To rotate the service account keys in Google Distributed Cloud, you update the
existing cluster credentials with the bmctl
command. This service account key
rotation might be as part of your regular processes to update credentials, or in
response to a potential exposure of the keys. When you update cluster
credentials, the new information is passed to admin or hybrid clusters, or
automatically routed to affected user clusters managed by an admin cluster.
Cluster credentials that can be updated
Google Distributed Cloud clusters require multiple credentials when they are created. You set the credentials in the cluster config when you create an admin, standalone, or hybrid cluster. User clusters, as noted above, are managed by an admin cluster (or a hybrid cluster acting as admin), and will reuse the same credentials from the admin cluster.
For more information about creating clusters and different cluster types, see Installation overview: choosing a deployment model.
You can update the following credentials, and their corresponding secrets,
in Google Distributed Cloud clusters with the bmctl
command:
- SSH private key: Used for node access.
- Container Registry key (
anthos-baremetal-gcr
): Service account key used to authenticate with Container Registry for image pulling. - Connect agent service account key
(
anthos-baremetal-connect
): Service account key used by Connect agent pods. - Connect registry service account key
(
anthos-baremetal-register
): Service account key used to authenticate with Hub when registering or unregistering a cluster. - Cloud operations service account key (
anthos-baremetal-cloud-ops
): Service account key to authenticate with Google Cloud Observability (logging & monitoring) APIs.
Update credentials with bmctl
When you create clusters, Google Distributed Cloud creates Kubernetes Secrets based on your credential keys. If you generate new keys, you must update the corresponding Secrets as described in the following steps. If the name or path to your keys change, you must also update the corresponding cluster configuration file.
Prepare the new values for the credentials you want to update:
You can generate new Google service account keys through the
gcloud
command or through the Google Cloud console.Generate new SSH private key on the admin workstation and make sure the cluster node machines have the corresponding public key.
Update the credentials section of your cluster configuration file with paths to the new keys.
Update the corresponding cluster Secrets with the
bmctl update credentials
command, adding the appropriate flags described below.For example, here
bmctl
updates the credentials for a new SSH private key, where ADMIN_KUBECONFIG specifies the path to the kubeconfig of the admin, hybrid, or standalone cluster, SSH_KEY_PATH specifies the path to the new SSH private key, and CLUSTER_NAME specifies the name of the cluster:bmctl update credentials --kubeconfig ADMIN_KUBECONFIG --ssh-private-key-path SSH_KEY_PATH --cluster CLUSTER_NAME
You can specify the following flags with bmctl
to update credentials:
Flag | description |
---|---|
--kubeconfig |
required, path to the kubeconfig of the admin, hybrid, or standalone cluster |
--cluster |
required, name of the admin, hybrid, or standalone cluster |
--ssh-private-key-path |
path to the new SSH private key |
--gcr-key-path |
path to the new Container Registry service account key |
--gke-connect-agent-service-account-key-path |
path to the new Connect agent service account key |
--gke-connect-register-service-account-key-path |
path to the new Connect register service account key |
--cloud-operations-service-account-key-path |
path to the new Google Cloud Observability service account key |