Bugzilla

i documented today's rotation at: https://gist.github.com/grenade/7d5c9f567951fbc3c3caf023bd356fa6 and have pasted the same below.

# windows cot key rotation

1. trigger occ ami builds
   ```bash
   git clone https://github.com/mozilla-releng/OpenCloudConfig ./occ
   cd ./occ
   git commit -m "cot key rotation $(date --iso-8601)" -m "deploy: gecko-3-b-win2012" --allow-empty
   ```
2. deploy key to image build instance
   1. obtain instance credentials from ec2 userdata
      - option 1: using the [console](https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#Instances:keyName=mozilla-taskcluster-worker-gecko-3-b-win2012):
        - navigate to the "edit userdata" page of the running instance (see [figure 01](https://gist.github.com/grenade/7d5c9f567951fbc3c3caf023bd356fa6#file-figure-01-png) below)
        - look for a line containing the administrator password. eg:
          ```xml
          <rootPassword>xxx999!!!</rootPassword>
          ```
      - option 2: using the aws cli:
        ```bash
        # assuming a `[moz-occ]` profile exists in ~/.aws/credentials
        instance_id=$(aws ec2 describe-instances \
          --profile moz-occ \
          --region us-west-2 \
          --filters Name=key-name,Values=mozilla-taskcluster-worker-gecko-3-b-win2012 Name=instance-state-name,Values=running \
          --query Reservations[].Instances[].InstanceId \
          --output text)
        instance_password=$(aws ec2 describe-instance-attribute \
          --profile moz-occ \
          --region us-west-2 \
          --instance-id ${instance_id} \
          --attribute userData \
          --query UserData.Value \
          --output text | base64 --decode | grep rootPassword | sed -e 's/\s*<[^>]*>//g')
        ```
   2. connect to the instance over remote desktop (rdp). note that the base windows 2012 image does not support tls 1.2 connections before the instance is bootstrapped completely. this means your rdp client will fail to connect unless it supports tls 1.0
      ```bash
      instance_ip=$(aws ec2 describe-instances \
        --profile moz-occ \
        --region us-west-2 \
        --filters Name=key-name,Values=mozilla-taskcluster-worker-gecko-3-b-win2012 Name=instance-state-name,Values=running \
        --query Reservations[].Instances[].PublicIpAddress \
        --output text)
      xfreerdp \
        /u:Administrator \
        /p:"${instance_password}" \
        /cert-ignore \
        /kbd:809 \
        /w:2400 \
        /h:1200 \
        +clipboard \
        /v:${instance_ip}
      ```
   3. open a text editor (sublime text is installed and uses sane file encodings by default) and paste the ed25519 cot private key into a new file. no newline is required after the key. save the file to `C:\generic-worker\ed25519-private.key`
   4. log out from the rdp session or shut down the instance (do not just close the connection. this will leave the occ session hanging and the image build incomplete).
   5. confirm that the occ image build task completes successfully. after the instance shuts down, occ will build an ami from it and distribute that ami to several regions. this can take half an hour. you can get to the image build task by clicking on the ci build associated with your commit and push from step 1 on the [occ commits page](https://github.com/mozilla-releng/OpenCloudConfig/commits/master). the task of interest is named **Update gecko-3-b-win2012 AMIs** and should complete green
   6. to troubleshoot an incomplete image build instance, examine the instance logs at: https://my.papertrailapp.com/events?q=system%3A${instance_id}
   7. to see ami availability look in the ec2 console:
      - [eu-central-1](https://eu-central-1.console.aws.amazon.com/ec2/v2/home?region=eu-central-1#Images:visibility=owned-by-me;name=gecko-3-b-win2012*;sort=desc:creationDate)
      - [us-east-1](https://us-east-1.console.aws.amazon.com/ec2/v2/home?region=us-east-1#Images:visibility=owned-by-me;name=gecko-3-b-win2012*;sort=desc:creationDate)
      - [us-east-2](https://us-east-2.console.aws.amazon.com/ec2/v2/home?region=us-east-2#Images:visibility=owned-by-me;name=gecko-3-b-win2012*;sort=desc:creationDate)
      - [us-west-1](https://us-west-1.console.aws.amazon.com/ec2/v2/home?region=us-west-1#Images:visibility=owned-by-me;name=gecko-3-b-win2012*;sort=desc:creationDate)
      - [us-west-2](https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#Images:visibility=owned-by-me;name=gecko-3-b-win2012*;sort=desc:creationDate)
3. update ci configuration with the new ami ids obtained from the artifacts page of the task described in 2.v above. the artifact of interest is named **ami-latest.json** / **ami-latest.yml**.