +The operator reads the `password` key on every reconciliation and applies it to the database, so you rotate the password by updating the secret. |
| 150 | +
|
| 151 | +### Retrieve the REDB password |
| 152 | +
|
| 153 | +1. Find the secret name for the database: |
| 154 | +
|
| 155 | + ```sh |
| 156 | + kubectl get redb <database-name> -o jsonpath="{.spec.databaseSecretName}" |
| 157 | + ``` |
| 158 | +
|
| 159 | +2. Decode the password: |
| 160 | +
|
| 161 | + ```sh |
| 162 | + kubectl get secret <secret-name> -o jsonpath="{.data.password}" | base64 --decode |
| 163 | + ``` |
| 164 | +
|
| 165 | +### Change the REDB password |
| 166 | +
|
| 167 | +{{<note>}} |
| 168 | +If the REDB spec sets `defaultUser: false`, the operator does not create or update the database secret. Rotating the secret has no effect in that mode — manage credentials through [Redis ACLs]({{< relref "/operate/rs/security/access-control/create-roles" >}}) instead. |
| 169 | +{{</note>}} |
| 170 | +
|
| 171 | +1. Base64-encode the new password. Use `echo -n` to avoid encoding a trailing newline: |
| 172 | +
|
| 173 | + ```sh |
| 174 | + echo -n '<new-password>' | base64 |
| 175 | + ``` |
| 176 | +
|
| 177 | +2. Patch the secret with the encoded value: |
| 178 | +
|
| 179 | + ```sh |
| 180 | + kubectl patch secret <secret-name> -p='{"data":{"password":"<base64-encoded-password>"}}' |
| 181 | + ``` |
| 182 | +
|
| 183 | + To edit the secret interactively, use `kubectl edit secret <secret-name>` and replace the `password` value. |
| 184 | +
|
| 185 | +3. Verify that the operator applied the change. The REDB status moves to `active-change-pending` while the update is in flight and returns to `active` when complete: |
| 186 | +
|
| 187 | + ```sh |
| 188 | + kubectl get redb <database-name> -o jsonpath='{.status.status}' |
| 189 | + ``` |
| 190 | +
|
| 191 | + Then test the new password with a Redis client: |
| 192 | +
|
| 193 | + ```sh |
| 194 | + redis-cli -h <service-name> -p <port> -a '<new-password>' PING |
| 195 | + ``` |
| 196 | +
|
| 197 | +To disable authentication for the default user, set the `password` value to an empty string. |
| 198 | +
|
| 199 | +#### Impact on existing client connections |
| 200 | +
|
| 201 | +Existing client connections authenticated with the old password remain open — Redis Enterprise does not drop sessions when the password changes. New connections, and any `AUTH` commands issued on existing connections, must use the new password. Coordinate the secret update with your client configuration to avoid authentication errors. |
| 202 | +
|
| 203 | +{{<note>}} |
| 204 | +For Active-Active databases, the database secret is not created automatically. See [Create a global database secret]({{< relref "/operate/kubernetes/active-active/global-db-secret" >}}). |
| 205 | +{{</note>}} |
0 commit comments