5 Managing Passwords in BRM Cloud Native

Learn how to manage passwords in your Oracle Communications Billing and Revenue Management (BRM) cloud native environment.

Topics in this document:

Using External Kubernetes Secrets for Certificates and Wallets

To increase system security and simplify certificate and wallet maintenance, you can store keystore certificates and Oracle wallets in precreated Kubernetes secrets. Create the required certificate or wallet material, add it to a Kubernetes secret, and configure the appropriate external secret key in your override-values.yaml file.

For TLS connections to BRM, use certificates issued by a certificate authority (CA) approved by your organization. BRM cloud native container images do not include populated TLS wallets, private keys, or sample CA certificates. You provide and manage the TLS certificates, private keys, and trust material that your deployment requires. You can provide BRM TLS wallets through Kubernetes secrets or, where supported, through customer-provided wallet files in the Helm chart.

When you perform a Helm install or Helm upgrade, the Helm chart checks the configured external secret keys. If you specify an external secret, the chart uses the precreated Kubernetes secret. If you do not specify an external secret, the behavior depends on the component and Helm chart. Where a chart-file source is supported, the chart creates a Kubernetes secret from the customer-provided certificate or wallet files. The Helm chart does not generate the certificate or wallet material.

For BRM Server TLS wallets, if you enable TLS and do not provide a supported wallet source, the Helm installation fails. For information about the supported wallet sources and their selection order, see "How BRM Selects the TLS Wallet".

You can use external Kubernetes secrets for the following:

  • Billing Care

  • Billing Care REST API

  • BRM REST Services Manager

  • BRM Server

  • Business Operations Center

  • Collections Configuration Center

  • Elastic Charging Engine

  • Pipeline Configuration Center

  • Pricing Design Center (PDC)

  • PDC REST Services Manager

  • Web Services Manager

To use external Kubernetes secrets in your BRM cloud native deployment:

  1. Create the required keystore certificates and Oracle wallets, and store them in Kubernetes secrets in your Kubernetes cluster.

    For TLS wallets, ensure that the certificates and private keys required by the component and TLS mode.

    For information about creating Kubernetes secrets, see "Managing Secrets" in the Kubernetes documentation.

  2. In the override-values.yaml file for the appropriate Helm chart, set the external secret key for each certificate or wallet to the name of the Kubernetes secret that you created.

    For BRM Server TLS wallets, set the appropriate component-specific extUserSSLWalletSecret key to the name of the precreated Kubernetes secret. BRM also supports shared wallet sources.

    Depending on the component, configure the appropriate external secret keys in:

    • oc-cn-init-db-helm-chart

    • oc-cn-helm-chart

    • oc-cn-op-job-helm-chart

    • oc-cn-ece-helm-chart

    Note:

    The precedence between an external Kubernetes secret and other supported certificate or wallet sources depends on the component.

  3. Perform a Helm install or Helm upgrade.

Rotating the BRM Root Password

The BRM root password is the password of service with the login ID root.0.0.0.1, which all clients use to connect to the Connection Manager (CM). For security reasons, you should change this password at regular intervals.

Changing the BRM root password impacts all clients that connect to the CM service: Billing Care, the Billing Care REST API, Business Operations Center, and BRM Web Services. Therefore, you must provide the new password to your clients so they can continue to connect to the CM service.

This shows the procedure for changing the current BRM root password (RootPassword1) to a new root password (RootPassword2) and then providing RootPassword2 to all of your clients:

  1. In your override-values.yaml file for oc-cn-helm-chart, set the keys in Table 5-1.

    Table 5-1 Initial Key Values

    Key Value Description

    ocbrm.rotate_password

    true

    Specify that the password is being changed.

    ocbrm.new_brm_root_password

    RootPassword2

    Set a new password for the root.0.0.0.1 service.

    ocbrm.cm.deployment.load_localized

    0

    Specify to not reload the localized strings into the database.

    This was already done during installation.

    ocbc.bc.wop.serverStartPolicy

    NEVER

    Specify to shut down the WebLogic servers for Billing Care.

    ocbc.bcws.wop.serverStartPolicy

    NEVER

    Specify to shut down the WebLogic servers for the Billing Care REST API.

    ocboc.boc.wop.serverStartPolicy

    NEVER

    Specify to shut down the WebLogic servers for Business Operations Center.

  2. Run the helm upgrade command to update the Helm release: 

    helm upgrade BrmReleaseName oc-cn-helm-chart --values OverrideValuesFile --namespace BrmNameSpace

    where:

    • BrmReleaseName is the release name assigned to your existing oc-cn-helm-chart installation.

    • OverrideValuesFile is the file name and path of your override-values.yaml file.

    • BrmNameSpace is the namespace for your existing BRM deployment.

    Updating the release changes the password for service root.0.0.0.1, spins off new pods for the CM and a few other services, and stops services for Billing Care, the Billing Care REST API, Business Operations Center, and BRM Web Services.

  3. Specify to turn off the password rotation indicator and to update the password. In the same override-values.yaml file, set the keys in Table 5-2.

    Table 5-2 Turn Off Password Rotation

    Key Value Description

    ocbrm.rotate_password

    false

    Turn off password rotation. This specifies that the password is not being changed.

    ocbrm.brm_root_pass

    RootPassword2

    Provide the updated password for the root.0.0.0.1 service.

  4. Update the password in the Infranet.properties file and wallet for Billing Care, the Billing Care REST API, and Business Operations Center by either reinstalling oc-cn-op-job-helm-chart or updating the wallet in place in the persistent volume (PV).

    To reinstall oc-cn-op-job-helm-chart, do this:

    1. Delete the release of oc-cn-op-job-helm-chart: 

      helm delete --namespace NameSpace OpJobReleaseName

      where OpJobReleaseName is the name of the oc-cn-op-job-helm-chart release.

    2. Clean up the domain home from the PV for Billing Care, Billing Care REST, and Business Operations Center:

      rm -rf DomainHome/domains/DomainUID

      where:

      • DomainHome is the location specified in the domainVolHostPath key under groups ocbc.bc.wop, ocbc.bcws.wop, and ocboc.boc.wop.

      • DomainUID is the domain name specified in the domainUID key under groups ocbc.bc.wop, ocbc.bcws.wop, and ocboc.boc.wop. Typically, the defaults are billingcare-domain, bcws-domain, and boc-domain respectively.

    3. Clean up the application home from the PV for Billing Care and the Billing Care REST API:

      rm -rf ApplicationHome/billingcare

      where ApplicationHome is the location specified in the appVolHostPath key under groups ocbc.bc.wop and ocbc.bcws.wop.

    4. Clean up the application home from the PV for Business Operations Center:

      rm -rf ApplicationHome/BOC

      where ApplicationHome is the location specified in the appVolHostPath key under group ocboc.boc.wop.

    5. Install oc-cn-op-job-helm-chart again: 

      helm install OpJobReleaseName oc-cn-op-job-helm-chart --namespace NameSpace --values OverrideValuesFile

      Wait for the jobs to complete their tasks.

    6. Delete the policy job for Billing Care, the Billing Care REST API, and Business Operations Center:

      kubectl --namespace NameSpace delete job DomainUID-policy-job

      where DomainUID is the domain name specified in the domainUID key under groups ocbc.bc.wop, ocbc.bcws.wop, and ocboc.boc.wop in the override-values.yaml file. Typically, the defaults are billingcare-domain, bcws-domain, and boc-domain respectively.

    To update the wallet in place in the PV, do this:

    1. For Billing Care and the Billing Care REST API, update the password in the wallet by following the instructions in "Storing Configuration Entries in the Billing Care Wallet" in BRM Security Guide. The wallet for these clients is located at ApplicationHome/billingcare/wallet/client.

    2. For Business Operations Center, update the password in the wallet by following the instructions in "Storing Configuration Entries in the Business Operations Center Wallet" in BRM Security Guide. The wallet for Business Operations Center is located at ApplicationHome/BOC/wallet/client.

    where ApplicationHome is the location specified in the appVolHostPath key under groups ocbc.bc.wop, ocbc.bcws.wop, and ocboc.boc.wop.

  5. Delete the PDC and Pipeline Configuration Center deployments:

    kubectl --namespace NameSpace delete deploy pdc-deployment pcc-deployment

  6. Update the release of oc-cn-helm-chart to bring up all client services with the updated CM connection details: 

    helm upgrade --namespace NameSpace ReleaseName oc-cn-helm-chart --values OverrideValuesFile

  7. Update the BRM root password in your ECE pods by doing this:

    1. Connect to any of the charging server (ecs) pods through JConsole. See "Creating a JMX Connection to ECE Using JConsole" for more information.

    2. Expand the ECE Configuration node.

    3. Navigate to the BRM Connection node.

    4. Expand Operations.

    5. Enter the new BRM root password (RootPassword2) along with the existing wallet password in the setPassword method and then run it.

    6. Perform a test connection to validate that the connection is successful.

    7. Rebounce the brmgateway pods for the new password to take effect and for the connection pool to BRM to be re-created.

Rotating the BRM Root Key

You should rotate the BRM root key regularly to increase security.

Note:

In BRM cloud native, the root key wallet is stored in the BRM database. The root key wallet is not stored in BRM container images or mounted in BRM pods.

To rotate the BRM root key:

  1. Ensure that the cm and dm-oracle pods are up and running.

  2. In your override-values.yaml file for oc-cn-helm-chart, set the ocbrm.root_key_rotate key to true.

  3. Run the helm upgrade command to update your Helm release: 

    helm upgrade BrmReleaseName oc-cn-helm-chart --values OverrideValuesFile --namespace BrmNameSpace

    where:

    • BrmReleaseName is the release name for oc-cn-helm-chart and is used to track this installation instance.

    • OverrideValuesFile is the file name and path to your override-values.yaml file.

    • BrmNameSpace is the namespace in which to create BRM Kubernetes objects for the BRM Helm chart.

  4. Restart the cm and dm-oracle pods.

If successful, the root key is rotated and a new one is generated in the Oracle wallet. You can set ocbrm.root_key_rotate to false to avoid rotating the root key again.

After you rotate the root key once, use the following method to rotate the root key again:

  1. Delete the dm-oracle deployment.

  2. In your override-values.yaml file for oc-cn-helm-chart, ensure that the ocbrm.root_key_rotate key is set to true.

  3. Run the helm upgrade command to update your Helm release: 

    helm upgrade BrmReleaseName oc-cn-helm-chart --values OverrideValuesFile --namespace BrmNameSpace

Rotating the BRM Password

To rotate the BRM password, stop and restart your pods.

To rotate the BRM password:

  1. In your override-values.yaml file for oc-cn-helm-chart, set the ocpdc.labels.isEnabled key to false.

  2. Run the helm upgrade command to update the Helm release: 

    helm upgrade BrmReleaseName oc-cn-helm-chart --values OverrideValuesFile --namespace BrmNameSpace

    where:

    • BrmReleaseName is the release name assigned to your existing oc-cn-helm-chart installation.

    • OverrideValuesFile is the file name and path of your override-values.yaml file.

    • BrmNameSpace is the namespace for your existing BRM deployment.

  3. In your override-values.yaml file for oc-cn-helm-chart, set the ocpdc.labels.isEnabled key to true.

  4. Run the helm upgrade command to update the Helm release. 

    helm upgrade BrmReleaseName oc-cn-helm-chart --values OverrideValuesFile --namespace BrmNameSpace

Rotating BRM Role Passwords

You set the initial passwords for each role in your BRM cloud native system when you deploy or upgrade your BRM cloud native server and database schema. These passwords are stored in the Oracle wallet. After your system is deployed, you should rotate your role passwords regularly.

To rotate your BRM role passwords after deployment:

  1. Open your override-values.yaml file for oc-cn-helm-chart.

  2. Set the ocbrm.rotate_brm_role_passwords key to true.

  3. Specify the old and new passwords for each role password that you want to rotate using this format:

    ocbrm:
   brm_role_pass:
      old_roleName.0.0.0.1: oldPassword
      roleName.0.0.0.1: newPassword

    where:

    • oldPassword is the old password in Base64-encoded format.

    • newPassword is the new password in Base64-encoded format.

    • roleName is one of the following:

      • acct_recv for the Accounts Receivable role. Users with this role can run the AR utilities such as pin_refund and pin_monitor_balance.

      • bc_client for the Billing Care role. Users with this role can run the Billing Care application.

      • bill_inv_pymt_sub for the Invoice Payments role. Users with this role can run the invoicing utilities such as pin_inv_accts and pin_upd_assoc_bus_profile.

      • billing for the Billing role. Users with this role can run billing applications such as pin_bill_accts and pin_rollover.

      • boc_client for the Business Operations Center role. Users with this role can run the Business Operations Center application.

      • collections for the Collections role. Users with this role can run the collections utilities such as pin_collections_process and pin_collections_send_dunning.

      • crypt_utils for the Encryption role. Users with this role can run the encryption utilities such as pin_crypt_upgrade and pin_crypt_upgrade_keys.

      • cust_mgnt for the Customer Management role. Users with this role can run the customer management utilities such as pin_contracts and pin_state_change.

      • invoicing for the Invoicing role. Users with this role can run the invoicing utilities such as pin_inv_accts and pin_inv_doc_gen.

      • java_client for the Java Applications role. Users with this role can run Java applications such as Account Migration Manager and Conversion Manager.

      • load_utils for the Load Utilities role. Users with this role can run the load utilities such as load_config and load_pin_calendar.

      • payments for the Payments role. Users with this role can run the payment utilities such as pin_installments and pin_recover.

      • pcc_client for the Pipeline Configuration Center role. Users with this role can run the Pipeline Configuration Center application.

      • rerating for the Rerating role. Users with this role can run the rerating utilities such as pin_rerate and pin_rate_change.

      • rsm for the REST Services Manager role. Users with this role can call the BRM REST Services Manager API operations.

      • super_user for the Super User role. Users with this role can create, update, and delete other roles.

      • ui_client for the Thick Clients role. Users with this role can run the thick clients such as Number Administration Center.

      • ece for the ECE role. Users with this role can run Elastic Charging Engine (ECE).

    For example, to rotate the Business Operations Center and Pipeline Configuration Center roles, you would enter the following:

    ocbrm:
   brm_role_pass:
      old_boc_client.0.0.0.1: oldBOCPassword
      boc_client.0.0.0.1: newBOCPassword
      old_pcc_client.0.0.0.1: oldPCCPassword
      pcc.0.0.0.1: newPCCPassword

  4. Keep all other role passwords in the file.

  5. Run the helm upgrade command to update your Helm release: 

    helm upgrade BrmReleaseName oc-cn-helm-chart --values OverrideValuesFile --namespace BrmNameSpace

    where:

    • BrmReleaseName is the release name for oc-cn-helm-chart and is used to track this installation instance.

    • OverrideValuesFile is the file name and path to your override-values.yaml file.

    • BrmNameSpace is the namespace in which to create BRM Kubernetes objects for the BRM Helm chart.

If successful, BRM cloud native:

  • Rotates the passwords for role names prefixed with old_.

  • Generates the new role passwords in the Oracle wallet.

All other passwords remain the same. You can set ocbrm.rotate_brm_role_passwords to false to avoid rotating the role passwords again.