[
https://issues.apache.org/jira/browse/BEAM-14169?focusedWorklogId=766772&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-766772
]
ASF GitHub Bot logged work on BEAM-14169:
-----------------------------------------
Author: ASF GitHub Bot
Created on: 05/May/22 16:42
Start Date: 05/May/22 16:42
Worklog Time Spent: 10m
Work Description: kerrydc commented on code in PR #17383:
URL: https://github.com/apache/beam/pull/17383#discussion_r866115080
##########
.test-infra/jenkins/job_ClusterCredentialsRotation.groovy:
##########
@@ -0,0 +1,63 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import CommonJobProperties as commonJobProperties
+
+job('Rotate Cluster Credentials') {
+ description('Rotates Certificates and performs an IP rotation for metrics
and io-datastores')
+
+ // Set common parameters.
+ commonJobProperties.setTopLevelMainJobProperties(delegate)
+
+ // Sets that this is a cron job.
+ commonJobProperties.setCronJob(delegate, 'H 2 1 */2 *')// At 00:02am every
second month.
+
+ steps {
+
+ //Credentials rotation for metrics and io-datastores
+
+ //Set a maintenance window
+ shell('''gcloud container clusters update metrics \
+ --zone=us-central1-a --maintenance-window=06:00 --quiet''')
+
+ shell('''gcloud container clusters update io-datastores \
+ --zone=us-central1-a --maintenance-window=06:00 --quiet''')
+
+ //Starting credential rotation
+ // it's necessary to rebuild the nodes after rotation to avoid apiservices
issues
+ shell('''gcloud container clusters update metrics \
+ --start-credential-rotation --zone=us-central1-a --quiet''')
+
+ shell('''gcloud container clusters update io-datastores \
+ --start-credential-rotation --zone=us-central1-a --quiet''')
+
+ //Rebuilding the nodes
+ shell('''gcloud container clusters upgrade metrics \
Review Comment:
What happens if these commands close with an error state?
##########
.test-infra/jenkins/job_ClusterCredentialsRotation.groovy:
##########
@@ -0,0 +1,63 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import CommonJobProperties as commonJobProperties
+
+job('Rotate Cluster Credentials') {
+ description('Rotates Certificates and performs an IP rotation for metrics
and io-datastores')
+
+ // Set common parameters.
+ commonJobProperties.setTopLevelMainJobProperties(delegate)
+
+ // Sets that this is a cron job.
+ commonJobProperties.setCronJob(delegate, 'H 2 1 */2 *')// At 00:02am every
second month.
+
+ steps {
+
+ //Credentials rotation for metrics and io-datastores
+
+ //Set a maintenance window
+ shell('''gcloud container clusters update metrics \
+ --zone=us-central1-a --maintenance-window=06:00 --quiet''')
+
+ shell('''gcloud container clusters update io-datastores \
+ --zone=us-central1-a --maintenance-window=06:00 --quiet''')
Review Comment:
same here.
##########
.test-infra/jenkins/job_ClusterCredentialsRotation.groovy:
##########
@@ -0,0 +1,63 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import CommonJobProperties as commonJobProperties
+
+job('Rotate Cluster Credentials') {
+ description('Rotates Certificates and performs an IP rotation for metrics
and io-datastores')
+
+ // Set common parameters.
+ commonJobProperties.setTopLevelMainJobProperties(delegate)
+
+ // Sets that this is a cron job.
+ commonJobProperties.setCronJob(delegate, 'H 2 1 */2 *')// At 00:02am every
second month.
+
+ steps {
+
+ //Credentials rotation for metrics and io-datastores
+
+ //Set a maintenance window
+ shell('''gcloud container clusters update metrics \
+ --zone=us-central1-a --maintenance-window=06:00 --quiet''')
Review Comment:
Why do you set a daily maintenance window for 6AM UTC? This command sets a
daily 4 hour maintenance window.
Issue Time Tracking
-------------------
Worklog Id: (was: 766772)
Time Spent: 2h 20m (was: 2h 10m)
> Automatically rotate credentials for Kubernetes cluster
> -------------------------------------------------------
>
> Key: BEAM-14169
> URL: https://issues.apache.org/jira/browse/BEAM-14169
> Project: Beam
> Issue Type: Improvement
> Components: testing
> Reporter: Kiley Sok
> Assignee: Elias Edgardo Segundo Antonio
> Priority: P2
> Time Spent: 2h 20m
> Remaining Estimate: 0h
>
> We had to manually rotate the credentials. Set up cron job to rotate every x
> months.
--
This message was sent by Atlassian Jira
(v8.20.7#820007)
