Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update rotate-user-aws-credentials.html.md.erb #5019

Merged
merged 2 commits into from
Nov 20, 2023
Merged

Update rotate-user-aws-credentials.html.md.erb #5019

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b39b0c4
Update rotate-user-aws-credentials.html.md.erb
pwyborn Nov 20, 2023
34c0d26
Commit changes made by code formatters
github-actions[bot] Nov 20, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions runbooks/source/rotate-user-aws-credentials.html.md.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
title: Rotate User Credentials
weight: 100
last_reviewed_on: 2023-09-27
last_reviewed_on: 2023-11-20
review_in: 6 months
---

Expand Down Expand Up @@ -34,7 +34,6 @@ make tools-shell
If the changes involve applying "pingdom_check", set the environment variables for pingdom.
The values are stored as secrets in `manager` cluster - `concourse-main` namespace.


## Target the live cluster

```bash
Expand Down Expand Up @@ -171,7 +170,7 @@ If this looks like it's going to do the right thing, enter 'yes' to confirm.

At this point, a new set of AWS credentials should have been created for the existing IAM user, and the kubernetes secret should contain the new access key and secret.

Note: It is possible that applications might experience downtime if, for example, a pod which was launched with the old password drops the connection to AWS and tries to open a new one (which will fail, because the password is no longer valid).
Note: It is possible that applications might experience downtime if, for example, a pod which was launched with the old password drops the connection to AWS and tries to open a new one (which will fail, because the password is no longer valid).
To make pods pick up the new password, perform a _manual_ rollout on every relevant deployment:
```bash
kubectl rollout restart "deployment/{deployment}" -namespace="{namespace}"
Expand Down