Chapter 5. Changing the default account credentials to ensure better security in the Multicloud Object Gateway

Procedure

1. Get the account name.

   For listing the accounts, run the following command:

   $ noobaa account list

   Copy to Clipboard Toggle word wrap

   Example output:

   NAME           ALLOWED_BUCKETS   DEFAULT_RESOURCE               PHASE   AGE
   account-test   [*]               noobaa-default-backing-store   Ready   14m17s
   test2          [first.bucket]    noobaa-default-backing-store   Ready   3m12s

   Copy to Clipboard Toggle word wrap

   Alternatively, run the oc get noobaaaccount command from the terminal:

   $ oc get noobaaaccount

   Copy to Clipboard Toggle word wrap

   Example output:

   NAME           PHASE   AGE
   account-test   Ready   15m
   test2          Ready   3m59s

   Copy to Clipboard Toggle word wrap

2. To regenerate the noobaa account S3 credentials, run the following command:

   $ noobaa account regenerate <noobaa_account_name> [options]

   Copy to Clipboard Toggle word wrap

   $ noobaa account regenerate
   FATA[0000] ❌ Missing expected arguments: <noobaa-account-name>
   
   Usage:
       noobaa account regenerate <noobaa-account-name> [flags] [options]
   
   Use "noobaa options" for a list of global command-line options (applies to all commands).

   Copy to Clipboard Toggle word wrap

3. Once you run the noobaa account regenerate command it will prompt a warning that says "This will invalidate all connections between S3 clients and NooBaa which are connected using the current credentials.", and ask for confirmation:

   Example:

   $ noobaa account regenerate account-test

   Copy to Clipboard Toggle word wrap

   Example output:

   INFO[0000] You are about to regenerate an account's security credentials.
   INFO[0000] This will invalidate all connections between S3 clients and NooBaa which are connected using the current credentials.
   INFO[0000] are you sure? y/n

   Copy to Clipboard Toggle word wrap

4. On approving, it will regenerate the credentials and eventually print them:

   INFO[0015] ✅ Exists: Secret "noobaa-account-account-test"
   Connection info:
   AWS_ACCESS_KEY_ID      : ***
   AWS_SECRET_ACCESS_KEY  : ***

   Copy to Clipboard Toggle word wrap

Procedure

1. To get the OBC name, run the following command:

   $ noobaa obc list

   Copy to Clipboard Toggle word wrap

   Example output:

   NAMESPACE   NAME       BUCKET-NAME                                     STORAGE-CLASS       BUCKET-CLASS                  PHASE
   default     obc-test   obc-test-35800e50-8978-461f-b7e0-7793080e26ba   default.noobaa.io   noobaa-default-bucket-class   Bound

   Copy to Clipboard Toggle word wrap

   Alternatively, run the oc get obc command from the terminal:

   $ oc get obc

   Copy to Clipboard Toggle word wrap

   Example output:

   NAME       STORAGE-CLASS       PHASE   AGE
   obc-test   default.noobaa.io   Bound   38s

   Copy to Clipboard Toggle word wrap

2. To regenerate the noobaa OBC S3 credentials, run the following command:

   $ noobaa obc regenerate <bucket_claim_name> [options]

   Copy to Clipboard Toggle word wrap

   $ noobaa obc regenerate
   FATA[0000] ❌ Missing expected arguments: <bucket-claim-name>
   
   Usage:
      noobaa obc regenerate <bucket-claim-name> [flags] [options]
   
   Use "noobaa options" for a list of global command-line options (applies to all commands).

   Copy to Clipboard Toggle word wrap

3. Once you run the noobaa obc regenerate command it will prompt a warning that says "This will invalidate all connections between the S3 clients and noobaa which are connected using the current credentials.", and ask for confirmation:

   Example:

   $ noobaa obc regenerate obc-test

   Copy to Clipboard Toggle word wrap

   Example output:

   INFO[0000] You are about to regenerate an OBC's security credentials.
   INFO[0000] This will invalidate all connections between S3 clients and NooBaa which are connected using the current credentials.
   INFO[0000] are you sure? y/n

   Copy to Clipboard Toggle word wrap

4. On approving, it will regenerate the credentials and eventually print them:

   INFO[0022] ✅ RPC: bucket.read_bucket() Response OK: took 95.4ms
   
   ObjectBucketClaim info:
     Phase                  : Bound
     ObjectBucketClaim      : kubectl get -n default objectbucketclaim obc-test
     ConfigMap              : kubectl get -n default configmap obc-test
     Secret                 : kubectl get -n default secret obc-test
     ObjectBucket           : kubectl get objectbucket obc-default-obc-test
     StorageClass           : kubectl get storageclass default.noobaa.io
     BucketClass            : kubectl get -n default bucketclass noobaa-default-bucket-class
   
   Connection info:
    BUCKET_HOST            : s3.default.svc
    BUCKET_NAME            : obc-test-35800e50-8978-461f-b7e0-7793080e26ba
       BUCKET_PORT            : 443
       AWS_ACCESS_KEY_ID      : ***
       AWS_SECRET_ACCESS_KEY  : ***
   
   Shell commands:
     AWS S3 Alias           : alias s3='AWS_ACCESS_KEY_ID=***
   AWS_SECRET_ACCESS_KEY=*** aws s3 --no-verify-ssl --endpoint-url ***'
   
   Bucket status:
     Name                   : obc-test-35800e50-8978-461f-b7e0-7793080e26ba
     Type                   : REGULAR
     Mode                   : OPTIMAL
     ResiliencyStatus       : OPTIMAL
     QuotaStatus            : QUOTA_NOT_SET
     Num Objects            : 0
     Data Size              : 0.000 B
     Data Size Reduced      : 0.000 B
     Data Space Avail       : 13.261 GB
     Num Objects Avail      : 9007199254740991

   Copy to Clipboard Toggle word wrap