[infra.ci.jenkins.io] 2024-11-21 Expiration of the Digital Oceans PATs used by Terraform

[dduportal]

Service(s)

infra.ci.jenkins.io, DigitalOcean

Summary

The Digital Ocean PATs (Personal Access Tokens) are expiring the 21 November 2024.

For info, previous token rotation: #4254

Todo list:

• Generate a new pair of tokens:
  • Connect to DigitalOcean as the "Jenkins Infrastructure Technical User" (email: [email protected])
  • use https://github.com/jenkins-infra/runbooks/blob/main/shared-totp/README.adoc for 2FA
  • Browse to the "API"section -> "Applications & API" title -> "Tokens/key" tab
  • Regenerate the 2 tokens (or create new ones if they disappeared) with 90 days of TTL:
    • infra.ci-production => Read + Write
    • infra.ci-staging => Read-Only
• Update tokens in the IaC setup:
  • Update the SOPS encrypted secrets in https://github.com/jenkins-infra/charts-secrets - https://github.com/jenkins-infra/charts-secrets/commit/f7873f70a51c3e10e2fa4ee8d97519dd38b7e9a7
  • Run a build of jenkins-infra/kubernetes-management on its main branch to deploy new secrets - https://infra.ci.jenkins.io/job/kubernetes-jobs/job/kubernetes-management/job/main/44536/
  • Reload JCasc on infra.ci to ensure credentials are updated from new secret
• Verify that the jenkins-infra/digitalocean is back to successful state (run a new PR or main build) - Apply complete! Resources: 0 added, 0 changed, 0 destroyed
• Add a calendar event in 90 days with a 2 weeks alert

Reproduction steps

No response

[dduportal]

New tokens generated and added in SOPS. Apply in progress

[dduportal]

Calendar event added

[dduportal]

infra.ci controller and PR shows the new credential works as expected: jenkins-infra/digitalocean#211