Credential Rotation

change password step

stateDiagram-v2
    noAction: no-pwd-change-needed
    wait: wait-for-new-pwd
    new: set-new-pwd
    removeOld: remove-old-pwd
    finished: new-pwd-change-finished
    state configExist? <<choice>>
    state valid? <<choice>>
    state finished? <<choice>>

    [*] --> configExist?
    configExist? --> valid?: new-password-config-exist?
    configExist? --> noAction
    valid? --> finished?: valid-from > now?
    valid? --> wait
    finished? --> finished: current > valid-from?
    finished? --> new
    new --> removeOld
    removeOld --> [*]
    finished --> [*]
    noAction --> [*]
    wait --> [*]

Example Data

Default

[{
    "current": true,
    "id": "521e0760",
    "userName": "root",
    "hostName": "backup-restore-65bd9b6ff5-z69sn",
    "created": "2024-10-18 13:08:16"
}]

Add another password

[
  {
    "current": true,
    "id": "521e0760",
    "userName": "root",
    "hostName": "backup-restore-65bd9b6ff5-z69sn",
    "created": "2024-10-18 13:08:16"
  },
  {
    "current": false,
    "id": "b67161fb",
    "userName": "root",
    "hostName": "backup-restore-65bd9b6ff5-z69sn",
    "created": "2024-10-18 13:16:54"
  }
]

Change current password

[
  {
    "current": false,
    "id": "521e0760",
    "userName": "root",
    "hostName": "backup-restore-65bd9b6ff5-z69sn",
    "created": "2024-10-18 13:08:16"
  },
  {
    "current": true,
    "id": "b67161fb",
    "userName": "root",
    "hostName": "backup-restore-65bd9b6ff5-z69sn",
    "created": "2024-10-18 13:16:54"
  }
]

Remove old password

[
  {
    "current": true,
    "id": "b67161fb",
    "userName": "root",
    "hostName": "backup-restore-65bd9b6ff5-z69sn",
    "created": "2024-10-18 13:16:54"
  }
]

Steps

Steps need to be validated and performed seperately and work independently of each other. To avoid problems where the program is shut down mid-transition.

Stages

Initial State

Validation:

Detect change requested: new password file environment is set

Steps to perform:

Add new password
restic -r <repo> key add --new-password-file <file>

New password has been added