K8s/Openshift - Maintenance Operations

1. Change the HAProxy configuration

The ConfigMap vid-haproxy-config in the deployment namespace holds the HAProxy configuration.

# edit the configuration
oc edit configmap -n <NAMESPACE> vid-haproxy-config
# restart HAProxy (DaemonSet, the default)
oc rollout restart -n <NAMESPACE> daemonset/vid-haproxy
# restart HAProxy (Deployment, when vid-haproxy.runAsDaemonSet is false)
oc rollout restart -n <NAMESPACE> deployment/vid-haproxy

2. Change a ConfigMap or Secret

2.1. Prerequisites

• OpenShift CLI (oc) or kubectl

2.2. Use the command line

# for a configmap:
oc -n <NAMESPACE> edit configmap <CONFIGMAP_NAME>

# for a secret:
oc -n <NAMESPACE> edit secret <SECRET_NAME>

The command opens the default editor of the environment. Change the content, then save and close the editor.

2.3. Use the web console

1. In the sidebar menu, go to Workloads - ConfigMaps or Workloads - Secrets.

2. Find the ConfigMap or Secret. Click the three dots at the right end of its line.

3. Select "Edit ConfigMap" or "Edit Secret".

4. Change the content, then click "Save".

3. Restart

3.1. Prerequisites

Install this software on the machine that you use to deploy VeridiumID:

• Helm 3. To see the installed version, run helm version.

• OpenShift CLI (oc) or kubectl

3.2. Rolling restart

A rolling restart replaces the pods of an application one at a time, with no downtime:

oc -n <NAMESPACE> rollout restart deployment <NAME_OF_APPLICATION>

HAProxy runs as a DaemonSet by default, and as a Deployment when vid-haproxy.runAsDaemonSet is false. Restart the object that exists:

oc -n <NAMESPACE> rollout restart daemonset vid-haproxy
oc -n <NAMESPACE> rollout restart deployment vid-haproxy

3.3. Hard restart

If a rolling restart does not solve the problem, uninstall the veridiumid chart, then install it again. The data and the configuration stay.

Use the veridiumid-values.yaml file of the last installation or upgrade. If you do not have it, get it from the release:

helm get values -n <NAMESPACE> veridiumid > values/veridiumid-values.yaml

Run these commands from the directory of the bundle:

# uninstall
helm -n <NAMESPACE> delete veridiumid
# install again
helm upgrade --install -n <NAMESPACE> -f values/veridiumid-values.yaml veridiumid helm/veridiumid-1.0.4.tgz

4. Backup and restore

For the backup and the restore of Cassandra, Zookeeper, Elasticsearch, ConfigMaps and Secrets, see the Backup and Restore Guide.

5. After a reinstall of Elasticsearch

A reinstall of Elasticsearch replaces its certificate and the password of the elastic user. Give the new values to VeridiumID:

1. Get the new certificate from the Secret elasticsearch-<ENV_NO>-es-http-certs-public. Save ca.crt and tls.crt on your computer.

2. In WebsecAdmin, go to Settings - Certificates - Truststores. Remove the old Elasticsearch certificate and upload the new one.

3. Get the new password from the Secret elasticsearch-<ENV_NO>-es-elastic-user.

4. In the vid-maintenance pod, make a new API key:

   curl -k -u elastic:<password> -X POST "https://elasticsearch-<ENV_NO>-es-http:9200/_security/api_key" -H 'Content-Type: application/json' -d'
   {
       "name": "veridium-api-key-10000"
   }
   '
   
   

   The output is similar to this:

   JSON

   {"id":"ABUIDIkBHzbsPdcpPRum","name":"veridium-api-key-10000","api_key":"MbZenHibSh6Lxc143YJf1Q","encoded":"QUJVSURJa0JIemJzUGRjcFBSdW06TWJaZW5IaWJTaDZMeGMxNDNZSmYxUQ=="}
   
   

   Keep the value of encoded.

5. In WebsecAdmin, go to Settings - Advanced. In elasticsearch.json, set apiKey to the encoded value and credentials.pass to the new password:

   ... truncate ...
           "apiKey": "QUJVSURJa0JIemJzUGRjcFBSdW06TWJaZW5IaWJTaDZMeGMxNDNZSmYxUQ==",
           ... truncate ...
           "credentials": {
               "pass": "<password>",
               ... truncate ...
           },
   ... truncate ...
   
   

6. Restart the applications:

   kubectl rollout restart -n <NAMESPACE> deployment/vid-websec
   kubectl rollout restart -n <NAMESPACE> deployment/vid-websecadmin
   kubectl rollout restart -n <NAMESPACE> deployment/vid-shibboleth
   kubectl rollout restart -n <NAMESPACE> deployment/vid-ssp
   kubectl rollout restart -n <NAMESPACE> deployment/vid-adservice
   kubectl rollout restart -n <NAMESPACE> deployment/vid-fido
   kubectl rollout restart -n <NAMESPACE> deployment/vid-freeradius
   kubectl rollout restart -n <NAMESPACE> deployment/vid-maintenance
   kubectl rollout restart -n <NAMESPACE> deployment/vid-opa
   

Last updated: October 15, 2026