[infra.ci.jenkins.io] Service Principal used to spawn Azure agents expires on 2024-06-30

[dduportal]

The Azure SP credential defined in https://github.com/jenkins-infra/azure/blob/baef2fc43660ac14e11d66e9861d1ea030e74715/infra.ci.jenkins.io.tf#L47 expires the 30 June 2024.

We need to:

• Add this expiration date to the automation tracking system introduced by @smerle33 and @lemeurherve so we would have an automatic PR
• Once the PR is open and ready to merge:
  • Announce the operation (infra.ci.jenkins.io won't be able to spin up Azure Virtual Machine agents during the operation: builds will be queued)
  • Merge the PR in jenkins-infra/azure to extend the credential expiry date (and dismiss the former credential)
  • Update the credential in SOPS. Note: once pushed to the repository chart-secrets, run one time the kubernetes-management job to apply the credential change
  • Restart the controller to ensure the new credentials is propagated and loaded in memory
  • Ensure Azure VM are spawned
  • Close announcement

[github-actions]

Take a look at these similar issues to see if there isn't already a response to your problem:

1. 92% Service Principal used by infra.ci.jenkins.io to spawn Azure agents expires on 2024-03-22 #4000

[dduportal]

Update:

• Announce done on infra.ci 's banner + Element matrix
• Generate a new Azure AD Application password with expiration date 2024-09-26T00:00:00Z on infra.ci.jenkins.io azure#761 automated PR is merged

[dduportal]

Update:

• Secret updated in https://github.com/jenkins-infra/charts-secrets/commit/404c67fb41f83a0dce2dfa3013135feef029c9fb (private repository)
• Controller restarted
• New secret present in the container tmpfs

[dduportal]

Update:

• The controller restart was not sufficient enough: the old Azure API token was still used (and failing)
• As pointed by @jayfranco999 we tried to reload JCasC which worked: a new API token was generated (as per controller logs) and Azure VM agents are now spun up

[dduportal]

Announcement close