[CI-3043] Switch to actions/create-jira-deployment #4074
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
CI-3043
Description
The CI team is currently working on replacing the
external-proxy
with Google Identity Aware Proxy (IAP). More info here.IAP is a Google service that allows control access to web applications running on GCP. It provides a security layer for applications by ensuring that only authenticated and authorized users/service accounts can access them. To programmatically access a resource protected by the IAP, we need to generate a JWT token and pass it alongside the request to authenticate before accessing the protected resource.
Currently, we use the
jenkins-job-trigger-action
to trigger Jenkins jobs from a GH workflow. Since this is a public action repo and to not expose our internal infrastructure implementation, we created the new private action (trigger-jenkins-job) to implement the IAP necessary steps for authentication and authorization. This new action requires some new inputs (secrets) used in the action’s steps to generate the authentication token.The IAP is already enabled for our Jenkins servers in alternative URLs during the migration, that’s why we use the input
jenkins_url
as a secret. Its main role is to make it easier and transparent when we turn the key to enable IAP in the production’s Jenkins URLs.In this PR, we switch to the
actions/create-jira-deployment
action, which uses the newtrigger-jenkins-job
action that implements the underlying steps to authenticate with IAP when triggering a Jenkins job from a GitHub workflow.Review