ServiceUserRotation

Prerequisites¶

• A Kubernetes cluster with the operator installed using helm, kubectl or kind (for local development).
• A Kubernetes Secret with an Aiven authentication token.

Required permissions¶

To create and manage this resource, you must have the appropriate roles or permissions. See the Aiven documentation for details on managing permissions.

This resource uses the following API operations, and for each operation, any of the listed permissions is sufficient:

Usage example¶

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

apiVersion: aiven.io/v1alpha1
kind: ServiceUserRotation
metadata:
  name: application-users
spec:
  authSecretRef:
    name: aiven-token
    key: token

  project: my-aiven-project
  serviceName: my-postgresql

  # Create both users and configure their permissions before enabling rotation.
  usernames:
    - application-user-a
    - application-user-b
  rotationInterval: 720h

  connInfoSecretTarget:
    name: application-database-credentials
    prefix: SERVICEUSER_

Apply the resource with:

kubectl apply -f example.yaml

Verify the newly created ServiceUserRotation:

kubectl get serviceuserrotations application-users

The output is similar to the following:

Name                 Service Name     Project             Active User         Next Rotation       
application-users    my-postgresql    my-aiven-project    <activeUsername>    <nextRotationAt>    

To view the details of the Secret, use the following command:

kubectl describe secret application-database-credentials

You can use the jq to quickly decode the Secret:

kubectl get secret application-database-credentials -o json | jq '.data | map_values(@base64d)'

The output is similar to the following:

{
    "SERVICEUSER_HOST": "<secret>",
    "SERVICEUSER_PORT": "<secret>",
    "SERVICEUSER_USERNAME": "<secret>",
    "SERVICEUSER_PASSWORD": "<secret>",
    "SERVICEUSER_CA_CERT": "<secret>",
    "SERVICEUSER_ACCESS_CERT": "<secret>",
    "SERVICEUSER_ACCESS_KEY": "<secret>",
    "SERVICEUSER_SASL_HOST": "<secret>",
    "SERVICEUSER_SASL_PORT": "<secret>",
    "SERVICEUSER_SCHEMA_REGISTRY_HOST": "<secret>",
    "SERVICEUSER_SCHEMA_REGISTRY_PORT": "<secret>",
}

ServiceUserRotation¶

ServiceUserRotation rotates credentials between two Aiven service users and publishes the active user's connection details and credentials through a stable Kubernetes Secret. Users and their permissions must be managed separately. For ServiceUser resources, leave connInfoSecretSource unset and set connInfoSecretTargetDisabled to true at creation. Passwords are generated by the operator and sent to Aiven during rotation. The active user's password is not repaired if it changes or the user is recreated. See Service user rotation for lifecycle and limitations.

Reading connection details also requires service:secrets:read for ServiceGet with include_secrets=true.

Required

• apiVersion (string). Value aiven.io/v1alpha1.
• kind (string). Value ServiceUserRotation.
• metadata (object). Data that identifies the object, including a name string and optional namespace.
• spec (object). ServiceUserRotationSpec defines the desired state of ServiceUserRotation. See below for nested schema.

spec¶

Appears on ServiceUserRotation.

ServiceUserRotationSpec defines the desired state of ServiceUserRotation.

Required

• connInfoSecretTarget (object). ConnInfoSecretTarget specifies the dedicated Kubernetes Secret that stores the active connection details and credentials. The Secret is controlled by this resource and must not be shared. A name is required; the name and effective key prefix are immutable. An empty prefix defaults to SERVICEUSER_. See below for nested schema.
• project (string, Immutable, Pattern: ^[a-zA-Z0-9_-]+$, MaxLength: 63). Identifies the project this resource belongs to.
• rotationInterval (string). RotationInterval is the minimum time between scheduled credential rotations. Measured from the publication time saved in the connection Secret. Must be at least one hour.
• serviceName (string, Immutable, Pattern: ^[a-z][-a-z0-9]+$, MaxLength: 63). Specifies the name of the service that this resource belongs to.
• usernames (array of strings, Immutable, MaxItems: 2). Usernames lists two existing Aiven service users in rotation order. Create the users and configure their permissions before enabling rotation. This resource does not create or delete users or manage their permissions.

Optional

• authSecretRef (object). Authentication reference to Aiven token in a secret. See below for nested schema.

authSecretRef¶

Appears on spec.

Authentication reference to Aiven token in a secret.

Required

• key (string, MinLength: 1).
• name (string, MinLength: 1).

connInfoSecretTarget¶

Appears on spec.

ConnInfoSecretTarget specifies the dedicated Kubernetes Secret that stores the active connection details and credentials. The Secret is controlled by this resource and must not be shared. A name is required; the name and effective key prefix are immutable. An empty prefix defaults to SERVICEUSER_.

Required

• name (string, Immutable). Name of the secret resource to be created. By default, it is equal to the resource name.

Optional

• annotations (object, AdditionalProperties: string). Annotations added to the secret.
• labels (object, AdditionalProperties: string). Labels added to the secret.
• prefix (string). Prefix for the secret's keys. Added "as is" without any transformations. By default, is equal to the kind name in uppercase + underscore, e.g. KAFKA_, REDIS_, etc.