Crawler fails due to lack of authentication

[NotMyFault]

Service(s)

trusted.ci.jenkins.io

Summary

Starting March the 1st, the crawler builds fail with

01:39:53  INFO: Failed to scan directory/file . Logging errors in scanning logs.
01:39:53  
01:39:53  Cannot perform sync due to error: GET https://updatesjenkinsio.file.core.windows.net/updates-jenkins-io/updates
01:39:53  --------------------------------------------------------------------------------
01:39:53  RESPONSE 403: 403 Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.
01:39:53  ERROR CODE: AuthenticationFailed
01:39:53  --------------------------------------------------------------------------------
01:39:53  <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthenticationFailed</Code><Message>Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.
01:39:53  RequestId:99b5a69b-901a-000a-1370-6be3e6000000
01:39:53  Time:2024-03-01T00:39:53.5940990Z</Message><AuthenticationErrorDetail>Signature not valid in the specified time frame: Start [Mon, 01 Jan 2024 00:00:00 GMT] - Expiry [Fri, 01 Mar 2024 00:00:00 GMT] - Current [Fri, 01 Mar 2024 00:39:53 GMT]</AuthenticationErrorDetail></Error>
01:39:53  --------------------------------------------------------------------------------

Reproduction steps

No response

[lemeurherve]

Thanks for the issue!

The SAS token is expired, I need to renew it, then in a second time to replace it with a short lived SAS token generated from a service principal.

Ref for later:

• Check if we could replace blobxfer by azcopy #3414 (comment)

[lemeurherve]

New SAS token expiring on the 2 of April generated, credentials updates-jenkins-io-file-share-sas-token-query-string updated on trusted.ci.jenkins.io, crawler job is now failing on the R2 bucket sync (another expired credentials 😓).

[lemeurherve]

I've made modifications in terraform-states (private repo) to update cloudflare tokens but can't apply them at the moment as I encounter a GPG error (and as it's quite late for me already).
Will continue later, the azure file storage has been updated.

[lemeurherve]

• CloudFlare tokens expiration date updated in terraform-states (private repo)
• infra.ci.jenkins.io credentials updated in chart-secrets (private repo)
• Crawler job restored in Revert "chore: comment out CloudFlare sync for now" crawler#142

Ran a crawler job on trusted.ci.jenkins.io: ✅

[lemeurherve]

New SAS token expiring on the 2 of April generated, credentials updates-jenkins-io-file-share-sas-token-query-string updated on trusted.ci.jenkins.io

This token will be replaced by a short-lived one.

Ref:

• Check if we could replace blobxfer by azcopy #3414 (comment)