[infra.ci.jenkins.io] 2025-02-18 Expiration of the Digital Oceans PATs used by Terraform

[smerle33]

Service(s)

infra.ci.jenkins.io, DigitalOcean

Summary

The Digital Ocean PATs (Personal Access Tokens) are expiring the 18 February 2025.

For info, previous token rotation: #4395

Todo list:

• Generate a new pair of tokens:
  • Connect to DigitalOcean as the "Jenkins Infrastructure Technical User" (email: jenkins-infra-team@googlegroups.com)
  • use https://github.com/jenkins-infra/runbooks/blob/main/shared-totp/README.adoc for 2FA
  • Browse to the "API"section -> "Applications & API" title -> "Tokens/key" tab
  • Regenerate the 2 tokens (or create new ones if they disappeared) with 90 days of TTL:
    • infra.ci-production => Read + Write
    • infra.ci-staging => Read-Only
• Update tokens in the IaC setup:
  • Update the SOPS encrypted secrets in https://github.com/jenkins-infra/charts-secrets -
  • Run a build of jenkins-infra/kubernetes-management on its main branch to deploy new secrets -
  • Reload JCasc on infra.ci to ensure credentials are updated from new secret
• Verify that the jenkins-infra/digitalocean is back to successful state (run a new PR or main build) -
• Add a calendar event in 90 days with a 2 weeks alert

Reproduction steps

No response