How to refresh the ODCS OIDC token used by OSBS

OSBS needs to trigger composes to ODCS for flatpak build, this is done using an OIDC token to authenticate the requests. This token expires every 365 days so it needs to be regenerated every year.

Generate a new token

In the ansible repo run the following command:

scripts/generate-oidc-token osbs -e 365 -s https://id.fedoraproject.org/scope/groups -s https://pagure.io/odcs/new-compose -s https://pagure.io/odcs/renew-compose -s https://pagure.io/odcs/delete-compose

Follow the instructions given by the script and run the SQL command on the ipsilon database server:

ssh db-fas01.iad2.fedoraproject.org
sudo -u postgres -i ipsilon
ipsilon=# BEGIN;
....
ipsilon=# COMMIT;

Save the value of the token generated by the script in the ansible-private repo under ansible-private/files/osbs/production/odcs-oidc-token (same needs to be done for the staging cluster)

Deploy the change

Run the following playbook to deploy the new token

ansible-playbook /srv/web/infra/ansible/playbooks/groups/osbs/configure-osbs.yml

Want to help? Learn how to contribute to Fedora Docs ›