Service Principal used by infra.ci.jenkins.io to spawn Azure agents expires on 2024-03-22

[lemeurherve]

Service(s)

infra.ci.jenkins.io

Summary

The SP password end date is set to 2024-03-22:

https://github.com/jenkins-infra/azure/blob/1c14ad33dfbf32f96755346fdba2915be0a4989b/infra.ci.jenkins.io.tf#L44-L48

It needs to be updated, then the corresponding credentials must be updated in chart-secrets (private repo).

Reproduction steps

No response

[dduportal]

Opened jenkins-infra/azure#648 to rotate (by extending expiration date of 3 months) the credential

[dduportal]

Weird: the Azure console was still showing the old SP password while terrafomr (and Azure API) showed the new one.

Old password value was invalid and revoked (which is good) but no new value visible though. Might be an Azure weirdness.

Out of caution, we deleted the existing SP password (not the SP!) and ran the terraform azure job a second time to create the new credential with success

[dduportal]

• Update the credential manually in infra.ci and tested it through the associated button
• Updated the credential in sops , pushed the change and kubernetes-management is currently re-deploying secrets

=> waiting 4 hours before closing (time to ensure any leftover in-memory Azure token are rotated to use the new SP)

[dduportal]

• Everything works as expected.
• Calendar updated to let us know about the next time
• Automatic PR to update the expiration dates should help: see chore(updatecli): add an updatecli manifest to automatically create a PR to renew certificates for trusted.ci and cert.ci azure-net#191