Rotate a Key File with the API
- OAuth 2.0 authentication for programmatic access to Cloud Manager is available as a Preview feature.
- The feature and the corresponding documentation might change at any time during the Preview period. To use OAuth 2.0 authentication, create a service account to use in your requests to the Cloud Manager Public API.
You can programmatically rotate a key file by updating a project's automation configuration.
To rotate a key file using the Cloud Manager API:
Retrieve the current configuration.
Add the new key file that you want to use with the auth.newKey setting.
Replace the entire configuration using
PUT
. You must usePUT
. Do not usePATCH
.
When all MongoDB Agents use the new key, Cloud Manager replaces the value of auth.key with the new key that you provided in auth.newKey and removes auth.newKey from the automation configuration.
Prerequisites
You must have access to the API. To learn more, see Configure API Access.
Your API key must have the
Project Automation Admin
orProject Owner
role.Authentication must be enabled.
At least one cluster in the project must be configured with the clusterAuthMode option set to
keyFile
orsendKeyFile
.All clusters in the project must be running MongoDB version 4.2 or higher.
Variables for Automation Config API Resources
The API resources use one or more of these variables. Replace these variables with your desired values before calling these API resources.
Name | Type | Description |
---|---|---|
PUBLIC-KEY | string | Your public API Key for your API credentials. |
PRIVATE-KEY | string | Your private API Key for your API
credentials. |
cloud.mongodb.com | string | URL of your Cloud Manager instance. |
GROUP-ID | string | Unique identifier of your project from your
project settings. |
CLUSTER-ID | string | Unique identifier of your cluster. |
Procedure
Retrieve and validate the automation configuration from Cloud Manager.
Use the automationConfig resource to retrieve the configuration. Issue the following command, replacing the placeholders with the Variables for Automation Config API Resources.
curl --user "{PUBLIC-KEY}:{PRIVATE-KEY}" --digest \ --request GET "https://cloud.mongodb.com/api/public/v1.0/groups/{PROJECT-ID}/automationConfig?pretty=true" \ --output currentAutomationConfig.json Validate the downloaded Automation Configuration file.
Compare the
version
field of thecurrentAutomationConfig.json
with that of the Automation Configuration backup file,mms-cluster-config-backup.json
. Theversion
value is the last element in both JSON documents. You can find this file on any host running the MongoDB Agent at:Linux and macOS:
/var/lib/mongodb-mms-automation/mms-cluster-config-backup.json
Windows:
%SystemDrive%\MMSAutomation\versions\mms-cluster-config-backup.json
If the
version
values match, you are working with the current version of the Automation Configuration file.
Add your new key file to the automation configuration file you downloaded.
Open
currentAutomationConfig.json
in your preferred text editor.Add the auth.newKey field. Set this field's value to the new key file that you want Cloud Manager to use.
Note
The sample configuration below is truncated for readability.
{ "auth": { "disabled": "false", "key": "<your-old-key>", "newKey": "<your-new-key>" } }
If you're updating the MongoDB Agent, see Update Agent Versions before continuing with this procedure.
Send the updated automation configuration.
Use the automationConfig resource to send the updated automation configuration.
Issue the following command with path to the updated configuration document and replace the placeholders with the Variables for Automation Config API Resources.
curl --user "{PUBLIC-KEY}:{PRIVATE-KEY}" --digest \ --header "Content-Type: application/json" --request PUT "https://cloud.mongodb.com/api/public/v1.0/groups/{PROJECT-ID}/automationConfig?pretty=true" \ --data @currentAutomationConfig.json
Upon successful update of the configuration, the API returns the HTTP
200 OK
status code to indicate the request has succeeded.
Confirm successful update of the automation configuration.
Retrieve the automation configuration from Cloud Manager and confirm it contains the changes. To retrieve the configuration, issue the following command, replacing the placeholders with the Variables for Automation Config API Resources.
curl --user "{PUBLIC-KEY}:{PRIVATE-KEY}" --digest \ --request GET "https://cloud.mongodb.com/api/public/v1.0/groups/{PROJECT-ID}/automationConfig?pretty=true"
Check the deployment status to ensure goal state is reached.
Use the automationStatus resource to retrieve the deployment status. Issue the following command, replacing the placeholders with the Variables for Automation Config API Resources.
curl --user "{PUBLIC-KEY}:{PRIVATE-KEY}" --digest \ --request GET "https://cloud.mongodb.com/api/public/v1.0/groups/{PROJECT-ID}/automationStatus?pretty=true"
Confirm that the values of all the lastGoalVersionAchieved
fields
in the processes
array match the goalVersion
field. To learn
about deployment status, see Get Automation Status of Latest Plan.