Updating database certificate in DBaaS
AKS-specific
- Launch an Azure CLI pod into the AKS cluster using the following command:
$ kubectl run az-cli --image=mcr.microsoft.com/azure-cli --command sleep infinity
Note:
Access to Azure Key Vault is restricted to specific subnets. Passwords stored in Azure Key Vault can be easily updated from a pod running in AKS.
- Exec into the Azure CLI pod as follows:
$ kubectl exec -it az-cli -- /bin/ash
- From Azure CLI pod, log into Azure account:
$ az login --scope https://graph.microsoft.com//.default
- (Optional) Create a key vault policy to allow the current user to retrieve the database credential.
Obtain the name of your resource group, key vault and ID of the current user by using the following respective commands:
Resource group name:
$ RESOURCE_GROUP=<resource_group_name>
Key vault name:
$ KEY_VAULT_NAME=$(az keyvault list --resource-group $RESOURCE_GROUP --resource-type vault | jq -r '.[].name')
Current user ID name:
$ USER_ID=$(az account show | jq -r '.user.name')
Create a key vault access policy as follows:
$ az keyvault set-policy -n $KEY_VAULT_NAME --upn $USER_ID --resource-group $RESOURCE_GROUP --secret-permissions all
- Store the updated certificate in key vault as follows:
$ DB_CERT_URL='https://cacerts.digicert.com/DigiCertGlobalRootCA.crt.pem'
$ DB_CERT_VALUE=$(curl -L "${DB_CERT_URL}" -s | awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}')
$ az keyvault secret set --vault-name $KEY_VAULT_NAME --name dbcertpem --value "$DB_CERT_VALUE"
- (Optional) Delete the key vault access policy created in step 4 above:
$ az keyvault delete-policy -n $KEYVAULT --upn $USER_ID
- Exit from the azure CLI pod:
$ exit
- Delete the az CLI pod:
$ kubectl delete pod az-cli
- (Applicable only for an existing cloudscale deployment) Restart the primary pod:
$ kubectl rollout restart "statefulset/${PRIMARY}" --namespace "${NAMESPACE}"
In the above command,
NAMESPACE is the namespace containing your NetBackup deployment
PRIMARY is the name of primary pod's stateful set
Use the following command to obtain NAMESPACE and PRIMARY:
$ kubectl get --namespace "${NAMESPACE}" primaryserver -o jsonpath='{.items[0].status.attributes.resourceName}'
EKS-specific
- Obtain the validity of AWS certificate as follows:
$ wget https://truststore.pki.rds.amazonaws.com/us-east-1/us-east-1-bundle.pem
$ openssl x509 -text -in ./us-east-1-bundle.pem
For example the certificate details are displayed as follows:
Certificate: Data: Version: 3 (0x2) Serial Number: c7:34:67:36:92:50:ae:75 Signature Algorithm: sha256WithRSAEncryption Issuer: C=US, L=Seattle, ST=Washington, O=Amazon Web Services, Inc., OU=Amazon RDS, CN=Amazon RDS Root 2019 CA Validity Not Before: Aug 22 17:08:50 2019 GMT Not After : Aug 22 17:08:50 2024 GMT Subject: C=US, L=Seattle, ST=Washington, O=Amazon Web Services, Inc., OU=Amazon RDS, CN=Amazon RDS Root 2019 CA... - Use lambda function to update the certificate.
LAMBDA_ARN is the ARN of the password changing lambda function. This can be obtained from the lambda function page on AWS console.
REGION=$(aws configure get region || true) DB_CERT_URL=https://truststore.pki.rds.amazonaws.com/${REGION}/${REGION}-bundle.pem DB_PROXY_CERT_URL=https://www.amazontrust.com/repository/AmazonRootCA1.pem DB_CERT_VALUE=$(curl -L "${DB_CERT_URL}" -s | awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}') DB_PROXY_CERT_VALUE=$(curl -L "${DB_PROXY_CERT_URL}" -s | awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}') DB_CUM_CERT_VALUE="$DB_CERT_VALUE$DB_PROXY_CERT_VALUE" tmp_file=$(mktemp /tmp/dbcert.XXXXXX.json) aws lambda invoke \ --function-name "$LAMBDA_ARN" \ --cli-binary-format raw-in-base64-out \ --payload "{\"dbcertpem\": \"${DB_CUM_CERT_VALUE}\"}" \ $tmp_file > /dev/null 2>&1 - Restart the primary pod:
$ kubectl rollout restart "statefulset/${PRIMARY}" --namespace "${NAMESPACE}"
In the above command,
NAMESPACE is the namespace containing your NetBackup deployment
PRIMARY is the name of primary pod's stateful set
Use the following command to obtain NAMESPACE and PRIMARY:
$ kubectl get --namespace "${NAMESPACE}" primaryserver -o jsonpath='{.items[0].status.attributes.resourceName}'