Secrets DataLens On-premises

secrets:
  ref: null                              # Link to an external Kubernetes secret
  #
  # === RSA authentication keys (required) ===
  AUTH_TOKEN_PRIVATE_KEY: null           # Generated automatically on first deployment
  AUTH_TOKEN_PUBLIC_KEY: null            # Generated automatically on first deployment
  AUTH_PROVIDERS_CONFIG: null            # JSON array of providers (optional)
  AUTH_ADMIN_PASSWORD: null              # The admin password (generated automatically)
  AUTH_CALLBACK_COOKIE_SECRET: null      # Generated automatically
  #
  # === Security ===
  CSRF_SECRET: null                      # Generated automatically
  #
  # === Master tokens ===
  AUTH_MASTER_TOKEN: null                # Generated automatically
  US_MASTER_TOKEN: null                  # Generated automatically
  FILE_UPLOADER_MASTER_TOKEN: null       # Generated automatically
  EXPORT_DATA_VERIFICATION_KEY: null     # Generated automatically
  #
  # === Encryption keys ===
  CONTROL_API_CRYPTO_KEY: null           # Generated automatically
  #
  # === Docker Registry ===
  DOCKER_CONFIG_JSON: null               # Required if registry.private: true
  #
  # === PostgreSQL ===
  POSTGRES_PASSWORD_ROOT: null           # Generated automatically
  POSTGRES_PASSWORD_US: null             # Generated automatically
  POSTGRES_PASSWORD_COMPENG: null        # Generated automatically
  POSTGRES_PASSWORD_AUTH: null           # Generated automatically
  POSTGRES_PASSWORD_TEMPORAL: null       # Generated automatically
  POSTGRES_PASSWORD_META_MANAGER: null   # Generated automatically
  POSTGRES_PASSWORD_DEMO: null           # Generated automatically
  #
  # === Temporal RSA keys (for import/export) ===
  TEMPORAL_AUTH_PRIVATE_KEY: null        # Generated if features.export is enabled
  TEMPORAL_AUTH_PUBLIC_KEY: null         # Generated if features.export is enabled
  #
  # === Infrastructure components ===
  CLICKHOUSE_PASSWORD: null              # Generated automatically
  REDIS_PASSWORD: null                   # Generated automatically
  S3_ACCESS_KEY_ID: null                 # Generated automatically
  S3_SECRET_ACCESS_KEY: null             # Generated automatically

# Generating a private key (4096 bit)
openssl genpkey -algorithm RSA -pkeyopt "rsa_keygen_bits:4096" -out private.pem

# Extracting a public key
openssl rsa -in private.pem -pubout -out public.pem

# Viewing content to insert into values.yaml
cat private.pem
cat public.pem

secrets:
  AUTH_TOKEN_PRIVATE_KEY: |
    -----BEGIN PRIVATE KEY-----
    MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQC...
    ...
    -----END PRIVATE KEY-----
  AUTH_TOKEN_PUBLIC_KEY: |
    -----BEGIN PUBLIC KEY-----
    MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA...
    ...
    -----END PUBLIC KEY-----

{
  "auths": {
    "registry.example.com": {
      "username": "user",
      "password": "password",
      "auth": "base64(user:password)"
    }
  }
}

secrets:
  ref: my-existing-secret

# 1. (Optional) Warn users to re-login

# 2. Generate new keys and run an update
./init.sh --auth-rsa-gen

# 3. Make sure all pods have restarted
./init.sh --kubectl get pods

# 4. Check that authentication is working

# 1. Prepare new token values ​​(32 characters, alphanumeric)
NEW_TOKEN=$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | head -c 32)

# 2. Create or update values.yaml with new values
# secrets:
#   US_MASTER_TOKEN: "<new token>"

# 3. Perform an update
./init.sh --values ./my-values.yaml

# 4. Make sure all pods have restarted
./init.sh --kubectl rollout status deployment --timeout=300s

# 1. Create a backup
./init.sh --dump-postgres

# 2. Connect to PostgreSQL
./init.sh --pg-sql

# 3. Change user password in PostgreSQL
ALTER USER "pg-us-user" WITH PASSWORD 'new_password';

# 4. Update the secret in values.yaml
# secrets:
#   POSTGRES_PASSWORD_US: "new_password"

# 5. Perform an update
./init.sh --values ./my-values.yaml

# 6. Restart the pods using this password
./init.sh --kubectl rollout restart deployment

# To get the administrator password
./init.sh --get-admin-password

# To generate new RSA keys for authentication
./init.sh --auth-rsa-gen

# To generate new RSA keys for Temporal
./init.sh --temporal-rsa-gen

# To specify the authentication provider configuration file
./init.sh --auth-providers-config ./my-auth-config.json

# To create a PostgreSQL backup prior to rotation
./init.sh --dump-postgres

# To check pod statuses after rotation
./init.sh --kubectl get pods

# To view logs to diagnose issues
./init.sh --stern .