1218784 - Reduce scopes assigned to worker types

Status: RESOLVED DUPLICATE of bug 1220738

(Taskcluster :: Services, defect)

Description

[Pete Moore [:pmoore][:pete]]

For good measure, we should probably also audit the scopes assigned to the various worker types. Of course they are already capped at the scopes that the client possesses, but all the same would be nice to keep them at a minimum.

Comment 1

[Greg Arndt [:garndt]]

Also, part of the discussion is the work that Jonas might do related to assigning temporary credentials when claiming a task so that the worker would only need a very limited set of scopes for polling the queue task URLs and a couple of other small things.

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

Bug 1217088 and the lead-up partially addresses this -- worker types are defined by roles, specifically

  https://tools.taskcluster.net/auth/roles/#worker-type:aws-provisioner-v1%252f*

Then bug 1134342 addressed the part where the task scopes must be satisfied by the workerType's scopes.

So, the `worker-type:aws-provisioner-v1/*` role can now be dialed back to include only the scopes required by the worker itself.  I think that is just queue operations (polling, claiming, reclaiming), and that everything else including putting artifacts and extending task-graphs is now handled with the temp creds for the task.

Greg, does this match your expectation?

Comment 3

[Greg Arndt [:garndt]]

That's my impression as well.  We should be able to do that once 1220738 is complete.  Also, our existing tasks need to be audited to make sure they have the appropriate scopes for creating/retreiving artifacts.  I think most tasks neglect to have those scopes and rely on the bug that the worker uses it's own creds that has scopes.

Comment 4

[Dustin J. Mitchell [:dustin] (he/him)]

Oh, I forgot about that bug.  I'll just dupe this one over