Plugin manager inside Jenkins does not show latest platformlabeler release

[MarkEWaite]

Service(s)

Update center

Summary

Latest release of platformlabeler plugin is not visible in Jenkins plugin manager or in plugin installation manager tool

Reproduction steps

A new platform labeler plugin release 2596.v4304971d3eb_b_ was created about 11 hours ago. When I open https://updates.jenkins.io/latest/platformlabeler.hpi?mirrorlist it shows that the new release is visible on 10 Jenkins mirrors. The new release is visible on plugins.jenkins.io . The update center JSON file includes an entry for the release:

      "name": "platformlabeler",
      "popularity": 235,
      "previousTimestamp": "2023-11-18T16:59:23.00Z",
      "previousVersion": "2325.v8f074df8840d",
      "releaseTimestamp": "2024-06-23T12:11:53.00Z",
      "requiredCore": "2.426.3",
      "scm": "https://github.com/jenkinsci/platformlabeler-plugin",
      "sha1": "5UGoh0ozyjx5Y8HlnrSdE18XSLk=",
      "sha256": "fOcdUYUPg3XYRtsxnr1n7IC8gSFQdMuQEGzTYo6IMf8=",
      "size": 35840,
      "title": "Platform Labeler",
      "url": "https://updates.jenkins.io/download/plugins/platformlabeler/2596.v4304971d3eb_b_/platformlabeler.hpi",
      "version": "2596.v4304971d3eb_b_",
      "wiki": "https://plugins.jenkins.io/platformlabeler"

However, the release is not displayed in the Jenkins plugin manager as a new release. The Jenkins plugin installation manager tool does not detect the new release of the plugin as an available update.

When the plugin installation manager tool requests the list of plugins, it seems to use the URL https://updates.jenkins.io/update-center.actual.json?version=2.452.2 . The contents of that URL does not include the most recent release of the platformlabeler plugin.

I assume some part of the update center processing is failing.

[dduportal]

• Confirmed you are correct: the update_center2 job is failing since a few hours/days (1-2 days?) on trusted.ci
• Found the following root cause in the error logs of the job:

ERROR: AADSTS7000222: The provided client secret keys for app **** are expired. Visit the Azure portal to create new keys for your app: https://aka.ms/NewClientSecret, or consider using certificate credentials for added security: https://aka.ms/certCreds. Trace ID: a03316bb-fbb5-4287-bcb8-71449cb77500 Correlation ID: 1aef7333-ef83-45d0-a221-95369f976465 Timestamp: 2024-06-24 07:37:24Z

=> there is an expired Azure SP. Work in progress to fix it as top priority

[dduportal]

The Azure SP marked as expired is the one used for file storage (it is NOT the one updated in jenkins-infra/azure#712).

The file share is defined by the following module named trusted_ci_jenkins_io_fileshare_serviceprincipal_writer: https://github.com/jenkins-infra/azure/blob/4c8cf5ec70512fa8e7da96ce61254f33f7350707/trusted.ci.jenkins.io.tf#L76-L87

[dduportal]

The Azure SP marked as expired is the one used for file storage (it is NOT the one updated in jenkins-infra/azure#712).

The file share is defined by the following module named trusted_ci_jenkins_io_fileshare_serviceprincipal_writer: https://github.com/jenkins-infra/azure/blob/4c8cf5ec70512fa8e7da96ce61254f33f7350707/trusted.ci.jenkins.io.tf#L76-L87

Aaaand the expiry date is 2024-06-20T19:00:00Z: https://github.com/jenkins-infra/azure/blob/4c8cf5ec70512fa8e7da96ce61254f33f7350707/trusted.ci.jenkins.io.tf#L83 which explains the error

[dduportal]

• Short term fix:
  • Manage the expiry date with the new Terraform Azure YAML setup - @lemeurherve
  • Track expiry date with updatecli (PR body pointing to here for now - short term) - @lemeurherve
  • Update SP from the new automated PR - @dduportal (with screen recording)
• Long term fix:
  • Update the updatecli PR body from screen recording to get proper instruction

[dduportal]

Update:

• Tracking the end date (e.g. automated PRs to avoid forgetting it) with chore: move trusted.ci.jenkins.io.tf service principal writer end dates to updatecli/values.yaml azure#748 and chore(updatecli): track trusted.ci.jenkins.io.tf File Share service principal writer end-dates azure#749
• We now expect an automated PR for the new credential

[dduportal]

Update:

• Rotated the 2 expired credential in Generate new end date 2024-09-22 for updates.jenkins.io File Share service principal writer on trusted.ci.jenkins.io azure#751 and Generate new end date 2024-09-22 for updates.jenkins.io (httpd) File Share service principal writer on trusted.ci.jenkins.io azure#752
• Updated trusted.ci.jenkins.io credentials (top-level) with the new SP password (notes below, but will need to transplant in the PR body as explained above. Recording not needed as the procedure is easier than I though):
  • terraform output -raw trustedci_jenkinsio_fileshare_serviceprincipal_writer_password | pbcopy => https://trusted.ci.jenkins.io:1443/manage/credentials/store/system/domain/_/credential/trustedci_jenkinsio_fileshare_serviceprincipal_writer/
  • terraform output -raw trusted_ci_jenkins_io_uc_content_fileshare_client_secret | pbcopy => https://trusted.ci.jenkins.io:1443/manage/credentials/store/system/domain/_/credential/trusted_ci_jenkins_io_fileshare_serviceprincipal_writer/

[dduportal]

Update: build 911315 of update_center2 succeeded

[dduportal]

• 3 builds in a row succeeding \o/
• The plugin is now available on ci.jenkins.io:

Next step before closing: updating the PR body for the credential expiry in jenkins-infra/azure#753 to give instructions

[MarkEWaite]

Thanks very much! I've confirmed that there are now 3 plugin updates waiting for my controller through the Jenkins plugin manager page:

• Pipeline graph view
• Platform labeler
• Build timeout

Same results for plugin installation manager tool.

Thanks again!

[dduportal]

The crawler job is also successful again