Upgrade external PCS to 10.2.3¶

Upgrade external PCS for self-managed DataRobot v10.2.3. This includes SCRAM-SHA-256 for PostgreSQL on AWS RDS, Azure, and Google Cloud SQL, as well as MongoDB Atlas and self-managed MongoDB user authentication.

Postgres¶

AWS RDS

• Modify the parameter group, to add password_encryption set to scram-sha-256. If you only have default parameter group set then create a new option group and configure your RDS to use the option group

• Once option group is added to RDS

• Follow guide to delete the existing secret

• Continue with upgrade as in the admin guide

Azure Postgresql

• Modify under settings for the instance and set password_encryption to SCRAM-SHA-256

• Once modified, follow guide to delete the existing secret

• Continue with upgrade as in the admin guide

Google CloudSQL

• Modify Database flags on your Cloud SQL Postgres and set password_encryption to scram-sha-256

• After the database flags are applied

• Follow guide to delete the existing secret

• Continue with upgrade as in the admin guide

Mongo Atlas¶

If your Mongo Atlas cluster was provisioned before 2023, reach out to your MongoDB Support to enable SCRAM-SHA-256 user authentication. If it's a new cluster this step isn't required as it's set by default

Starting with DataRobot 11.14, the pcs-mongodb user must authenticate with SCRAM-SHA-256 only. Atlas users created in 2023 or later already use SCRAM-SHA-256. For older users, open the user in Atlas under Database Access and confirm that its authentication method is SCRAM-SHA-256.

Self-managed MongoDB deployment¶

Starting with DataRobot 11.14, only SCRAM-SHA-256 is supported for the pcs-mongodb user. Run the following command as an admin before the upgrade so the user holds a SCRAM-SHA-256 credential and nothing else:

use admin

db.runCommand({'updateUser':'pcs-mongodb',pwd:passwordPrompt(), mechanisms:['SCRAM-SHA-256']}) 

When prompted, enter the user’s current MongoDB password. The password doesn’t change. MongoDB only regenerates the stored credential.

The upgrade also runs the mongodb-scram-migration job, which removes any remaining SCRAM-SHA-1 credentials from users it has permission to update. If the pcs-mongodb user doesn’t have that permission, the job logs MANUAL ACTION REQUIRED but doesn’t fail. In that case, run the command above to update the user manually.