Customizing core secrets v1.4.1 (LTS)

Required for all Hybrid Manager (HM) deployments. The core scenario is always enabled — it isn't optional like ai, analytics, or migration. These secrets cover the HM portal's admin identity provider (IdP) and the consolidated system database used by core platform components.

Bootstrap Fernet key and admin credentials: Used by the HM portal's IdP (Dex) to encrypt connector configuration and to bootstrap the first admin user(s).

System database credentials: Per-role passwords for the consolidated system database (upm-system-db) used by core platform components (portal API, EDB Postgres AI agent, transporter, and others).

Creating core secrets

1. You can create the bootstrap Fernet key and admin credentials using the edbctl CLI.

   • For manual installations, run this command and follow the interactive prompts:

     → WrapCopy

     edbctl hybrid-manager create-install-secrets --version <version> --scenario core

   • If you're running the installation via a CI/CD pipeline, you must suppress interactive prompts:

     1. Configure edbctl for non-interactive behavior:

        → WrapCopy

        edbctl config set interactive_mode off
        edbctl config set confirm_mode off

     2. Provide the primary admin's credentials as environment variables and run the setup command:

        → WrapCopy

        EDB_CORE_ADMIN_EMAIL1="owner@mycompany.com" \
        EDB_CORE_ADMIN_PASSWORD1='My-Secret-Password-1' \
        edbctl hybrid-manager create-install-secrets --version <version> --scenario core

        A second admin user is optional. Set EDB_CORE_ADMIN_EMAIL2 and EDB_CORE_ADMIN_PASSWORD2 to add one.

   This creates the hm-portal-bootstrap secret in the default namespace, which is automatically replicated to upm-dex. It contains:

   • fernet-key: Encryption key for sensitive connector configuration fields.
   • static-passwords.yaml: Initial admin user account(s) for bootstrap access, generated from the admin email/password values above.

   Note

   On upgrades from a pre-2026.2 / pre-1.4 installation, edbctl preserves existing admin identities automatically where possible, so rerunning this command doesn't break existing user role assignments. If you're upgrading from a Dex-based installation and need to migrate static users manually, see Upgrading from 2026.1 to the 2026.2 Innovation Release.

2. The HM administrator must retrieve the Fernet key and store it safely:

   → WrapCopy

   kubectl get secret hm-portal-bootstrap -n default -o yaml

   Warning

   The fernet-key in this secret can't be rotated in place. edbctl refuses to update it, even with --force, because existing connector configuration is encrypted with the original key and isn't re-encrypted automatically. To rotate it manually, see Rotating IdP connector encryption keys.

   The admin credentials in static-passwords.yaml can be rotated. Rerun the setup command with --force; edbctl reprompts for the admin email and password and matches the existing Dex user ID by email, so role assignments aren't broken.

3. System database secrets are created automatically alongside the bootstrap secret and don't require separate input. See Understanding core secrets for the full list.

Rotating core secrets

To rotate the system database secrets, run the setup command again with --force:

edbctl hybrid-manager create-install-secrets --version <version> --scenario core --force

--force rotates only secrets annotated safe-to-update=true. This updates all seven system database secrets (db-upm, db-dex, db-langflow, db-lakekeeper, db-beacon-app, db-transporter, db-superuser). CloudNativePG (CNPG) picks up each new password automatically through the k8s.enterprisedb.io/reload label.

Secrets annotated safe-to-update=false are skipped, with a warning. This includes the fernet-key in hm-portal-bootstrap — see the warning above for details.

Understanding core secrets

For each secret, Description explains why you need it, and Safe to rotate indicates whether the secret can be updated in place without additional steps.

HM portal bootstrap

Description: Encrypts Dex connector configuration and bootstraps the primary (and optional secondary) admin user for the HM portal.

Namespace: default (replicated to upm-dex)

Secret name: hm-portal-bootstrap

Safe to rotate: Partially — The fernet-key can't be rotated in place. The admin credentials in static-passwords.yaml can be rotated with --force without breaking role assignments. See the warning above.

System database secrets

Description: Per-role passwords for the consolidated system database (upm-system-db) used by core platform components (portal API, EDB Postgres AI agent, transporter, and others).

Namespace: default (secrets are replicated to the namespaces of the components that consume them)

Legacy: Dex Fernet key

Secret name: dex-fernet-key (namespace: upm-dex)

Description: Encryption key for the Dex IdP database, used before the IdP was migrated to be available in the HM console.