[April 2024] Cloudflare API tokens are expired

[dduportal]

We had a team-calendar alert the 1st of April 2024, shifted to the 2nd of April 2024 (as 1st is a banking day in a lot of locations) alerting us that the Cloudflare token(s) will expire.

These tokens are stored in the private repository https://github.com/jenkins-infra/terraform-states/blob/main/cloudflare/main.tf. It is confirmed that their expiration date is 2024-04-01: they are already expired.

Their purposes are:

• Allow jenkins-infra/terraform to authenticate on the Cloudflare API
• Allow jenkins-infra/update_center2 and jenkins-infra/crawler to authenticate to the Cloudflare R2 buckets

=> all of this jobs are failing due to the expiration (see https://matrix.to/#/!JLUOInpEYmxJIYXlzs:matrix.org/$1iM95X460ArJA5h4YKqHAwoLNfjl-tRt_xhkXLFXe9A?via=g4v.dev&via=gitter.im&via=matrix.org)

Todo list:

• Renew all the tokens with a new 3 month-TTL
• Insert the renewed tokens in all the required locations
• Ensure all the jobs are back to success
• Add a improved calendar event with 3 weeks notice

[smerle33]

Token renewed in (private repo) https://github.com/jenkins-infra/terraform-states/commit/1912f57c79d9129ae87f471a85b63e0f324980c7 for 3 months

[dduportal]

Updated the credentials with the new token values:

• infra.ci (for jenkins-infra/cloudflare) in https://github.com/jenkins-infra/charts-secrets/commit/3311cc69f06bbeb24913706e0061f8a55bdebc8b
  • A build of kubernetes-management is running to deploy the new credentials
• trusted.ci: manually with the description of the 2 involved credentials updated to point to the current issue

Next step: check jobs are going back to success with the new tokens

[dduportal]

On trusted.ci, both update center (build 887674) and crawler (build 14284) are back to successful state (with the new rotated tokens)

[dduportal]

The jenkins-infra/cloudflare terraform project is back to success when using the new credentials.

[dduportal]

Calendar updated:

• New date: 2024-07-02
• 3 alerts (3 weeks before, 2 weeks before and 1 week before) to avoid being caught off-guard
• Calendar invite with body updated pointing to this issue

[dduportal]

Note: automation is tricky as the jenkins-infra/terraform-states is a private repository which should NOT be accessed in infra.ci (separation of concerns to avoid putting all sensitive terraform data in the same location).

We might want to check GH action on private repository and/or another Jenkins controller