How can we Change the user and password no need restart the broker?

[Turing-Lee666]

Hi
I have an idea, which is to modify the username and password without the need to restart the broker. Could this be implemented?

[brusdev]

You could use a jaas-config secret to update users and roles without restarting, see https://github.com/artemiscloud/activemq-artemis-operator/blob/1.2.6/docs/help/operator.md#configuring-jaas-for-brokers

[Turing-Lee666]

You could use a jaas-config secret to update users and roles without restarting, see https://github.com/artemiscloud/activemq-artemis-operator/blob/1.2.6/docs/help/operator.md#configuring-jaas-for-brokers

Hi
I have indeed implemented the update of the administrator username and password without having to restart the broker pod using the 'secret' configuration for JAAS. However, I have discovered a new issue. It is strange that I can still send messages using the old username and password information through the command line tool within the broker pod. @brusdev

After a short while, the old username or password seems to become invalid, as shown in the figure above.

[brusdev]

If you mean the user/password in /home/jboss/amq-broker/etc/artemis-users.properties, it is used by the operator to interact with the broker pods.
@gtully is working on a new experimental feature that split control (operator) and data (broker clients) planes by enabling the restricted flag, see https://github.com/artemiscloud/activemq-artemis-operator/blob/main/docs/help/operator.md#restricted-mode-experimental

[Turing-Lee666]

If you mean the user/password in /home/jboss/amq-broker/etc/artemis-users.properties, it is used by the operator to interact with the broker pods. @gtully is working on a new experimental feature that split control (operator) and data (broker clients) planes by enabling the restricted flag, see https://github.com/artemiscloud/activemq-artemis-operator/blob/main/docs/help/operator.md#restricted-mode-experimental

Thank you!
Actually I mean the user/password in /amq/extra/secret/{secret_name}/users.properties. I change the user name or password，the old will also valid for a short while.

[brusdev]

Kubernetes takes a few seconds to update the projections of the secrets. You could use the BrokerPropertiesApplied condition to check when the users.properties file is reloaded by the PropertiesLoginModule, i.e.

apiVersion: broker.amq.io/v1beta1
kind: ActiveMQArtemis
...
status:
  conditions:
    - lastTransitionTime: '2024-11-13T14:24:46Z'
      message: ''
      reason: Applied
      status: 'True'
      type: BrokerPropertiesApplied
...