This procedure sets a new password on the Cassandra keystore and truststore. It also renews the Cassandra certificates.
Cassandra and the VeridiumID services restart during this procedure.
1. Prerequisites
-
OpenShift CLI (oc), logged in to the cluster.
-
The
veridiumidchart 0.9.1 or later, installed in the namespace.
2. Change the password
Connect to the maintenance pod:
oc -n $NAMESPACE exec -it deployment/vid-maintenance -- bash
In the maintenance pod, run the script:
bash /scripts/renew-cassandra-certificates.sh --reset-store-pass
At the end, the script shows restart commands. Do not run them. The steps that follow do the restarts.
3. Get the name of the k8ssandracluster
oc -n $NAMESPACE get k8ssandracluster
4. Restart Cassandra with the new password
Let the k8ssandra operator update Cassandra:
oc -n $NAMESPACE annotate k8ssandracluster <K8SSANDRA_CLUSTER> k8ssandra.io/autoupdate-spec=always --overwrite
Wait until each Cassandra datacenter is ready again.
5. Restart the VeridiumID services
oc -n $NAMESPACE rollout restart deployment vid-opa vid-websec vid-adservice vid-shibboleth vid-ssp vid-fido vid-websecadmin
6. Remove the annotation
oc -n $NAMESPACE annotate k8ssandracluster $K8SSANDRA_CLUSTER k8ssandra.io/autoupdate-spec- --overwrite