CDN basic authentication secret rotation fails in AEMaaCS
The CDN configuration deployment can fail after you rotate a basic authentication secret if the secret reference in the configuration does not match the secret defined in Cloud Manager, or if pipeline secrets and environment secrets are mixed in the same configuration. To resolve the issue, create a new secret, update the configuration to reference it, and ensure that all referenced secrets use the same scope.
Description description
Environment
Adobe Experience Manager as a Cloud Service
Issue/Symptoms
-
After rotating the secret used for CDN basic authentication:
- the configuration pipeline fails
- a secret reference cannot be found
- the updated password is not applied
-
You see an error similar to the following: customer error: ensure all the secret references are defined either configuration tab of your environment or in the pipeline variables section. Please define all secrets in either section and do not mix them: secret reference '
<SECRET_NAME>’ does not match any existing secret keys
Root cause
This issue occurs when the secret reference in the CDN configuration does not match the secret defined in Cloud Manager, or when pipeline secrets and environment secrets are mixed in the same configuration.
Resolution resolution
Follow the steps below to address the issue:
- Generate the new password that you want to use for CDN basic authentication.
- In Cloud Manager, open the pipeline or environment where the CDN configuration is deployed and create a new secret with a new name. Do not update the existing secret in place.
- Open the CDN configuration file and replace the old secret reference with the new one. For example:
password: ${{NEW_CDN_BASIC_AUTH_PASSWORD}} - Make sure the secret reference in the configuration file exactly matches the secret name in Cloud Manager.
- Review all secret references used in the configuration and make sure they are defined in the same scope. Use either pipeline secrets or environment secrets, but do not mix both in the same configuration.
- Commit the configuration change and run the configuration pipeline again.
- If the deployment still fails, verify that each referenced secret exists in Cloud Manager, each secret name matches exactly, and all referenced secrets are defined in the same scope.