Version: v6.0.0 [Falcon]

brc config ru set-password

Update the Radio Unit credentials Athena logs in with

Synopsis

Update the credentials Athena's manager uses to log into a vendor's Radio Units.

The Composition Model installs a Secret holding one YAML document per vendor, and mounts it into the manager sidecar at /etc/secrets. The manager reads the document matching the RU vendor before it runs the vendor's configuration workflow, so a wrong password means the unit is probed, fails to authenticate, and never reaches the ready state.

There is more than one such Secret. oai-ran ships ru-secrets, ocudu mounts ocudu-ru-secrets, and oai-ran additionally ships per-vendor Secrets that nothing currently mounts. A password belongs to the Radio Unit, not to whichever Composition Model happens to be driving it, so every Secret in the namespace carrying the vendor's key is updated together. Naming one with --secret narrows the change to it alone, and is also the only way to seed the key into a Secret that does not carry it yet.

Benetel units are the reason the command exists: from the firmware release that made a password mandatory, every unit carries whatever password its operator set, so the credential has to be brought in line with the hardware per deployment.

vendor	key in the Secret	fields
`benetel`	`benetel.yaml`	username, password
`benetel-650`	`benetel-650.yaml`	username, password

LiteON is not accepted. Those units ship with credentials that do not vary by deployment, and ru.py probes them with its own fixed constants rather than with anything stored per unit. Changing the Secret would only move it out of step with the hardware and with the probe, so the command refuses rather than offering the choice.

Only the addressed vendor's key is rewritten, and the username already stored is preserved unless --username overrides it. The other vendors' keys are left untouched.

The other half of the credential

The manager is not the only thing that logs into a Radio Unit. On each worker node, ru.py probes the unit for its sync state and its MAC address, and it authenticates with the password field of the unit's entry in /etc/pontus/ru.json. A Benetel unit whose password is set in the Secret but not in the inventory never reports ready, so Pontus never publishes it and the manager never gets the chance to use the credential it was given. The reverse leaves the unit assignable but unconfigurable.

Both places are therefore updated by default. Use --secret-only or --inventory-only when you deliberately want them to differ.

note

/etc/pontus/ru.json is mode 0644, so a password written there is readable by any local user on the worker node. The Secret is at least behind Kubernetes RBAC.

danger

This patches the live Secret. The Composition Model ships the passwords as literal chart content, so reinstalling or upgrading the model restores the shipped defaults and this change has to be applied again.

For security reasons, this command cannot be executed in verbose mode.
The password is read from the terminal without echo, or from standard input with --stdin.

brc config ru set-password <vendor> [flags]

Examples

# prompt for the Benetel RAN650 password
brc config ru set-password benetel-650

# non-interactive, for a provisioning script
printf '%s' "$RU_PASSWORD" | brc config ru set-password benetel-650 --stdin

# narrow the change to one Secret
brc config ru set-password benetel --secret ocudu-ru-secrets

# clear the password again, for units on firmware that has none
brc config ru set-password benetel-650 --empty

# leave the node inventories alone and touch only the Secret
brc config ru set-password benetel-650 --secret-only

# repair only the inventory, on one node
brc config ru set-password benetel-650 --inventory-only --node moto

Options

      --empty             store an empty password, for firmware that has none
  -h, --help              help for set-password
      --host string       SSH host of the worker node when it differs from the Kubernetes node name
      --inventory-only    update the node inventories and leave the Secret alone
      --node string       limit the inventory update to this worker node
      --secret string     update only this Secret (default: every Secret in the namespace holding the vendor's key)
      --secret-only       update the Secret and leave the node inventories alone
      --stdin             read the password from standard input instead of prompting
      --user string       SSH user for the worker node
      --username string   username to store (defaults to the one already in the Secret)
  -y, --yes               do not ask for confirmation

Options inherited from parent commands

  -n, --namespace string   namespace to perform the operations (default "trirematics")
  -v, --verbose            debug output

brc config ru set-password