{"action":"created","issue":{"url":"https://api.github.com/repos/alphagov/paas-cf/issues/441","repository_url":"https://api.github.com/repos/alphagov/paas-cf","labels_url":"https://api.github.com/repos/alphagov/paas-cf/issues/441/labels{/name}","comments_url":"https://api.github.com/repos/alphagov/paas-cf/issues/441/comments","events_url":"https://api.github.com/repos/alphagov/paas-cf/issues/441/events","html_url":"https://github.com/alphagov/paas-cf/pull/441","id":172904272,"number":441,"title":"[#128160309] Bosh only ssh key","user":{"login":"mtekel","id":483891,"avatar_url":"https://avatars.githubusercontent.com/u/483891?v=3","gravatar_id":"","url":"https://api.github.com/users/mtekel","html_url":"https://github.com/mtekel","followers_url":"https://api.github.com/users/mtekel/followers","following_url":"https://api.github.com/users/mtekel/following{/other_user}","gists_url":"https://api.github.com/users/mtekel/gists{/gist_id}","starred_url":"https://api.github.com/users/mtekel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mtekel/subscriptions","organizations_url":"https://api.github.com/users/mtekel/orgs","repos_url":"https://api.github.com/users/mtekel/repos","events_url":"https://api.github.com/users/mtekel/events{/privacy}","received_events_url":"https://api.github.com/users/mtekel/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"keymon","id":280032,"avatar_url":"https://avatars.githubusercontent.com/u/280032?v=3","gravatar_id":"","url":"https://api.github.com/users/keymon","html_url":"https://github.com/keymon","followers_url":"https://api.github.com/users/keymon/followers","following_url":"https://api.github.com/users/keymon/following{/other_user}","gists_url":"https://api.github.com/users/keymon/gists{/gist_id}","starred_url":"https://api.github.com/users/keymon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/keymon/subscriptions","organizations_url":"https://api.github.com/users/keymon/orgs","repos_url":"https://api.github.com/users/keymon/repos","events_url":"https://api.github.com/users/keymon/events{/privacy}","received_events_url":"https://api.github.com/users/keymon/received_events","type":"User","site_admin":false},"assignees":[{"login":"keymon","id":280032,"avatar_url":"https://avatars.githubusercontent.com/u/280032?v=3","gravatar_id":"","url":"https://api.github.com/users/keymon","html_url":"https://github.com/keymon","followers_url":"https://api.github.com/users/keymon/followers","following_url":"https://api.github.com/users/keymon/following{/other_user}","gists_url":"https://api.github.com/users/keymon/gists{/gist_id}","starred_url":"https://api.github.com/users/keymon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/keymon/subscriptions","organizations_url":"https://api.github.com/users/keymon/orgs","repos_url":"https://api.github.com/users/keymon/repos","events_url":"https://api.github.com/users/keymon/events{/privacy}","received_events_url":"https://api.github.com/users/keymon/received_events","type":"User","site_admin":false}],"milestone":null,"comments":6,"created_at":"2016-08-24T09:22:02Z","updated_at":"2016-08-25T14:12:48Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/alphagov/paas-cf/pulls/441","html_url":"https://github.com/alphagov/paas-cf/pull/441","diff_url":"https://github.com/alphagov/paas-cf/pull/441.diff","patch_url":"https://github.com/alphagov/paas-cf/pull/441.patch"},"body":"## What\r\n\r\n[Rotate credentials](https://www.pivotaltracker.com/n/projects/1275640/stories/128160309)\r\n\r\n## How to review\r\n\r\nRun `create-bosh-cloudfoundry` pipeline. Observe new key being generated, uploaded to AWS by terraform and applied on BOSH server (which due to how bosh-init works will cause re-deployment). After deploying, you can check in AWS what key is BOSH using & compare that to key used by bosh deployed VMs.\r\n\r\n## Implementation\r\n\r\nCompared to https://github.com/alphagov/paas-cf/pull/437 , I have used (a different) mechanism of setting and getting the keys which is used in `create-bosh-cloudfoundry` pipeline, with a slight modification:\r\n* use s3init to initialize empty files (so that we can `get` something instead of being blocked)\r\n* use s3iam resource to `get` and `put` keys\r\n* (new) only `put` keys when new ones are generated. This will cause upload jobs of generated keys to fail when there's nothing to upload, but it will not break the pipeline execution, as this is in `ensure` block. The advantages are:\r\n  1. faster execution (as key only gets generated & uploaded when it is not present in state bucket)\r\n  2. less concourse resources used (no need to create containers for put steps every time) \r\n  3. better caching - as there is not a \"new\" version of the resource after every put\r\n  4. less storage used in the bucket (we don't re-upload the same file again) - less $ spent\r\n  5. better auditability - bucked only contains file versions which have been used. We can track when new key was generated by upload times.\r\n\r\n## Who can review\r\n\r\nnot @mtekel\r\n"},"comment":{"url":"https://api.github.com/repos/alphagov/paas-cf/issues/comments/242401187","html_url":"https://github.com/alphagov/paas-cf/pull/441#issuecomment-242401187","issue_url":"https://api.github.com/repos/alphagov/paas-cf/issues/441","id":242401187,"user":{"login":"keymon","id":280032,"avatar_url":"https://avatars.githubusercontent.com/u/280032?v=3","gravatar_id":"","url":"https://api.github.com/users/keymon","html_url":"https://github.com/keymon","followers_url":"https://api.github.com/users/keymon/followers","following_url":"https://api.github.com/users/keymon/following{/other_user}","gists_url":"https://api.github.com/users/keymon/gists{/gist_id}","starred_url":"https://api.github.com/users/keymon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/keymon/subscriptions","organizations_url":"https://api.github.com/users/keymon/orgs","repos_url":"https://api.github.com/users/keymon/repos","events_url":"https://api.github.com/users/keymon/events{/privacy}","received_events_url":"https://api.github.com/users/keymon/received_events","type":"User","site_admin":false},"created_at":"2016-08-25T14:12:48Z","updated_at":"2016-08-25T14:12:48Z","body":"I am OK with this PR, but I think we should implement this feature as a dedicated resource."}}
{"actor":{"display_login":"keymon"}}