You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@beam.apache.org by "Amar3tto (via GitHub)" <gi...@apache.org> on 2023/10/04 10:55:08 UTC
[PR] Add rotate credentials workflows [beam]
Amar3tto opened a new pull request, #28815:
URL: https://github.com/apache/beam/pull/28815
The following jenkins job has been migrated:
https://ci-beam.apache.org/job/Rotate%20IO-Datastores%20Cluster%20Credentials/
https://ci-beam.apache.org/job/Rotate%20Metrics%20Cluster%20Credentials/
### How has it been tested?
The job has been tested on Self-hosted GKE runners ubuntu 20.04.
------------------------
Thank you for your contribution! Follow this checklist to help us incorporate your contribution quickly and easily:
- [ ] Mention the appropriate issue in your description (for example: `addresses #123`), if applicable. This will automatically add a link to the pull request in the issue. If you would like the issue to automatically close on merging the pull request, comment `fixes #<ISSUE NUMBER>` instead.
- [ ] Update `CHANGES.md` with noteworthy changes.
- [ ] If this contribution is large, please file an Apache [Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf).
See the [Contributor Guide](https://beam.apache.org/contribute) for more tips on [how to make review process smoother](https://github.com/apache/beam/blob/master/CONTRIBUTING.md#make-the-reviewers-job-easier).
To check the build health, please visit [https://github.com/apache/beam/blob/master/.test-infra/BUILD_STATUS.md](https://github.com/apache/beam/blob/master/.test-infra/BUILD_STATUS.md)
GitHub Actions Tests Status (on master branch)
------------------------------------------------------------------------------------------------
[](https://github.com/apache/beam/actions?query=workflow%3A%22Build+python+source+distribution+and+wheels%22+branch%3Amaster+event%3Aschedule)
[](https://github.com/apache/beam/actions?query=workflow%3A%22Python+Tests%22+branch%3Amaster+event%3Aschedule)
[](https://github.com/apache/beam/actions?query=workflow%3A%22Java+Tests%22+branch%3Amaster+event%3Aschedule)
[](https://github.com/apache/beam/actions?query=workflow%3A%22Go+tests%22+branch%3Amaster+event%3Aschedule)
See [CI.md](https://github.com/apache/beam/blob/master/CI.md) for more information about GitHub Actions CI or the [workflows README](https://github.com/apache/beam/blob/master/.github/workflows/README.md) to see a list of phrases to trigger workflows.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add rotate credentials workflows [beam]
Posted by "andreydevyatkin (via GitHub)" <gi...@apache.org>.
andreydevyatkin commented on code in PR #28815:
URL: https://github.com/apache/beam/pull/28815#discussion_r1347793365
##########
.github/workflows/beam_IODatastoresCredentialsRotation.yml:
##########
@@ -0,0 +1,78 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Rotate IO-Datastores Cluster Credentials
+
+on:
+ schedule:
+ - cron: '0 2 1 * *'
+ workflow_dispatch:
+
+#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
+permissions:
+ actions: write
+ pull-requests: read
+ checks: read
+ contents: read
+ deployments: read
+ id-token: none
+ issues: read
+ discussions: read
+ packages: read
+ pages: read
+ repository-projects: read
+ security-events: read
+ statuses: read
+
+# This allows a subsequently queued workflow run to interrupt previous runs
+concurrency:
+ group: '${{ github.workflow }} @ ${{ github.event.issue.number || github.sha || github.head_ref || github.ref }}-${{ github.event.schedule || github.event.sender.login }}'
+ cancel-in-progress: true
+
+env:
+ GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
+ GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
+ GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}
+
+jobs:
+ beam_IODatastoresCredentialsRotation:
+ if: |
+ github.event_name == 'workflow_dispatch' ||
+ github.event_name == 'schedule'
+ runs-on: [self-hosted, ubuntu-20.04, main]
+ timeout-minutes: 100
+ name: ${{ matrix.job_name }}
+ strategy:
+ matrix:
+ job_name: ["beam_IODatastoresCredentialsRotation"]
+ job_phrase: ["N/A"]
+ steps:
+ - uses: actions/checkout@v3
+ - name: Setup repository
+ uses: ./.github/actions/setup-action
+ with:
+ comment_phrase: ${{ matrix.job_phrase }}
+ github_token: ${{ secrets.GITHUB_TOKEN }}
+ github_job: ${{ matrix.job_name }}
+ - name: Starting credential rotation
+ run: |
+ gcloud container clusters update io-datastores --start-credential-rotation --zone=us-central1-a --quiet
+ - name: Rebuilding the nodes
+ run: |
+ gcloud container clusters upgrade io-datastores --node-pool=pool-1 --zone=us-central1-a --quiet
+ - name: Completing the rotation
+ run: |
+ gcloud container clusters update io-datastores --complete-credential-rotation --zone=us-central1-a --quiet
+# TODO: Send email to dev@beam.apache.org if something went wrong during credentials rotation
Review Comment:
Based on the conversation with @damccorm we agreed to omit this for now
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add rotate credentials workflows [beam]
Posted by "damccorm (via GitHub)" <gi...@apache.org>.
damccorm commented on code in PR #28815:
URL: https://github.com/apache/beam/pull/28815#discussion_r1348575278
##########
.github/workflows/beam_IODatastoresCredentialsRotation.yml:
##########
@@ -0,0 +1,78 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Rotate IO-Datastores Cluster Credentials
+
+on:
+ schedule:
+ - cron: '0 2 1 * *'
+ workflow_dispatch:
+
+#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
+permissions:
+ actions: write
+ pull-requests: read
+ checks: read
+ contents: read
+ deployments: read
+ id-token: none
+ issues: read
+ discussions: read
+ packages: read
+ pages: read
+ repository-projects: read
+ security-events: read
+ statuses: read
+
+# This allows a subsequently queued workflow run to interrupt previous runs
+concurrency:
+ group: '${{ github.workflow }} @ ${{ github.event.issue.number || github.sha || github.head_ref || github.ref }}-${{ github.event.schedule || github.event.sender.login }}'
+ cancel-in-progress: true
+
+env:
+ GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
+ GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
+ GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}
+
+jobs:
+ beam_IODatastoresCredentialsRotation:
+ if: |
+ github.event_name == 'workflow_dispatch' ||
+ github.event_name == 'schedule'
+ runs-on: [self-hosted, ubuntu-20.04, main]
+ timeout-minutes: 100
+ name: ${{ matrix.job_name }}
+ strategy:
+ matrix:
+ job_name: ["beam_IODatastoresCredentialsRotation"]
+ job_phrase: ["N/A"]
+ steps:
+ - uses: actions/checkout@v3
+ - name: Setup repository
+ uses: ./.github/actions/setup-action
+ with:
+ comment_phrase: ${{ matrix.job_phrase }}
+ github_token: ${{ secrets.GITHUB_TOKEN }}
+ github_job: ${{ matrix.job_name }}
+ - name: Starting credential rotation
+ run: |
+ gcloud container clusters update io-datastores --start-credential-rotation --zone=us-central1-a --quiet
+ - name: Rebuilding the nodes
+ run: |
+ gcloud container clusters upgrade io-datastores --node-pool=pool-1 --zone=us-central1-a --quiet
+ - name: Completing the rotation
+ run: |
+ gcloud container clusters update io-datastores --complete-credential-rotation --zone=us-central1-a --quiet
+# TODO: Send email to dev@beam.apache.org if something went wrong during credentials rotation
Review Comment:
Sounds good.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add rotate credentials workflows [beam]
Posted by "damccorm (via GitHub)" <gi...@apache.org>.
damccorm merged PR #28815:
URL: https://github.com/apache/beam/pull/28815
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add rotate credentials workflows [beam]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #28815:
URL: https://github.com/apache/beam/pull/28815#issuecomment-1748754484
Assigning reviewers. If you would like to opt out of this review, comment `assign to next reviewer`:
R: @Abacn for label build.
Available commands:
- `stop reviewer notifications` - opt out of the automated review tooling
- `remind me after tests pass` - tag the comment author after tests pass
- `waiting on author` - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)
The PR bot will only process comments in the main thread (not review comments).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add rotate credentials workflows [beam]
Posted by "Amar3tto (via GitHub)" <gi...@apache.org>.
Amar3tto commented on code in PR #28815:
URL: https://github.com/apache/beam/pull/28815#discussion_r1348540435
##########
.github/workflows/beam_IODatastoresCredentialsRotation.yml:
##########
@@ -0,0 +1,78 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Rotate IO-Datastores Cluster Credentials
+
+on:
+ schedule:
+ - cron: '0 2 1 * *'
+ workflow_dispatch:
+
+#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
+permissions:
+ actions: write
+ pull-requests: read
+ checks: read
+ contents: read
+ deployments: read
+ id-token: none
+ issues: read
+ discussions: read
+ packages: read
+ pages: read
+ repository-projects: read
+ security-events: read
+ statuses: read
+
+# This allows a subsequently queued workflow run to interrupt previous runs
+concurrency:
+ group: '${{ github.workflow }} @ ${{ github.event.issue.number || github.sha || github.head_ref || github.ref }}-${{ github.event.schedule || github.event.sender.login }}'
+ cancel-in-progress: true
+
+env:
+ GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
+ GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
+ GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}
+
+jobs:
+ beam_IODatastoresCredentialsRotation:
+ if: |
+ github.event_name == 'workflow_dispatch' ||
+ github.event_name == 'schedule'
+ runs-on: [self-hosted, ubuntu-20.04, main]
+ timeout-minutes: 100
+ name: ${{ matrix.job_name }}
+ strategy:
+ matrix:
+ job_name: ["beam_IODatastoresCredentialsRotation"]
+ job_phrase: ["N/A"]
+ steps:
+ - uses: actions/checkout@v3
+ - name: Setup repository
+ uses: ./.github/actions/setup-action
+ with:
+ comment_phrase: ${{ matrix.job_phrase }}
+ github_token: ${{ secrets.GITHUB_TOKEN }}
+ github_job: ${{ matrix.job_name }}
+ - name: Starting credential rotation
+ run: |
+ gcloud container clusters update io-datastores --start-credential-rotation --zone=us-central1-a --quiet
+ - name: Rebuilding the nodes
+ run: |
+ gcloud container clusters upgrade io-datastores --node-pool=pool-1 --zone=us-central1-a --quiet
+ - name: Completing the rotation
+ run: |
+ gcloud container clusters update io-datastores --complete-credential-rotation --zone=us-central1-a --quiet
+# TODO: Send email to dev@beam.apache.org if something went wrong during credentials rotation
Review Comment:
We are going to implement the `Send email` step in the separate PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add rotate credentials workflows [beam]
Posted by "damccorm (via GitHub)" <gi...@apache.org>.
damccorm commented on code in PR #28815:
URL: https://github.com/apache/beam/pull/28815#discussion_r1347809604
##########
.github/workflows/beam_IODatastoresCredentialsRotation.yml:
##########
@@ -0,0 +1,78 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Rotate IO-Datastores Cluster Credentials
+
+on:
+ schedule:
+ - cron: '0 2 1 * *'
+ workflow_dispatch:
+
+#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
+permissions:
+ actions: write
+ pull-requests: read
+ checks: read
+ contents: read
+ deployments: read
+ id-token: none
+ issues: read
+ discussions: read
+ packages: read
+ pages: read
+ repository-projects: read
+ security-events: read
+ statuses: read
+
+# This allows a subsequently queued workflow run to interrupt previous runs
+concurrency:
+ group: '${{ github.workflow }} @ ${{ github.event.issue.number || github.sha || github.head_ref || github.ref }}-${{ github.event.schedule || github.event.sender.login }}'
+ cancel-in-progress: true
+
+env:
+ GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
+ GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
+ GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}
+
+jobs:
+ beam_IODatastoresCredentialsRotation:
+ if: |
+ github.event_name == 'workflow_dispatch' ||
+ github.event_name == 'schedule'
+ runs-on: [self-hosted, ubuntu-20.04, main]
+ timeout-minutes: 100
+ name: ${{ matrix.job_name }}
+ strategy:
+ matrix:
+ job_name: ["beam_IODatastoresCredentialsRotation"]
+ job_phrase: ["N/A"]
+ steps:
+ - uses: actions/checkout@v3
+ - name: Setup repository
+ uses: ./.github/actions/setup-action
+ with:
+ comment_phrase: ${{ matrix.job_phrase }}
+ github_token: ${{ secrets.GITHUB_TOKEN }}
+ github_job: ${{ matrix.job_name }}
+ - name: Starting credential rotation
+ run: |
+ gcloud container clusters update io-datastores --start-credential-rotation --zone=us-central1-a --quiet
+ - name: Rebuilding the nodes
+ run: |
+ gcloud container clusters upgrade io-datastores --node-pool=pool-1 --zone=us-central1-a --quiet
+ - name: Completing the rotation
+ run: |
+ gcloud container clusters update io-datastores --complete-credential-rotation --zone=us-central1-a --quiet
+# TODO: Send email to dev@beam.apache.org if something went wrong during credentials rotation
Review Comment:
I think this is actually a slightly different case since its going to dev@beam.apache.org instead of builds@beam.apache.org. I think we should keep emails to the dev list, especially something like this that has a high probability of indicating something that we need to address immediately.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org