Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Untuk merotasi kunci akun layanan di Google Distributed Cloud, Anda memperbarui
kredensial cluster yang ada dengan perintah bmctl. Rotasi kunci akun layanan ini mungkin merupakan bagian dari proses rutin Anda untuk memperbarui kredensial, atau sebagai respons terhadap potensi kebocoran kunci. Saat Anda memperbarui kredensial cluster, informasi baru akan diteruskan ke cluster admin atau hybrid, atau otomatis dirutekan ke cluster pengguna yang terpengaruh yang dikelola oleh cluster admin.
Kredensial cluster yang dapat diupdate
Cluster Google Distributed Cloud memerlukan beberapa kredensial saat dibuat.
Anda menetapkan kredensial dalam konfigurasi cluster saat membuat cluster admin, mandiri, atau hybrid. Cluster pengguna, seperti yang disebutkan sebelumnya, dikelola
oleh cluster admin (atau cluster hybrid yang bertindak sebagai admin), dan akan menggunakan kembali
kredensial yang sama dari cluster admin.
Anda dapat memperbarui kredensial berikut, dan secret yang sesuai, di cluster Google Distributed Cloud dengan perintah bmctl:
Kunci pribadi SSH: Digunakan untuk akses node.
Kunci Artifact Registry (anthos-baremetal-gcr): Kunci akun layanan yang digunakan untuk mengautentikasi dengan Artifact Registry untuk menarik image.
Kunci akun layanan agen Connect
(anthos-baremetal-connect): Kunci akun layanan yang digunakan oleh
pod agen Connect.
Kunci akun layanan pendaftaran Connect
(anthos-baremetal-register): Kunci akun layanan yang digunakan untuk mengautentikasi dengan
Hub saat mendaftarkan atau membatalkan pendaftaran cluster.
Kunci akun layanan operasi cloud (anthos-baremetal-cloud-ops):
Kunci akun layanan untuk mengautentikasi dengan Google Cloud Observability (logging & monitoring)
API.
Perbarui kredensial dengan bmctl
Saat Anda membuat cluster, Google Distributed Cloud akan membuat Secret Kubernetes berdasarkan kunci kredensial Anda. Jika Anda membuat kunci baru, Anda harus memperbarui Secret yang sesuai seperti yang dijelaskan dalam langkah-langkah berikut. Jika nama atau jalur
ke kunci Anda berubah, Anda juga harus memperbarui file konfigurasi
cluster yang sesuai.
Siapkan nilai baru untuk kredensial yang ingin Anda perbarui:
ADMIN_KUBECONFIG: jalur file kubeconfig
dari cluster admin atau yang dikelola sendiri.
CLUSTER_NAME: nama cluster yang SSH key-nya Anda perbarui.
SSH_KEY_PATH: jalur file kunci SSH. Secara
default, bmctl memeriksa file kunci SSH dan akun layanan yang ditentukan
dalam file konfigurasi cluster. Jika bmctl menemukan file kunci yang sudah tidak berlaku,
perintah akan gagal. Jika Anda memiliki file kunci baru yang valid di lokasi yang berbeda dengan yang ditentukan dalam file konfigurasi, sertakan tanda --ignore-validation-errors untuk menghindari kegagalan ini.
Untuk daftar lengkap flag yang dapat Anda gunakan dengan perintah bmctl update
credentials, lihat update
credentials di referensi perintah bmctl.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-01 UTC."],[],[],null,["To rotate the service account keys in Google Distributed Cloud, you update the\nexisting cluster credentials with the `bmctl` command. This service account key\nrotation might be as part of your regular processes to update credentials, or in\nresponse to a potential exposure of the keys. When you update cluster\ncredentials, the new information is passed to admin or hybrid clusters, or\nautomatically routed to affected user clusters managed by an admin cluster.\n\nCluster credentials that can be updated\n\nGoogle Distributed Cloud clusters require multiple credentials when they are created.\nYou set the credentials in the cluster config when you create an admin,\nstandalone, or hybrid cluster. User clusters, as noted previously, are managed\nby an admin cluster (or a hybrid cluster acting as admin), and will reuse the\nsame credentials from the admin cluster.\n\nFor more information about creating clusters and different cluster types,\nsee [Installation overview: choosing a deployment model](/kubernetes-engine/distributed-cloud/bare-metal/docs/installing/install-prep).\n\nYou can update the following credentials, and their corresponding secrets,\nin Google Distributed Cloud clusters with the `bmctl` command:\n\n- **SSH private key**: Used for node access.\n- **Artifact Registry key** (`anthos-baremetal-gcr`): Service account key used to authenticate with Artifact Registry for image pulling.\n- **Connect agent service account key** (`anthos-baremetal-connect`): Service account key used by Connect agent pods.\n- **Connect register service account key** (`anthos-baremetal-register`): Service account key used to authenticate with Hub when registering or unregistering a cluster.\n- **Cloud operations service account key** (`anthos-baremetal-cloud-ops`): Service account key to authenticate with Google Cloud Observability (logging \\& monitoring) APIs.\n\nUpdate credentials with `bmctl`\n\nWhen you create clusters, Google Distributed Cloud creates Kubernetes Secrets\nbased on your credential keys. If you generate new keys, you must update the\ncorresponding Secrets as described in the following steps. If the name or path\nto your keys change, you must also update the corresponding cluster\nconfiguration file.\n\n1. Prepare the new values for the credentials you want to update:\n\n - You can\n [generate new Google service account keys](/iam/docs/keys-create-delete#creating)\n through the Google Cloud CLI or through the Google Cloud console.\n\n - Generate new SSH private key on the admin workstation and make sure the\n cluster node machines have the corresponding public key.\n\n2. Update the credentials section of your cluster configuration file with paths\n to the new keys.\n\n3. Update the corresponding cluster Secrets with the `bmctl update credentials`\n command, adding the appropriate flags.\n\n The following example updates the credentials for a new SSH private key: \n\n bmctl update credentials --kubeconfig \u003cvar translate=\"no\"\u003eADMIN_KUBECONFIG\u003c/var\u003e \\\n --cluster \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --ssh-private-key-path \u003cvar translate=\"no\"\u003eSSH_KEY_PATH\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eADMIN_KUBECONFIG\u003c/var\u003e: the path of the kubeconfig file\n of the admin or self-managing cluster.\n\n - \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e: the name of the cluster that you're\n updating the SSH key for.\n\n - \u003cvar translate=\"no\"\u003eSSH_KEY_PATH\u003c/var\u003e: the path of the SSH key file. By\n default, `bmctl` checks the SSH and service account key files specified\n in the cluster configuration file. If `bmctl` finds an expired key file,\n the command fails. If you have the new valid key file in a different\n location than what's specified in the configuration file, include the\n `--ignore-validation-errors` flag to avoid this failure.\n\n For a complete list of the flags that you can use with the `bmctl update\n credentials` command, see [update\n credentials](/kubernetes-engine/distributed-cloud/bare-metal/docs/reference/bmctl#update_credentials) in the `bmctl`\n command reference."]]
