chore(updatecli): add an updatecli manifest to automatically create a PR to renew certificates for trusted.ci and cert.ci #191

smerle33 · 2024-01-09T08:29:01Z

provide an automatic way to update expiration date for renewing certificates, this will spawn PR to generate the new certificates

…iration date for trusted.ci and cert.ci

smerle33 · 2024-01-09T08:29:43Z

--- locals.tf
+++ locals.tf
@@ -15,7 +15,7 @@
 
   lets_encrypt_dns_challenged_domains = {
     "trusted.ci.jenkins.io" = "2024-04-03T20:00:00Z"
-    "cert.ci.jenkins.io"    = "2024-04-03T21:00:00Z"
+    "cert.ci.jenkins.io"    = "2024-04-08T00:00:00Z"
     # TODO: add support for workload identities by providing an empty expiration date
     # "<something>.jenkins.io" = ""
   }

and

--- locals.tf
+++ locals.tf
@@ -14,7 +14,7 @@
   }
 
   lets_encrypt_dns_challenged_domains = {
-    "trusted.ci.jenkins.io" = "2024-04-03T20:00:00Z"
+    "trusted.ci.jenkins.io" = "2024-04-08T00:00:00Z"
     "cert.ci.jenkins.io"    = "2024-04-03T21:00:00Z"
     # TODO: add support for workload identities by providing an empty expiration date
     # "<something>.jenkins.io" = ""

updatecli/updatecli.d/letsencrypt_cert.ci.yaml

dduportal

Good job,n almost there!

A few blockers:
- shellcheck errors about shebang/options
- Title isn't clear about "what" is updated with its expiry date
Nitpicks:
- Can you add a comment (eventually a block comment) to explain why using file kind instead of terraform?
- To be thought: the PR which will be opened by this updatecli manfiest does not point to any procedure about "where" to update the new password. worth checking if we can custiomize the PR body with updatecli

updatecli/scripts/datediff.sh

updatecli/scripts/dateadd.sh

updatecli/updatecli.d/letsencrypt_cert.ci.yaml

Co-authored-by: Damien Duportal <damien.duportal@gmail.com>

dduportal

There are errors related to date, not sure to understand them at first sight

updatecli/scripts/datediff.sh

… busybox

smerle33 · 2024-01-19T16:11:35Z

the date with -D was the date in busybox https://stackoverflow.com/questions/72747456/busybox-date-to-decode-time-in-a-custom-format

as for now, we use a more conventional date working alike gnudate:

https://infra.ci.jenkins.io/blue/organizations/jenkins/terraform-jobs%2Fazure-net/detail/PR-191/10/pipeline/51#step-55-log-72

and

https://infra.ci.jenkins.io/blue/organizations/jenkins/terraform-jobs%2Fazure-net/detail/PR-191/10/pipeline/51#step-55-log-125

smerle33 · 2024-01-22T13:10:03Z

updatecli/updatecli.d/letsencrypt_cert.ci.yaml

+    scmid: default
+    spec:
+      title: Generate new letsencrypt certificate for cert.ci new expiration date {{ source "nextExpiry" }}
+      description: paste this certicate output here https://github.com/jenkins-infra/jenkins-infra/blob/587d065d9fc609db2cd5ececc01a8159657a73fa/hieradata/clients/controller.cert.ci.jenkins.io.yaml#L30


this should provide information within the body of the PullRequest

smerle33 · 2024-01-22T13:10:13Z

updatecli/updatecli.d/letsencrypt_trusted.ci.yaml

+    scmid: default
+    spec:
+      title: Generate new letsencrypt certificate for trusted.ci new expiration date  {{ source "nextExpiry" }}
+      description: paste this certicate output here https://github.com/jenkins-infra/jenkins-infra/blob/587d065d9fc609db2cd5ececc01a8159657a73fa/hieradata/clients/controller.trusted.ci.jenkins.io.yaml#L35


this should provide information within the body of the PullRequest

lemeurherve · 2024-01-22T16:56:48Z

updatecli/updatecli.d/letsencrypt_trusted.ci.yaml

+    scmid: default
+    spec:
+      title: Generate new letsencrypt certificate for trusted.ci new expiration date  {{ source "nextExpiry" }}
+      description: paste this certicate output here https://github.com/jenkins-infra/jenkins-infra/blob/587d065d9fc609db2cd5ececc01a8159657a73fa/hieradata/clients/controller.trusted.ci.jenkins.io.yaml#L35


paste this certicate output

Which output more precisely?

more precise now

lemeurherve · 2024-01-22T17:04:52Z

updatecli/updatecli.d/letsencrypt_cert.ci.yaml

@@ -56,6 +56,6 @@ actions:
    kind: github/pullrequest
    scmid: default
    spec:
-      title: Generate a new password for the Azure Service Principal "cert.ci.jenkins.io - Let's Encrypt" with (https://github.com/jenkins-infra/jenkins-infra/blob/d76e72a6c1ee06a0d321ed4d04c5d3e1b81d061d/hieradata/clients/controller.cert.ci.jenkins.io.yaml#L27)
+      title: Generate a new password for the Azure Service Principal "cert.ci.jenkins.io - Let's Encrypt". Set the new password value in the following encrypted file: <https://github.com/jenkins-infra/jenkins-infra/blob/d76e72a6c1ee06a0d321ed4d04c5d3e1b81d061d/hieradata/clients/controller.cert.ci.jenkins.io.yaml#L27> (open a PR : https://github.com/jenkins-infra/jenkins-infra/edit/production/hieradata/clients/controller.cert.ci.jenkins.io.yaml).


Suggested change

title: Generate a new password for the Azure Service Principal "cert.ci.jenkins.io - Let's Encrypt". Set the new password value in the following encrypted file: <https://github.com/jenkins-infra/jenkins-infra/blob/d76e72a6c1ee06a0d321ed4d04c5d3e1b81d061d/hieradata/clients/controller.cert.ci.jenkins.io.yaml#L27> (open a PR : https://github.com/jenkins-infra/jenkins-infra/edit/production/hieradata/clients/controller.cert.ci.jenkins.io.yaml).

title: Generate a new password for the Azure Service Principal "cert.ci.jenkins.io - Let's Encrypt"

description: Set the new password value at `sp_client_secret` in the `profile::letsencrypt::dns_azure:` section of the encrypted file: https://github.com/jenkins-infra/jenkins-infra/blob/production/hieradata/clients/controller.cert.ci.jenkins.io.yaml.

Add description, no "absolute" ref, and removing the "open a PR link", a bit redundant.

dduportal

[2024-03-22T10:59:50.205Z] CONDITIONS:
[2024-03-22T10:59:50.205Z] ===========
[2024-03-22T10:59:50.205Z] 
[2024-03-22T10:59:50.205Z] checkIfExpirySoonExpiredcert
[2024-03-22T10:59:50.205Z] ----------------------------
[2024-03-22T10:59:50.205Z] The shell 🐚 command "/bin/sh /tmp/updatecli/bin/d8a07761ca8468705bdcd187510d8a87a1813a2d546f279433b40952ebee3875.sh" exited on error (exit code 1) with the following output:
[2024-03-22T10:59:50.205Z] ----
[2024-03-22T10:59:50.205Z] not yet expired
[2024-03-22T10:59:50.205Z] ----
[2024-03-22T10:59:50.205Z] 
[2024-03-22T10:59:50.205Z] command stderr output was:
[2024-03-22T10:59:50.205Z] ----
[2024-03-22T10:59:50.205Z] + currentexpirydate=2024-04-03T21:00:00Z
[2024-03-22T10:59:50.205Z] + DATE_BIN=date
[2024-03-22T10:59:50.205Z] + command -v gdate
[2024-03-22T10:59:50.205Z] + command -v date
[2024-03-22T10:59:50.205Z] ++ date --utc +%s
[2024-03-22T10:59:50.205Z] + currentdateepoch=1711105190
[2024-03-22T10:59:50.205Z] ++ date +%s -d 2024-04-03T21:00:00Z
[2024-03-22T10:59:50.205Z] + expirydateepoch=1712178000
[2024-03-22T10:59:50.205Z] + datediff=12
[2024-03-22T10:59:50.205Z] + '[' 12 -lt 10 ']'
[2024-03-22T10:59:50.205Z] + echo 'not yet expired'
[2024-03-22T10:59:50.205Z] + exit 1
[2024-03-22T10:59:50.205Z] 
[2024-03-22T10:59:50.205Z] ----
[2024-03-22T10:59:50.205Z] shell command failed. Expected exit code 0 but got 1
[2024-03-22T10:59:50.205Z] ✗ shell condition of type "console/output" not passing
[2024-03-22T10:59:50.205Z] 
[2024-03-22T10:59:50.205Z] 
[2024-03-22T10:59:50.205Z] TARGETS
[2024-03-22T10:59:50.205Z] ========
[2024-03-22T10:59:50.205Z] 
[2024-03-22T10:59:50.205Z] updateNextExpirycert
[2024-03-22T10:59:50.205Z] --------------------
[2024-03-22T10:59:50.205Z] Conditions [checkIfExpirySoonExpiredcert] not met. Skipping execution of the target["updateNextExpirycert"]

=> that looks good!

I would set the diff date to 3 weeks (e.g. 21 days) to map to our calendars. It would let us enough time to "detect, understand and plan" the change: 10 days looks really short. WDYT? (besides, that change would trigger the new PR so a good way to fully validate)

done

dduportal

LGTM!

The output checks show that the 2 dates will have to be updated!

[2024-04-05T12:26:51.670Z] TARGETS
[2024-04-05T12:26:51.670Z] ========
[2024-04-05T12:26:51.670Z] 
[2024-04-05T12:26:51.670Z] updateNextExpirycert
[2024-04-05T12:26:51.670Z] --------------------
[2024-04-05T12:26:51.670Z] 
[2024-04-05T12:26:51.670Z] **Dry Run enabled**
[2024-04-05T12:26:51.670Z] 
[2024-04-05T12:26:51.670Z] "locals.tf" updated with [dry run] content "${1}2024-07-04T00:00:00Z\""
[2024-04-05T12:26:51.670Z] 
[2024-04-05T12:26:51.670Z] ```
[2024-04-05T12:26:51.670Z] --- locals.tf
[2024-04-05T12:26:51.670Z] +++ locals.tf
[2024-04-05T12:26:51.670Z] @@ -15,7 +15,7 @@
[2024-04-05T12:26:51.670Z]  
[2024-04-05T12:26:51.670Z]    lets_encrypt_dns_challenged_domains = {
[2024-04-05T12:26:51.670Z]      "trusted.ci.jenkins.io" = "2024-04-03T20:00:00Z"
[2024-04-05T12:26:51.670Z] -    "cert.ci.jenkins.io"    = "2024-04-03T21:00:00Z"
[2024-04-05T12:26:51.670Z] +    "cert.ci.jenkins.io"    = "2024-07-04T00:00:00Z"
[2024-04-05T12:26:51.670Z]      # TODO: add support for workload identities by providing an empty expiration date
[2024-04-05T12:26:51.670Z]      # "<something>.jenkins.io" = ""
[2024-04-05T12:26:51.670Z]    }
[2024-04-05T12:26:51.670Z] 
[2024-04-05T12:26:51.670Z] ```
[2024-04-05T12:26:51.670Z] 
[2024-04-05T12:26:51.670Z] ⚠ - 1 file(s) updated with "${1}2024-07-04T00:00:00Z\"":
[2024-04-05T12:26:51.670Z] 	* locals.tf

Great work!

chore(updatecli): add an updatecli manifest to update letsencrypt exp…

fed6682

…iration date for trusted.ci and cert.ci

smerle33 requested a review from a team as a code owner January 9, 2024 08:29

change to 10 days expiration

201efb7

smerle33 commented Jan 9, 2024

View reviewed changes

updatecli/updatecli.d/letsencrypt_cert.ci.yaml Outdated Show resolved Hide resolved

dduportal requested changes Jan 9, 2024

View reviewed changes

updatecli/scripts/datediff.sh Outdated Show resolved Hide resolved

updatecli/scripts/dateadd.sh Outdated Show resolved Hide resolved

updatecli/updatecli.d/letsencrypt_cert.ci.yaml Outdated Show resolved Hide resolved

smerle33 and others added 2 commits January 10, 2024 09:08

chore comment

ea8cf7c

Apply suggestions from code review

3830589

Co-authored-by: Damien Duportal <damien.duportal@gmail.com>

smerle33 changed the title ~~chore(updatecli): add an updatecli manifest to update letsencrypt expiration date for trusted.ci and cert.ci~~ chore(updatecli): add an updatecli manifest to automatally create a PR to renew certificates for trusted.ci and cert.ci Jan 10, 2024

smerle33 added 3 commits January 10, 2024 09:25

chore pr body with link

8452a7d

chore cert.ci

1b34c5e

chore trusted.ci comments and PR body

d9981ad

mcwarman mentioned this pull request Jan 10, 2024

terraform/file path not able to match keys with dots "." in name updatecli/updatecli#1859

Open

1 task

smerle33 requested a review from dduportal January 10, 2024 14:30

dduportal changed the title ~~chore(updatecli): add an updatecli manifest to automatally create a PR to renew certificates for trusted.ci and cert.ci~~ chore(updatecli): add an updatecli manifest to automatically create a PR to renew certificates for trusted.ci and cert.ci Jan 17, 2024

dduportal previously requested changes Jan 17, 2024

View reviewed changes

updatecli/scripts/datediff.sh Outdated Show resolved Hide resolved

smerle33 and others added 3 commits January 19, 2024 17:04

no need for -D anymore as date is the new version from debian and not…

ebbfeb7

… busybox

more comments

6a31926

Merge branch 'main' into updatecli/date/certificats

9703691

smerle33 requested a review from dduportal January 19, 2024 16:09

smerle33 commented Jan 22, 2024

View reviewed changes

dduportal marked this pull request as draft January 22, 2024 16:37

Update letsencrypt_cert.ci.yaml

af17d5f

lemeurherve reviewed Jan 22, 2024

View reviewed changes

Update letsencrypt_cert.ci.yaml

5763c59

lemeurherve reviewed Jan 22, 2024

View reviewed changes

chore enhance description

95fe5dd

smerle33 marked this pull request as ready for review January 23, 2024 13:10

smerle33 and others added 8 commits January 23, 2024 14:10

Merge branch 'main' into updatecli/date/certificats

58ab775

Merge branch 'main' into updatecli/date/certificats

28f1cc1

Update letsencrypt_cert.ci.yaml

69e5b76

Update letsencrypt_trusted.ci.yaml

34b9433

Update letsencrypt_cert.ci.yaml

d6b9de8

Update letsencrypt_trusted.ci.yaml

83d909e

Merge branch 'main' into updatecli/date/certificats

513d93a

Merge branch 'main' into updatecli/date/certificats

6f25527

dduportal mentioned this pull request Mar 21, 2024

Service Principal used by infra.ci.jenkins.io to spawn Azure agents expires on 2024-03-22 jenkins-infra/helpdesk#4000

Closed

Merge branch 'main' into updatecli/date/certificats

0a92e43

dduportal reviewed Mar 25, 2024

View reviewed changes

smerle33 and others added 2 commits April 5, 2024 14:19

change delay to 21 days instead of 10 days

61dcc81

Merge branch 'main' into updatecli/date/certificats

cbfb63d

dduportal approved these changes Apr 5, 2024

View reviewed changes

smerle33 merged commit 914768f into jenkins-infra:main Apr 5, 2024
2 checks passed

smerle33 deleted the updatecli/date/certificats branch April 5, 2024 12:39

smerle33 mentioned this pull request Apr 5, 2024

chore(updatecli): correct manifest #217

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(updatecli): add an updatecli manifest to automatically create a PR to renew certificates for trusted.ci and cert.ci #191

chore(updatecli): add an updatecli manifest to automatically create a PR to renew certificates for trusted.ci and cert.ci #191

smerle33 commented Jan 9, 2024 •

edited

smerle33 commented Jan 9, 2024

dduportal left a comment •

edited

dduportal left a comment

smerle33 commented Jan 19, 2024 •

edited

smerle33 Jan 22, 2024

smerle33 Jan 22, 2024

lemeurherve Jan 22, 2024

smerle33 Jan 23, 2024

lemeurherve Jan 22, 2024

dduportal left a comment

dduportal left a comment

	title: Generate a new password for the Azure Service Principal "cert.ci.jenkins.io - Let's Encrypt". Set the new password value in the following encrypted file: <https://github.com/jenkins-infra/jenkins-infra/blob/d76e72a6c1ee06a0d321ed4d04c5d3e1b81d061d/hieradata/clients/controller.cert.ci.jenkins.io.yaml#L27> (open a PR : https://github.com/jenkins-infra/jenkins-infra/edit/production/hieradata/clients/controller.cert.ci.jenkins.io.yaml).
	title: Generate a new password for the Azure Service Principal "cert.ci.jenkins.io - Let's Encrypt"
	description: Set the new password value at `sp_client_secret` in the `profile::letsencrypt::dns_azure:` section of the encrypted file: https://github.com/jenkins-infra/jenkins-infra/blob/production/hieradata/clients/controller.cert.ci.jenkins.io.yaml.

chore(updatecli): add an updatecli manifest to automatically create a PR to renew certificates for trusted.ci and cert.ci #191

chore(updatecli): add an updatecli manifest to automatically create a PR to renew certificates for trusted.ci and cert.ci #191

Conversation

smerle33 commented Jan 9, 2024 • edited

smerle33 commented Jan 9, 2024

dduportal left a comment • edited

Choose a reason for hiding this comment

dduportal left a comment

Choose a reason for hiding this comment

smerle33 commented Jan 19, 2024 • edited

smerle33 Jan 22, 2024

Choose a reason for hiding this comment

smerle33 Jan 22, 2024

Choose a reason for hiding this comment

lemeurherve Jan 22, 2024

Choose a reason for hiding this comment

smerle33 Jan 23, 2024

Choose a reason for hiding this comment

lemeurherve Jan 22, 2024

Choose a reason for hiding this comment

dduportal left a comment

Choose a reason for hiding this comment

dduportal left a comment

Choose a reason for hiding this comment

smerle33 commented Jan 9, 2024 •

edited

dduportal left a comment •

edited

smerle33 commented Jan 19, 2024 •

edited