zarf_update_creds
Rotate the credentials an initialised cluster holds.
Write it as colonel_byte.zarf.zarf_update_creds. It runs zarf on the node the task is delegated to; nothing is installed on the cluster’s nodes.
Added in colonel_byte.zarf 0.88.0.
Runs zarf tools update-creds <service> against the cluster a kubeconfig names, rewriting the credentials it holds for its registry, its git server or its agent.
The module is a compiled binary with zarf linked into it. It renders the zarf tools update-creds command line from these parameters, executes zarf’s own command in its own process, and reports one JSON result. It needs no zarf on the node.
It is the write half of colonel_byte.zarf.zarf_state_info, which reads the same zarf-state Secret and withholds what it finds. Rotating a password without it means doing in several steps what zarf does in one: the Secret, the service’s own configuration, and every deployed package that pulls through it.
Zarf has one subcommand per service, each taking only that service’s credentials, and the bare zarf tools update-creds that takes all of them warns that it is deprecated. This module renders the subcommand, so service is required and a credential given for another service is an error naming it.
Parameters
| Parameter | Type | Required | Flag | Description |
|---|---|---|---|---|
service | str | yes | None | Which service’s credentials to rewrite. It selects the zarf subcommand, so it is required: each subcommand accepts only its own service’s credentials. The subcommand name, so it renders no flag. One of registry, git, agent. |
kubeconfig | str | no | None | The kubeconfig of the cluster whose credentials are being rewritten. Zarf has no --kubeconfig flag, so it is passed as KUBECONFIG in zarf’s environment. |
zarf_config | str | no | None | A zarf config file, passed as ZARF_CONFIG. It is how a playbook keeps the new credentials out of the argument vector entirely. |
wrapper_binary | str | no | None | The module wrapper to run, resolved on the path when it holds no separator. The action plugin consumes this parameter; the wrapper never sees it. |
parameters | dict | no | None | Further module parameters, merged into the ones given directly. A parameter given both directly and inside parameters is an error naming it. The action plugin consumes this key; the wrapper never sees it. |
registry_url | str | no | --registry-url | The registry’s new address. Taken by service: registry. |
registry_push_username | str | no | --registry-push-username | The registry’s new push username. |
registry_push_password | str | no | --registry-push-password | The registry’s new push password. |
registry_pull_username | str | no | --registry-pull-username | The registry’s new pull username. |
registry_pull_password | str | no | --registry-pull-password | The registry’s new pull password. |
git_url | str | no | --git-url | The git server’s new address. Taken by service: git. |
git_push_username | str | no | --git-push-username | The git server’s new push username. |
git_push_password | str | no | --git-push-password | The git server’s new push password. |
git_pull_username | str | no | --git-pull-username | The git server’s new pull username. |
git_pull_password | str | no | --git-pull-password | The git server’s new pull password. |
agent_tls_ca | str | no | --agent-tls-ca | A PEM-encoded CA certificate for the zarf agent. Taken by service: agent. |
agent_tls_cert | str | no | --agent-tls-cert | A PEM-encoded TLS certificate for the zarf agent. |
agent_tls_key | str | no | --agent-tls-key | A PEM-encoded TLS private key for the zarf agent. |
force_conflicts | bool | no | --force-conflicts | Whether zarf forces Helm ownership during server-side apply, for the deployed packages it updates. Taken by service: registry and service: agent. The git subcommand does not have it – it patches no Helm-owned resource – so setting it with service: git is an error naming it. |
log_level | str | no | --log-level | Zarf’s log level. |
log_format | str | no | --log-format | Zarf’s log format. Defaults to json. |
Notes
- Set
run_once: trueanddelegate_toon the task. The credentials belong to the cluster, so a play over its own inventory would otherwise rotate them once per host. - Set
no_log: trueon the task. Every parameter here butserviceis a credential or a path to one, and a binary module has no per-parameterno_log. Better still, put them in a zarf config file and name it withzarf_config, which keeps them out of the argument vector and so out of the process table. --confirmis always rendered: there is no terminal on the other end of a playbook task, and the command asks before it rewrites anything.- The task reports
changed: truewithzarf.changedSignalset tounknown. Zarf reports that it updated the services, not whether any of them already held what was given, so a credential set twice is reported as changed both times. - Check mode reports the task as skipped. The command has no dry run.
- The artifact server is the fourth service zarf keeps credentials for and has no subcommand of its own. It is deprecated upstream, so this module does not update it.
- One service per task: a playbook rotating the registry and the git server writes two tasks.
Example
- name: Rotate the registry's push password
colonel_byte.zarf.zarf_update_creds:
service: registry
registry_push_password: "{{ new_registry_password }}"
kubeconfig: /etc/rancher/rke2/rke2.yaml
delegate_to: localhost
run_once: true
no_log: true
- name: Rotate the git credentials from a zarf config file, keeping them out of the process table
colonel_byte.zarf.zarf_update_creds:
service: git
zarf_config: /etc/zarf/rotation.yaml
kubeconfig: /etc/rancher/rke2/rke2.yaml
delegate_to: localhost
run_once: true
- name: Install a new agent certificate
colonel_byte.zarf.zarf_update_creds:
service: agent
agent_tls_ca: /etc/zarf/ca.pem
agent_tls_cert: /etc/zarf/tls.pem
agent_tls_key: /etc/zarf/tls.key
kubeconfig: /etc/rancher/rke2/rke2.yaml
delegate_to: localhost
run_once: true
no_log: true