Skip to content

openshift-cluster-secrets-migrate

A blueprint to migrate a cluster's local secure params into the external secret store

Runs openshift-secrets-migrate against an existing cluster, moving its locally stored secure params (kubeconfig, kubeadmin-password, ssh-key, install/agent configs, and the rest of the covered set) into the external secret store behind the cluster's LookupUri references.

Requirements

Cluster State

  • The cluster exists and its secure params hold real values.
  • A profile supplying store references has been applied to the cluster (an openshift-secrets-<backend> profile, or an operator profile with hard-coded references).
  • The referenced secret-store plugin instance is healthy.

Usage

Apply the matching openshift-secrets-<backend> profile to the cluster, then run this blueprint against the cluster. Every migrated param is verified with a decode round-trip; any failure restores the local value, so a partial run is safe to re-run. After migration the blueprint runs openshift-refresh-kubeconfig, which re-renders the runner's on-disk kubeconfig through the store reference as an end-to-end read check.

Verification

After the blueprint completes, confirm with: - drpcli clusters get Name:<cluster> param openshift/kubeconfig --aggregate shows the LookupUri reference (not a sealed value) - drpcli clusters get Name:<cluster> param openshift/kubeconfig --aggregate --decode returns the kubeconfig from the store

Objects that Reference openshift-cluster-secrets-migrate

Not used in current content packs

Objects used by openshift-cluster-secrets-migrate