Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

renew Azure AD Password before expiration for sponsorship.ci.jenkins.io-tf-managed #4052

Closed
smerle33 opened this issue Apr 18, 2024 · 4 comments
Closed

renew Azure AD Password before expiration for sponsorship.ci.jenkins.io-tf-managed #4052

smerle33 opened this issue Apr 18, 2024 · 4 comments
Assignees
@dduportal
Labels
ci.jenkins.io
Milestone
infra-team-sync-2...

Comments

@smerle33
Copy link
Contributor

smerle33 commented Apr 18, 2024 •
edited
Loading

Service(s)

ci.jenkins.io

Summary

The Azure Service Principal password used for the sponsorship.ci.jenkins.io-tf-managed is soon to be expired.
We need to rotate it and to check if we can automate the renewal at least partly with updatecli like #4043

to update
https://github.com/jenkins-infra/azure/blob/1cf37c7fd95e043d6ed6d60cb799c6574f6eed1b/ci.jenkins.io.tf#L39

Reproduction steps

No response
@smerle33 smerle33 added the triage Incoming issues that need review label Apr 18, 2024
@smerle33 smerle33 self-assigned this Apr 18, 2024
@smerle33 smerle33 added this to the infra-team-sync-2024-04-23 milestone Apr 18, 2024
@smerle33 smerle33 removed the triage Incoming issues that need review label Apr 19, 2024
@smerle33 smerle33 mentioned this issue Apr 19, 2024
Merged
dduportal added a commit to jenkins-infra/azure that referenced this issue Apr 23, 2024
@smerle33 @dduportal
chore(updatecli): provide a manifest to track controller_service_prin…
3134477 
…cipal_end_date for ci.jenkins.io (#669)

as per jenkins-infra/helpdesk#4052

track the end date, it's using the same script as in azure-net.

EDIT:
The short term solution would be to generate a new date directly for the
ci.jenkins.io service principal but using this manifest will help us to
check if it's working in production as the certificate is due in a week.

The next step will be to migrate the scripts used in the shared-tools as
they are the same than in azure-net.

---------

Co-authored-by: Damien Duportal <damien.duportal@gmail.com>
@dduportal dduportal self-assigned this Apr 23, 2024
@dduportal
Copy link
Contributor

Update:

Next steps:

@dduportal dduportal mentioned this issue Apr 23, 2024
Merged
@dduportal dduportal changed the title renew Service Principal Password before expiration for application sponsorship.ci.jenkins.io-tf-managed renew Azure AD Password before expiration for sponsorship.ci.jenkins.io-tf-managed Apr 23, 2024
@dduportal
Copy link
Contributor

Update:

  • Announces done (ref. open operation on ci.j for helpdesk-4052 status#497 and ci.jenkins.io)
    Capture d’écran 2024-04-23 à 18 23 05

  • PR merged, deployed with success by Terraform on infra.ci.jenkins.io , and the Azure AD password's values has been retrieved to a secured (encrypted) location

  • ci.jenkins.io's credential azure-jenkins-sponsorship-credentials has been updated manually on ci.jenkins.io's UI

    • Verified both the Azure Credential and Azure VM clouds by clicking on the "Verify <...>" buttons with success

@dduportal
Copy link
Contributor

Update: ci.jenkins.io uses the new credential with success. https://ci.jenkins.io/job/Infra/job/acceptance-tests/job/check-agent-availability/3605/ was run with success after a controller restart.

@dduportal dduportal mentioned this issue Apr 24, 2024
Merged
@smerle33 smerle33 mentioned this issue Apr 29, 2024
Merged
smerle33 added a commit to jenkins-infra/azure that referenced this issue Apr 29, 2024
@smerle33
chore(updatecli) add link to infos in helpdesk (#680)
8439b47 
as per jenkins-infra/helpdesk#4052

add a little more information in the created PR.
@dduportal
Copy link
Contributor

@jenkins-infra-updatecli jenkins-infra-updatecli bot mentioned this issue Jul 1, 2024
Merged
dduportal pushed a commit to jenkins-infra/azure that referenced this issue Jul 22, 2024
@jenkins-infra-updatecli @jenkins-infra-bot
Extend Azure Service Principal password on ci.jenkins.io (current e…
9ec6946 
…nd date: 2024-07-22T00:00:00Z) (#766)

Generate a new password for the Azure Service Principal `ci.jenkins.io`.

See
jenkins-infra/helpdesk#4052 (comment)
for details.


---



<Actions>
<action
id="acb7646fbd8dac790f09a1398ca8a42522f8128cdae3e25082927aa213936d26">
<h3>Generate new end date for ci.jenkins.io controller service
principal</h3>
<details
id="4191ba5f46dbb754c1e7d30549ffcee986a6a05817c850ea79cf471743ba992d">
<summary>Update Terraform file `ci.jenkins.io.tf` with new expiration
date for controller_service_principal_end_date</summary>
<p>1 file(s) updated with
&#34;${1}2024-10-19T00:00:00Z\&#34;&#34;:&#xA;&#x9;*
ci.jenkins.io.tf&#xA;</p>
        </details>
<a
href="https://infra.ci.jenkins.io/job/updatecli/job/azure/job/main/332/">Jenkins
pipeline link</a>
    </action>
</Actions>

---

<table>
  <tr>
    <td width="77">
<img src="https://www.updatecli.io/images/updatecli.png" alt="Updatecli
logo" width="50" height="50">
    </td>
    <td>
      <p>
Created automatically by <a
href="https://www.updatecli.io/">Updatecli</a>
      </p>
      <details><summary>Options:</summary>
        <br />
<p>Most of Updatecli configuration is done via <a
href="https://www.updatecli.io/docs/prologue/quick-start/">its
manifest(s)</a>.</p>
        <ul>
<li>If you close this pull request, Updatecli will automatically reopen
it, the next time it runs.</li>
<li>If you close this pull request and delete the base branch, Updatecli
will automatically recreate it, erasing all previous commits made.</li>
        </ul>
        <p>
Feel free to report any issues at <a
href="https://github.com/updatecli/updatecli/issues">github.com/updatecli/updatecli</a>.<br
/>
If you find this tool useful, do not hesitate to star <a
href="https://github.com/updatecli/updatecli/stargazers">our GitHub
repository</a> as a sign of appreciation, and/or to tell us directly on
our <a
href="https://matrix.to/#/#Updatecli_community:gitter.im">chat</a>!
        </p>
      </details>
    </td>
  </tr>
</table>

---------

Co-authored-by: Jenkins Infra Bot (updatecli) <60776566+jenkins-infra-bot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@dduportal dduportal

Labels
ci.jenkins.io
Projects
None yet
Milestone
infra-team-sync-2024-04-30
Development

No branches or pull requests
2 participants
@dduportal @smerle33