openshift-secrets-migrate¶

A task to migrate a cluster's local secure params into the external secret store

Moves an existing cluster's locally stored secure params into the external secret store, for clusters that were built before a secret-store backend was applied. Run it on the cluster after applying an openshift-secrets-<backend> profile (or any profile that supplies LookupUri references).

Requirements¶

Cluster State¶

A profile supplying LookupUri references must be applied to the cluster. The task needs no configuration for it: candidates are discovered by walking the cluster's profile chain (nested profiles and global included) and collecting every reference-valued param, so both the shipped openshift-secrets-* profiles and operator-authored profiles (hard-coded per-param references included) are found without knowing their names.
The referenced secret-store plugin instance must be healthy; every migration is verified by a decode round-trip before the local copy is considered replaced.

Parameters¶

openshift/secrets/migrate-exclude: params never migrated even when referenced (composed across the chain, empty by default).
openshift/secrets/migrate-pull-secret: the shared openshift/pull-secret is always excluded unless this is explicitly set true, because its store location is shared by every cluster.

References only exist on Secure: true params (the LookupUri envelope is the secure-data envelope; DRP rejects it on non-secure params), so discovery cannot misfire on ordinary params.

Usage¶

Run via the openshift-cluster-secrets-migrate blueprint against the cluster. For each discovered param the task:

Checks for a local copy on the two objects the pipeline writes: the cluster object and the cluster-name profile (key presence; raw Secure values are redacted under job claims). No local copy there means the param is already store-backed or hosted on an operator profile the task refuses to edit; it is skipped either way.
Decodes and stashes the current value, then removes the local copy. Object params outrank profiles, so the discovered reference now wins aggregation.
Sets the value cluster-rooted so write-through stores it behind the reference, proves write-through engaged (the param must NOT reappear as a local key), and verifies the decode round-trip. Any failure restores the local value where it was.

The task is idempotent: a second run discovers the same candidates, finds them reference-backed, and changes nothing.

Objects that Reference openshift-secrets-migrate¶

blueprints openshift-cluster-secrets-migrate in Openshift as part of Tasks (declared)

Objects used by openshift-secrets-migrate¶