サポートコンソール開発者トライアルの開始お問い合わせ

第6章 Securing Multicloud Object Gateway

6.1. Changing the default account credentials to ensure better security in the Multicloud Object Gateway
リンクのコピー

Change and rotate your Multicloud Object Gateway (MCG) account credentials using the command-line interface to prevent issues with applications, and to ensure better account security.

6.1.1. Resetting the noobaa account password
リンクのコピー

Prerequisites

  • A running OpenShift Data Foundation cluster.

  • Download the Multicloud Object Gateway (MCG) command-line interface binary from the customer portal and make it executable.

    注記

    Choose the correct product variant according to your architecture. Available platforms are Linux(x86_64), Windows, and Mac OS.

Procedure

  • To reset the noobaa account password, run the following command: 

    $ noobaa account passwd <noobaa_account_name> [options]
     
    $ noobaa account passwd
FATA[0000] ❌ Missing expected arguments: <noobaa_account_name>

Options:
    --new-password='': New Password for authentication - the best practice is to omit this flag, in that
    case the CLI will prompt to prompt and read it securely from the terminal to avoid leaking secrets in t
     he shell history
    --old-password='': Old Password for authentication - the best practice is to omit this flag, in that
    case the CLI will prompt to prompt and read it securely from the terminal to avoid leaking secrets in
    the shell history
    --retype-new-password='': Retype new Password for authentication - the best practice is to omit this flag, in that case the CLI will prompt to prompt and read it securely from the terminal to avoid
    leaking secrets in the shell history


Usage:
    noobaa account passwd <noobaa-account-name> [flags] [options]

Use "noobaa options" for a list of global command-line options (applies to all commands).

    Example: 

    $ noobaa account passwd admin@noobaa.io

    Example output: 

    Enter old-password: [got 24 characters]
Enter new-password: [got 7 characters]
Enter retype-new-password: [got 7 characters]
INFO[0017] ✅ Exists: Secret "noobaa-admin"
INFO[0017] ✅ Exists: NooBaa "noobaa"
INFO[0017] ✅ Exists: Service "noobaa-mgmt"
INFO[0017] ✅ Exists: Secret "noobaa-operator"
INFO[0017] ✅ Exists: Secret "noobaa-admin"
INFO[0017] ✈️  RPC: account.reset_password() Request: {Email:admin@noobaa.io VerificationPassword:* Password:*}
WARN[0017] RPC: GetConnection creating connection to wss://localhost:58460/rpc/ 0xc000402ae0
INFO[0017] RPC: Connecting websocket (0xc000402ae0) &{RPC:0xc000501a40 Address:wss://localhost:58460/rpc/ State:init WS:<nil> PendingRequests:map[] NextRequestID:0
Lock:{state:1 sema:0} ReconnectDelay:0s cancelPings:<nil>}
INFO[0017] RPC: Connected websocket (0xc000402ae0) &{RPC:0xc000501a40 Address:wss://localhost:58460/rpc/ State:init WS:<nil> PendingRequests:map[] NextRequestID:0
Lock:{state:1 sema:0} ReconnectDelay:0s cancelPings:<nil>}
INFO[0020] ✅ RPC: account.reset_password() Response OK: took 2907.1ms
INFO[0020] ✅ Updated:  "noobaa-admin"
INFO[0020] ✅ Successfully reset the password for the account "admin@noobaa.io"
    重要

    To access the admin account credentials run the noobaa status command from the terminal: 

    --------------------
- Mgmt Credentials -
--------------------

email    : admin@noobaa.io
password : ***

6.1.2. Setting Multicloud Object Gateway account credentials using CLI command
リンクのコピー

You can update and verify the Multicloud Object Gateway (MCG) account credentials manually by using the MCG CLI command.

Prerequisites

Ensure that the following prerequisites are met:

  • A running OpenShift Data Foundation cluster.
  • Download the Multicloud Object Gateway (MCG) command-line interface binary from the customer portal and make it executable.
注記

Choose the correct product variant according to your architecture. Available platforms are Linux(x86_64), Windows, and Mac OS.

Procedure

  • To update the MCG account credentials, run the following command: 

    $ noobaa account credentials <noobaa-account-name> [options]

    Example: 

    $ noobaa account credentials admin@noobaa.io

    Example output: 

    $ noobaa account credentials admin@noobaa.io
Enter access-key: [got 20 characters]
Enter secret-key: [got 40 characters]
INFO[0026] ❌ Not Found: NooBaaAccount "admin@noobaa.io"
INFO[0026] ✅ Exists: NooBaa "noobaa"
INFO[0026] ✅ Exists: Service "noobaa-mgmt"
INFO[0026] ✅ Exists: Secret "noobaa-operator"
INFO[0026] ✅ Exists: Secret "noobaa-admin"
INFO[0026] ✈️  RPC: account.update_account_keys() Request: {Email:admin@noobaa.io AccessKeys:{AccessKey:* SecretKey:}} WARN[0026] RPC: GetConnection creating connection to wss://localhost:33495/rpc/ 0xc000cd9980 INFO[0026] RPC: Connecting websocket (0xc000cd9980) &{RPC:0xc0001655e0 Address:wss://localhost:33495/rpc/ State:init WS:<nil> PendingRequests:map[] NextRequestID:0 Lock:{state:1 sema:0} ReconnectDelay:0s cancelPings:<nil>} INFO[0026] RPC: Connected websocket (0xc000cd9980) &{RPC:0xc0001655e0 Address:wss://localhost:33495/rpc/ State:init WS:<nil> PendingRequests:map[] NextRequestID:0 Lock:{state:1 sema:0} ReconnectDelay:0s cancelPings:<nil>} INFO[0026] ✅ RPC: account.update_account_keys() Response OK: took 42.7ms INFO[0026] ✈️ RPC: account.read_account() Request: {Email:admin@noobaa.io} INFO[0026] ✅ RPC: account.read_account() Response OK: took 2.0ms INFO[0026] ✅ Updated: "noobaa-admin" INFO[0026] ✅ Successfully updated s3 credentials for the account "admin@noobaa.io" INFO[0026] ✅ Exists: Secret "noobaa-admin" Connection info: AWS_ACCESS_KEY_ID :  AWS_SECRET_ACCESS_KEY : *

    Credential complexity requirements:

    Access key
    The account access key must be 20 characters in length and it must contain only alphanumeric characters.
    Secret key

    The secret key must be 40 characters in length and it must contain alphanumeric characters and "+", "/".

    For example: 

    $ noobaa account credentials my-account --access-key=ABCDEF1234567890ABCD --secret-key=ABCDE12345+FGHIJ67890/KLMNOPQRSTUV123456

  • To verify the credentials, run the following command: 

    noobaa account status <noobaa-account-name> --show-secrets
注記

You cannot have a duplicate access-key. Each user must have a unique access-key and secret-key.

6.1.3. Regenerating the S3 credentials for the accounts
リンクのコピー

Prerequisites

  • A running OpenShift Data Foundation cluster.

  • Download the Multicloud Object Gateway (MCG) command-line interface binary from the customer portal and make it executable.

    注記

    Choose the correct product variant according to your architecture. Available platforms are Linux(x86_64), Windows, and Mac OS.

Procedure

  1. Get the account name.

    For listing the accounts, run the following command: 

    $ noobaa account list

    Example output: 

    NAME           ALLOWED_BUCKETS   DEFAULT_RESOURCE               PHASE   AGE
account-test   [*]               noobaa-default-backing-store   Ready   14m17s
test2          [first.bucket]    noobaa-default-backing-store   Ready   3m12s

    Alternatively, run the oc get noobaaaccount command from the terminal: 

    $ oc get noobaaaccount

    Example output: 

    NAME           PHASE   AGE
account-test   Ready   15m
test2          Ready   3m59s

  2. To regenerate the noobaa account S3 credentials, run the following command: 

    $ noobaa account regenerate <noobaa_account_name> [options]
     
    $ noobaa account regenerate
FATA[0000] ❌ Missing expected arguments: <noobaa-account-name>

Usage:
    noobaa account regenerate <noobaa-account-name> [flags] [options]

Use "noobaa options" for a list of global command-line options (applies to all commands).

  3. Once you run the noobaa account regenerate command it will prompt a warning that says "This will invalidate all connections between S3 clients and NooBaa which are connected using the current credentials.", and ask for confirmation:

    Example: 

    $ noobaa account regenerate account-test

    Example output: 

    INFO[0000] You are about to regenerate an account's security credentials.
INFO[0000] This will invalidate all connections between S3 clients and NooBaa which are connected using the current credentials.
INFO[0000] are you sure? y/n

  4. On approving, it will regenerate the credentials and eventually print them: 

    INFO[0015] ✅ Exists: Secret "noobaa-account-account-test"
Connection info:
AWS_ACCESS_KEY_ID      : ***
AWS_SECRET_ACCESS_KEY  : ***

6.1.4. Regenerating the S3 credentials for the OBC
リンクのコピー

Prerequisites

  • A running OpenShift Data Foundation cluster.

  • Download the Multicloud Object Gateway (MCG) command-line interface binary from the customer portal and make it executable.

    注記

    Choose the correct product variant according to your architecture. Available platforms are Linux(x86_64), Windows, and Mac OS.

Procedure

  1. To get the OBC name, run the following command: 

    $ noobaa obc list

    Example output: 

    NAMESPACE   NAME       BUCKET-NAME                                     STORAGE-CLASS       BUCKET-CLASS                  PHASE
default     obc-test   obc-test-35800e50-8978-461f-b7e0-7793080e26ba   default.noobaa.io   noobaa-default-bucket-class   Bound

    Alternatively, run the oc get obc command from the terminal: 

    $ oc get obc

    Example output: 

    NAME       STORAGE-CLASS       PHASE   AGE
obc-test   default.noobaa.io   Bound   38s

  2. To regenerate the noobaa OBC S3 credentials, run the following command: 

    $ noobaa obc regenerate <bucket_claim_name> [options]
     
    $ noobaa obc regenerate
FATA[0000] ❌ Missing expected arguments: <bucket-claim-name>

Usage:
   noobaa obc regenerate <bucket-claim-name> [flags] [options]

Use "noobaa options" for a list of global command-line options (applies to all commands).

  3. Once you run the noobaa obc regenerate command it will prompt a warning that says "This will invalidate all connections between the S3 clients and noobaa which are connected using the current credentials.", and ask for confirmation:

    Example: 

    $ noobaa obc regenerate obc-test

    Example output: 

    INFO[0000] You are about to regenerate an OBC's security credentials.
INFO[0000] This will invalidate all connections between S3 clients and NooBaa which are connected using the current credentials.
INFO[0000] are you sure? y/n

  4. On approving, it will regenerate the credentials and eventually print them: 

    INFO[0022] ✅ RPC: bucket.read_bucket() Response OK: took 95.4ms

ObjectBucketClaim info:
  Phase                  : Bound
  ObjectBucketClaim      : kubectl get -n default objectbucketclaim obc-test
  ConfigMap              : kubectl get -n default configmap obc-test
  Secret                 : kubectl get -n default secret obc-test
  ObjectBucket           : kubectl get objectbucket obc-default-obc-test
  StorageClass           : kubectl get storageclass default.noobaa.io
  BucketClass            : kubectl get -n default bucketclass noobaa-default-bucket-class

Connection info:
 BUCKET_HOST            : s3.default.svc
 BUCKET_NAME            : obc-test-35800e50-8978-461f-b7e0-7793080e26ba
    BUCKET_PORT            : 443
    AWS_ACCESS_KEY_ID      : ***
    AWS_SECRET_ACCESS_KEY  : ***

Shell commands:
  AWS S3 Alias           : alias s3='AWS_ACCESS_KEY_ID=***
AWS_SECRET_ACCESS_KEY=*** aws s3 --no-verify-ssl --endpoint-url ***'

Bucket status:
  Name                   : obc-test-35800e50-8978-461f-b7e0-7793080e26ba
  Type                   : REGULAR
  Mode                   : OPTIMAL
  ResiliencyStatus       : OPTIMAL
  QuotaStatus            : QUOTA_NOT_SET
  Num Objects            : 0
  Data Size              : 0.000 B
  Data Size Reduced      : 0.000 B
  Data Space Avail       : 13.261 GB
  Num Objects Avail      : 9007199254740991
Red Hat logoGithubredditYoutubeTwitter

詳細情報

試用、購入および販売

コミュニティー

会社概要

Red Hat は、企業がコアとなるデータセンターからネットワークエッジに至るまで、各種プラットフォームや環境全体で作業を簡素化できるように、強化されたソリューションを提供しています。

多様性を受け入れるオープンソースの強化

Red Hat では、コード、ドキュメント、Web プロパティーにおける配慮に欠ける用語の置き換えに取り組んでいます。このような変更は、段階的に実施される予定です。詳細情報: Red Hat ブログ.

Red Hat ドキュメントについて

Red Hat をお使いのお客様が、信頼できるコンテンツが含まれている製品やサービスを活用することで、イノベーションを行い、目標を達成できるようにします。 最新の更新を見る.

Legal Notice

Theme

© 2026 Red Hatトップに戻る