REQUEST: Repository maintenance on opentelemetry-collector-contrib

[atoulme]

Affected Repository

https://github.com/open-telemetry/opentelemetry-collector-contrib

Requested changes

Add a new PAT from the opentelemetry-bot with specific permissions to query the Github API for organization members.

Purpose

We are rolling out a tool that needs to get access to organization members list to check for codeowners.

See open-telemetry/opentelemetry-collector-contrib#20868 and open-telemetry/opentelemetry-collector-contrib#24638

Expected Duration

Permanently.

Repository Maintainers

• @open-telemetry/collector-contrib-maintainer

[atoulme]

Can I get any help on this? We are missing CI checks because of this, and it created regressions in our repository, specifically open-telemetry/opentelemetry-collector-contrib#27267

[tigrannajaryan]

@open-telemetry/technical-committee who has access to opentelemetry-bot?

[tigrannajaryan]

Add a new PAT from the opentelemetry-bot with specific permissions

@atoulme what are the permissions you need?

[jpkrohling]

I have, and I'm looking into this right now. I'm struggling to figure out exactly which permissions are needed.

[atoulme]

It needs "read:org, read:user"

[jpkrohling]

I was able to generate the token, but I can't seem to be able to create the secret in that repo 🤦🏽 I guess someone from the TC will have to do both steps. @tigrannajaryan, would you do the honors?

[trask]

I was able to generate the token, but I can't seem to be able to create the secret in that repo 🤦🏽 I guess someone from the TC will have to do both steps.

ya, this is the motivation behind #1652

[tigrannajaryan]

I was able to generate the token, but I can't seem to be able to create the secret in that repo 🤦🏽 I guess someone from the TC will have to do both steps. @tigrannajaryan, would you do the honors?

@jpkrohling can you put the secret in our 1password, give me access to it and tell me what setting do you want in the repo to be updated?

[jpkrohling]

Sorry for taking so long, I lost track of this one. I just created an entry in our 1password, within the OpenTelemetry Collector vault. I also added you to that vault, as I wasn't sure you'd have access to it. Given you are part of the TC, I believe you should.

@atoulme, other than the secret, do you need anything else updated in this repo?

[tigrannajaryan]

@atoulme please tell what exactly you need to be done on the repo, I am not sure I understand.

[atoulme]

I need a secret containing a PAT with the permissions "read:org, read:user" that we can reference as a secret in a github action runners workflow so we can query members of the organization to check codeowners.

[tigrannajaryan]

@atoulme I added OTEL_BOT_PASSWORD and OTEL_BOT_USERNAME to https://github.com/open-telemetry/opentelemetry-collector-contrib/settings/secrets/actions

[atoulme]

Thanks working with that.

[bogdandrutu]

Closing since @atoulme confirm it works.

[atoulme]

Sorry, it didn't work. I just never had time to get back into this.

[trask]

Sorry, it didn't work. I just never had time to get back into this.

reopening

@atoulme can you provide any more details / logs / errors that might help?

[atoulme]

The gh client doesn't work with username and password of the user. It would be best to remove those secrets from the repository, in case someone finds a way to abuse our checks and use those to login as opentelemetry-bot.

Here is what I would need. Logged in as the opentelemetry-bot user, you can generate a token using the following steps:

• Go to https://github.com/settings/apps (Developer Settings)
• Click on Personal Access Tokens and select Tokens (classic). It should get you to https://github.com/settings/tokens
• Click on "Generate new token" up to the right, and select "Generate new token (classic)"
• In the dialog, select the permission "read:org":
  ** Give a name to the token of your choosing
  ** Set up a rotation time for the token
• Click "Generate token"
• Copy the token value (should start with ghp_) into a github secret on the repository opentelemetry-collector-contrib.

[atoulme]

hello folks, any upate on this issue?

[arminru]

Hi @atoulme! Are you saying that the new PAT should replace the existing secrets OTEL_BOT_USERNAME and OTEL_BOT_PASSWORD in https://github.com/open-telemetry/opentelemetry-collector-contrib/settings/secrets/actions, or should it be added in addition to it?

[arminru]

@tigrannajaryan I see a PAT called opentelemetry-collector-contrib-1659 in the @opentelemetrybot account but it was never used. Is that the PAT you added for OTEL_BOT_PASSWORD already?

[tigrannajaryan]

@tigrannajaryan I see a PAT called opentelemetry-collector-contrib-1659 in the @opentelemetrybot account but it was never used. Is that the PAT you added for OTEL_BOT_PASSWORD already?

@arminru I think yes, that's it, but I can't remember for certain.

[arminru]

@atoulme I re-generated the aforementioned token and stored it under READ_ORG_AND_USER_TOKEN in collector-contrib. I also removed the unused OTEL_BOT_USERNAME and OTEL_BOT_PASSWORD secrets from the repo. Since the former PAT was used as the "password", it would be invalidated now anyway and I think for PAT authentication you don't even need to know the username.

[atoulme]

OK, I will try this out. I appreciate the help!

[atoulme]

It worked! We're good now. Thanks for all your help, closing.