Enable GitHub OAuth for Sentry 10

[omgitsbillryan]

Issue Description

Configure our Sentry 10 deployment with GitHub OAuth to allow our users to login using their GitHub accounts.

Extra Context

• Our Sentry 9 deployment has already been configured for this behavior
• Our current Sentry 10 deployment is completely vanilla and will probably require that config files are copied written to the EC2 instance as part of our Ansible deploy scripts

Tasks

• [x] Create necessary Sentry config in the relevant Sentry config files
• [x] Have the Ansible deployment write the files (probably w/ templates) to the EC2 instance

Acceptance Criteria

• [x] Sentry 10 builds include configuration for GitHub OAuth
• [ ] Configuration for OAuth works in the Sentry UI

---

How to configure this issue

• [ ] Attached to a Milestone (when will this be completed?)
• [x] Attached to an Epic (what body of work is this a part of?)
• [x] Labeled with Team (product support, analytics-insights, operations, service-design, tools-be, tools-fe)
• [x] Labeled with Practice Area (backend, frontend, devops, design, research, product, ia, qa, analytics, contact center, research, accessibility, content)
• [x] Labeled with Type (bug, request, discovery, documentation, etc.)

[kfrz]

2020-08-10

• Spun up a test GitHub app
• Configured Sentry with the following in sentry.conf.py.j2:

#################################
# GitHub Enterprise Integration #
#################################

SENTRY_OPTIONS['github-app.name']           = 'sentry10-test-kf'
SENTRY_OPTIONS['github-app.id']             = {{ lookup('credstash', 'sentry.testbed.github_app.id') }}
SENTRY_OPTIONS['github-app.client-id']      = r'{{ lookup('credstash', 'sentry.testbed.github_app.client_id') }}'
SENTRY_OPTIONS['github-app.client-secret']  = r'{{ lookup('credstash', 'sentry.testbed.github_app.client_secret') }}'
SENTRY_OPTIONS['github-app.webhook-secret'] = r'{{ lookup('credstash', 'sentry.testbed.github_app.webhook_secret') }}'
SENTRY_OPTIONS['github-app.private-key']    = r'''{{ lookup('credstash', 'sentry.testbed.github_app.private_key') }}'''

• Added those values into Credstash
• Pushed a branch containing settings changes kfrz/sentry10-configure-github
• Kicked off a build/deploy of Sentry10 (failed)

Notes

• I had a bunch of notes here but they were lost in a browser-crash :(
• Will need to identify GitHub DSVA org admin to eventually transfer application

[kfrz]

2020-08-11

• [x] Hold meeting with @omgitsbillryan to go over progress and deploy latest AMI

• [ ] ~Need to define webhook url in revproxy for Sentry10 see here~

• [ ] ~Redeploy revproxy with webhook? Maybe not necessary~

• [x] Write sentry.conf.py.j2 template to EC2 filesystem for use by docker - see ansible/deployment/config/sentry10-utility.yml

• https://github.com/getsentry/sentry/blob/10.0.1/docker/sentry.conf.py

Notes

• look into release job for sentry10
• sentry oauth github provider now in sentry project

[kfrz]

2020-08-17

Tasks

• [x] Redeploy previously generated AMI as my latest is returning 502 when deployed. Job
• [x] Write Sentry config template to the EC2 filesystem for use in the Sentry Dockerfile

Next Steps

• Create and test a Sentry 10 release configuration (#13161)
• Create a Sentry specific IAM Role (or update/attach sentry-web-worker, see ansible/deployment/config/sentry10-utility.yml

Notes

• Carrying over work from last week and diving back in
• Not sure we need to have a webhook URL in reverse proxy for the OAuth part.
• If/when we need an internal DNS update, look here
• Can we move Sentry10 configuration TF to use vagov-utility not vetsgov-utility...or document why it's still vetsgov?
• How are we supposed to use tags in our deployment roles - high_cpu , high_io, etc?

[kfrz]

2020-08-18

Tasks

• [x] Cleanup the configuration template and commit to git branch
• [x] Test the build locally and check (in ssh, then docker,) for the GitHub credstash calls
• [x] Open PR with changes (#7532)

Next Steps

• [ ] Create and test a Sentry 10 release configuration (#13161)
• [ ] Create a Sentry specific IAM Role (or update/attach sentry-web-worker, see ansible/deployment/config/sentry10-utility.yml

[kfrz]

2020-08-26

• Using the onpremise repository, I needed to run ./install.sh and then docker exec -it sentry_onpremise_web_1 /bin/bash to drop into a shell
• Running sentry upgrade will migrate the databases and prompt for a user creation, then localhost:9000 is accessible
• Testing with a local vets-api and updating the SENTRY_DSN env var
• Successfully built and deployed AMI
• We used CI=true because otherwise the install.sh script will attempt to prompt user for the sentry createuser step
• Building locally works! Verified by checking vagrant ssh <sentrybox> and looking at the configuration files.
• Interestingly the config.yml and the sentry.config.py have different formats (ofc, syntax), but curious which is better to use for integration config

[kfrz]

2020-08-27

• Built an AMI and deployed with configuration locally
• Configuration is in place but won't connect to webhook?

Next Steps

• [x] Figure out why deploy is not updating AMI in vagov-utility
• [ ] Finish updating the new README.md

[kfrz]

2020-09-02

• Figured out the details for the GitHub linkage.
• A developer application vs OAuth application is the difference, needed to configure the OAuth app
• Tested by wiring up to my personal organization, was able to finish the configuration flow
• Will need help from DSVA GitHub org admins now to accept app transfer issue here

Next Steps

• [x] Add OAuth app credentials to credstash
• [x] Update sentry.conf.py.j2 to include the GitHub OAuth details

[kfrz]

2020-09-03

• OAuth is now working for login on sentry10.vfs.va.gov !