OSS prow uses GitHub app for authenticating

[chaodaiG]

OSS prow currently uses bot personal access token(PAT) for authentication with GitHub APIs, which has a global rate limit of 5000 per hour. This is not very well scalable with many tenants. Switching over to GitHub app will get a rate limit per installation, which would greatly increase the rate limit exhaustion problem we have seen lately

[chaodaiG]

The migration can be done one org/repo at a time, there are two steps:

1. Install Google OSS Prow app on corresponding org/repo https://github.com/apps/google-oss-prow
2. Register the org/repo to be handled by prow deployments that use GH app for authentication, example PR Opt in looker for GitHub app authentication #1184

The org/repo with managed webhooks are the targets for migration:

• google/http_pattern_matcher
• google/bms-toolkit
• googleforgames/agones
• grpc-ecosystem/grpc-httpjson-transcoding
• GoogleCloudPlatform/artifact-registry-apt-transport
• GoogleCloudPlatform/artifact-registry-yum-plugin
• GoogleCloudPlatform/compute-image-tools
• GoogleCloudPlatform/elcarro-oracle-operator
• GoogleCloudPlatform/esp-v2
• GoogleCloudPlatform/guest-agent
• GoogleCloudPlatform/guest-configs
• GoogleCloudPlatform/guest-diskexpand
• GoogleCloudPlatform/guest-logging-go
• GoogleCloudPlatform/guest-oslogin
• GoogleCloudPlatform/guest-test-infra
• GoogleCloudPlatform/k8s-cloud-provider
• GoogleCloudPlatform/osconfig
• GoogleCloudPlatform/oss-test-infra
• GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp
• GoogleCloudPlatform/testgrid
• kubeflow
• looker
• GoogleCloudPlatform/blueprints
• chaotoppicks

Note:

• Once the app is installed, webhook from the org/repo will be sent to prow. So for google and GoogleCloudPlatform, it is recommended to install on repo level instead of org level to avoid unnecessary webhooks.
• There is no reason to panic if the webhook is configured on the org level by accident, the webhooks are only processed when:
  • Plugins are defined for the org
  • (AND) prow deployment says --github-enabled-org=<ORG>

[chaodaiG]

So far all orgs/repos have been migrated over to use GitHub app, crier, hook, and tide work well with Github now. Remaining work:

- Sub. Fix needed from upstream kubernetes/test-infra#24316

• Deck. Blocked by Deck OAuth Authentication not working with Apps Auth enabled kubernetes/test-infra#23870. Will use PAT in the short term. The drawback is that for new onboards, PR status page and rerun button might not work unless they add google-oss-robot as admin of their repos.

[chaodaiG]

Sub just migrated with the fix #1313 , and it seems working fine so far

[chaodaiG]

Will mark this issue as fixed, since deck migration is not super critical at this point. Will revisit when it becomes necessary

/close

[google-oss-prow]

@chaodaiG: Closing this issue.

In response to this:

Will mark this issue as fixed, since deck migration is not super critical at this point. Will revisit when it becomes necessary

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.