Expiration of the Digital Oceans PATs [10 June 2024]

[dduportal]

Service(s)

infra.ci.jenkins.io, DigitalOcean

Summary

The Digital Ocean PATs (Personal Access Tokens) are expiring the 10 June 2024.

For info, previous token rotation: #3986

Todo list:

• Generate a new pair of tokens:
  • Connect to DigitalOcean as the "Jenkins Infrastructure Technical User" (email: jenkins-infra-team@googlegroups.com)
  • use https://github.com/jenkins-infra/runbooks/blob/main/shared-totp/README.adoc for 2FA
  • Browse to the "API"section -> "Applications & API" title -> "Tokens/key" tab
  • Regenerate the 2 tokens (or create new ones if they disappeared) with 90 days of TTL:
    • infra.ci-production => Read + Write
    • infra.ci-staging => Read-Only
• Update tokens in the IaC setup:
  • Update the SOPS encrypted secrets in https://github.com/jenkins-infra/charts-secrets - < commit link >
  • Run a build of jenkins-infra/kubernetes-management on its main branch to deploy new secrets
  • Reload JCasc on infra.ci to ensure credentials are updated from new secret
• Verify that the jenkins-infra/digitalocean is back to successful state (run a new PR or main build) - Apply complete! Resources: 0 added, 0 changed, 0 destroyed
• Add a calendar event in 90 days with 2 weeks alert

Reproduction steps

No response

[github-actions]

Take a look at these similar issues to see if there isn't already a response to your problem:

1. 79% Expiration of the Digital Oceans PATs [June 2023] #3616
2. 71% Expiration of the Digital Oceans PATs [December 2023] #3853

[smerle33]

rotation and update done successfully

to plan next time, use a custom token to specify rights.

also, it's not possible to renew a token as it keep the same expiration date, so we need to delete the old ones and create new ones with the same names :

infra.ci-production => Read + Write
infra.ci-staging => Read-Only