DigitalOcean: expiration of the API token for jenkins-infra-team account [July 2022]

[dduportal]

Service(s)

Digital Ocean

Summary

The API token of the technical account jenkins-infra-team has expired today, as reminded by our team calendar.

• No services are impacted
• The following jobs will fail once the token is expired:
  • jenkins-infra/kubernetes-management (on the Digital Ocean branch, as the token is used to retrieve the Kubernetes API service account token)
  • jenkins-infra/digitalocean (as the token is used by Terraform to authenticate to the DO API)

Reproduction steps

No response

[dduportal]

While checking the credentials rotation, we discovered that the user jenkins-infra-team has a LOT of tokens. All of them are expiring after 7-8 days.

After some researches: digitalocean/action-doctl#30.

Related enhancement: jenkins-infra/kubernetes-management#2597 (review) (shorter expiry time).

[dduportal]

• Authenticated to DigitalOcean as jenkins-infra-team
• Created 2 new tokens: 1 for staging (readonly) and 1 for production (read/write)
• Updated the SOPS encrypted files in charts secrets (private page: https://github.com/jenkins-infra/charts-secrets/commit/3630500c6991e1f9e14dff56cc1cd10d691cef4f)

=> Let's wait for infra.ci to be updated by jenkins-infra/kubernetes-management (which should auto-heal)

[dduportal]

All jobs are green again: new token had been propagated. Closing.