You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@beam.apache.org by ke...@apache.org on 2022/05/09 19:39:10 UTC
[beam] branch master updated: [BEAM-14169] Add Credentials rotation cron job for clusters (#17383)
This is an automated email from the ASF dual-hosted git repository.
kenn pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/beam.git
The following commit(s) were added to refs/heads/master by this push:
new 85d9824f108 [BEAM-14169] Add Credentials rotation cron job for clusters (#17383)
85d9824f108 is described below
commit 85d9824f108a65853443d1cab9ae767ab3ab1aa5
Author: Elias Segundo Antonio <el...@gmail.com>
AuthorDate: Mon May 9 14:39:03 2022 -0500
[BEAM-14169] Add Credentials rotation cron job for clusters (#17383)
Add cron groovy job for credentials rotation. As Jenkins already has the `-xe` flag set while executing DSL jobs, if a command returns an error then the job will be stopped and marked as fail. Addded email notifications in case of failure and jobs were separated.
Co-authored-by: Elias Segundo <el...@luisrazo.local>
---
.../job_IODatastoresCredentialsRotation.groovy | 56 ++++++++++++++++++++++
.../jenkins/job_MetricsCredentialsRotation.groovy | 56 ++++++++++++++++++++++
2 files changed, 112 insertions(+)
diff --git a/.test-infra/jenkins/job_IODatastoresCredentialsRotation.groovy b/.test-infra/jenkins/job_IODatastoresCredentialsRotation.groovy
new file mode 100644
index 00000000000..55ba93d90c5
--- /dev/null
+++ b/.test-infra/jenkins/job_IODatastoresCredentialsRotation.groovy
@@ -0,0 +1,56 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import CommonJobProperties as commonJobProperties
+
+job('Rotate IO-Datastores Cluster Credentials') {
+ description('Rotates Certificates and performs an IP rotation for Metrics cluster')
+
+ // Set common parameters.
+ commonJobProperties.setTopLevelMainJobProperties(delegate)
+
+ // Sets that this is a cron job.
+ commonJobProperties.setCronJob(delegate, 'H 2 1 */2 *')// At 00:02am every second month.
+ def date = new Date().format('E MMM dd HH:mm:ss z yyyy')
+
+ steps {
+ //Starting credential rotation
+ shell('''gcloud container clusters update io-datastores \
+ --start-credential-rotation --zone=us-central1-a --quiet''')
+
+ //Rebuilding the nodes
+ shell('''gcloud container clusters upgrade io-datastores \
+ --node-pool=default-pool --zone=us-central1-a --quiet''')
+
+ //Completing the rotation
+ shell('''gcloud container clusters update io-datastores \
+ --complete-credential-rotation --zone=us-central1-a --quiet''')
+ }
+
+ publishers {
+ extendedEmail {
+ triggers {
+ failure {
+ subject('Credentials Rotation Failure on IO-Datastores cluster')
+ content("Something went wrong during the automatic credentials rotation for IO-Datastores Cluster, performed at ${date}. It may be necessary to check the state of the cluster certificates. For further details refer to the following links:\n * ${JOB_URL} \n * ${JENKINS_URL}.")
+ recipientList('dev@beam.apache.org')
+ }
+ }
+ }
+ }
+}
diff --git a/.test-infra/jenkins/job_MetricsCredentialsRotation.groovy b/.test-infra/jenkins/job_MetricsCredentialsRotation.groovy
new file mode 100644
index 00000000000..f7e295e2b81
--- /dev/null
+++ b/.test-infra/jenkins/job_MetricsCredentialsRotation.groovy
@@ -0,0 +1,56 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import CommonJobProperties as commonJobProperties
+
+job('Rotate Metrics Cluster Credentials') {
+ description('Rotates Certificates and performs an IP rotation for Metrics cluster')
+
+ // Set common parameters.
+ commonJobProperties.setTopLevelMainJobProperties(delegate)
+
+ // Sets that this is a cron job.
+ commonJobProperties.setCronJob(delegate, 'H 2 1 */2 *')// At 00:02am every second month.
+ def date = new Date().format('E MMM dd HH:mm:ss z yyyy')
+
+ steps {
+ //Starting credential rotation
+ shell('''gcloud container clusters update metrics \
+ --start-credential-rotation --zone=us-central1-a --quiet''')
+
+ //Rebuilding the nodes
+ shell('''gcloud container clusters upgrade metrics \
+ --node-pool=default-pool --zone=us-central1-a --quiet''')
+
+ //Completing the rotation
+ shell('''gcloud container clusters update metrics \
+ --complete-credential-rotation --zone=us-central1-a --quiet''')
+ }
+
+ publishers {
+ extendedEmail {
+ triggers {
+ failure {
+ subject('Credentials Rotation Failure on Metrics cluster')
+ content("Something went wrong during the automatic credentials rotation for Metrics Cluster, performed at ${date}. It may be necessary to check the state of the cluster certificates. For further details refer to the following links:\n * ${JOB_URL} \n * ${JENKINS_URL}.")
+ recipientList('dev@beam.apache.org')
+ }
+ }
+ }
+ }
+}