sigs.k8s.io/cluster-api-provider-aws@v1.5.5/docs/changing-credentials.md (about)

     1  # Changing Credentials
     2  
     3  Although `clusterctl init` embeds a set of AWS credentials into the configuration of the Cluster API Provider for AWS (CAPA) when initializing the management cluster, it may be necessary after deployment to change or update those AWS credentials.
     4  
     5  CAPA stores the credentials it uses as a Kubernetes Secret in the "capa-system" namespace. You can use `kubectl -n capa-system get secrets` and you'll see the "capa-manager-bootstrap-credentials" Secret. The credentials themselves are stored as a key named `credentials`; you can use this command to retrieve the credentials and decode them (if you're using macOS, change the `-d` to `-D`):
     6  
     7      kubectl -n capa-system get secret capa-manager-bootstrap-credentials \
     8      -o jsonpath="{.data.credentials}" | base64 -d
     9  
    10  The command will return something like this (but with valid access key ID, secret access key, and region values, obviously):
    11  
    12      [default]
    13      aws_access_key_id = <access-key-id-value-here>
    14      aws_secret_access_key = <secret-access-key-value-here>
    15      region = <aws-region-here>
    16  
    17  There are two ways to change the AWS credentials used by CAPA:
    18  
    19  1. As part of upgrading Cluster API components using `clusterctl upgrade`
    20  2. Manually
    21  
    22  ## When Upgrading Cluster API Components
    23  
    24  When upgrading the Cluster API components using `clusterctl upgrade` in a management cluster that has CAPA installed, `clusterctl` requires that the variable "AWS_B64ENCODED_CREDENTIALS" is defined with a value. This value is used by `clusterctl` to update the Kubernetes Secret described above. Thus, if the management cluster needs to be upgraded, users can change/update the AWS credentials used by CAPA as part of the upgrade process.
    25  
    26  The process would look like this:
    27  
    28  1. Use `clusterawsadm` to define the "AWS_B64ENCODED_CREDENTIALS" variable. With `clusterawsadm` 0.5.4 and earlier, the command is `clusterawsadm alpha bootstrap encode-aws-credentials`; with version 0.5.5 or later, the command is `clusterawsadm bootstrap credentials encode-as-profile`. Assign the output of this command to the "AWS_B64ENCODED_CREDENTIALS" variable. Users should ensure that `clusterawsadm` picks up the _new_ or _updated_ credentials when running this command.
    29  2. Use `clusterctl` to upgrade the management cluster, first by running `clusterctl upgrade plan` and then by running `clusterctl upgrade apply` (using the command provided in the output of `clusterctl upgrade plan`). As part of the upgrade process, the credentials stored in the "AWS_B64ENCODED_CREDENTIALS" variable will be placed into the Kubernetes Secret used by CAPA.
    30  
    31  If the management cluster does not need to be upgraded or can't be upgraded at the current time, then users will need to manually change the credentials.
    32  
    33  ## Manually Changing Credentials
    34  
    35  To manually change the credentials used by CAPA, follow these steps:
    36  
    37  1. Use `clusterawsadm` to create the material needed for the Kubernetes Secret. With `clusterawsadm` 0.5.5 and earlier, the command is `clusterawsadm alpha bootstrap encode-aws-credentials`; with version 0.6.0 or later, the command is `clusterawsadm bootstrap credentials encode-as-profile`. Record the output of this command, as it is needed in a later step.
    38  2. Use `kubectl -n capa-system edit secret capa-manager-bootstrap-credentials` to edit the Secret. Replace the existing value of the `data.credentials` field with the new value created in step 1 using `clusterawsadm`. Save your changes.
    39  3. For the CAPA controller manager to pick up the new credentials in the Secret, restart it with `kubectl -n capa-system rollout restart deployment capa-controller-manager`.
    40  
    41  Upon restart, CAPA will now use the updated credentials in the Secret to communicate with AWS.