Updating the Db2 password secrets

The Db2 administration accounts on your IBM Software Hub cluster are protected by password secrets. During deployment of Db2, these password secrets are automatically generated and securely stored for these accounts. These accounts are used by Db2 to handle administrative tasks on the database. If you need to change them to comply with specific password regulations, or if your security situation changes, you can use this method to update the password secrets at any point in time.

1. Obtain the name of the Db2uClusteror Db2uInstance and assign it to a variable:

   oc get db2ucluster,db2uinstance

   Example result:

   NAME                       STATE   MAINTENANCESTATE   AGE
   db2oltp-1657844758916344   Ready   None               46d

   Export the Db2uCluster or Db2uInstance name to a variable:

   export DB2_CR_ID=<db2ucluster_name/db2uinstance_name>

2. Complete the following steps to update the password in the secret object.
   1. Export the new password to a variable:

      export NEW_PASSWORD="my_new_password"

   2. Run the following command to update the password in the secret object:

      oc patch -n ${PROJECT_CPD_INST_OPERANDS} $(oc get secret c-${DB2_CR_ID}-instancepassword -oname) -p "{\"data\":{\"password\": \"$(echo -n ${NEW_PASSWORD} | base64)\"}}"

   Attention: If the Db2 instance is either the primary or principal standby in an HADR configuration, the Governor configuration file must also be updated with the new password.

   1. Exec into the Db2 pod and switch to the database instance owner.

      su - db2inst1

   2. Change the password in the /mnt/blumeta0/home/db2inst1/governor/db2.yml Governor configuration file.

      db2:
      ...
       authentication:
        username: db2inst1
        password: XCouid9KSLi1TYC     # Change this to the new password

3. Run the following command on any running Db2 engine pod (for example, c-db2oltp-1605722434029496-db2u-0):

   oc exec -i c-${DB2_CR_ID}-db2u-0 -- sudo python <<EOF
   import json
   
   with open("/mnt/blumeta0/db2_config/users.json", 'r') as fd:
       parsed = json.load(fd)
   
   if 'db2inst1' in parsed['users']:
       del parsed['users']['db2inst1']
   
   with open("/mnt/blumeta0/db2_config/users.json", 'w') as fd:
       json.dump(parsed, fd, indent=2)
   EOF

4. Restart the Db2 engine pod:

   oc delete -n ${PROJECT_CPD_INST_OPERANDS} $(oc get po -n ${PROJECT_CPD_INST_OPERANDS} -o name | grep -E "${DB2_CR_ID}-db2u-[0-9]")