1269443 - Use auth.expandScopes before checking scope satisfaction

Status: RESOLVED FIXED

(Taskcluster :: Workers, defect)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

A task with

 scopes: [
    'assume:repo:hg.mozilla.org/try/*'
 ],
 payload: {
   caches: {
     'level-1-try-tc-vcs-public-sources': '/home/worker-tc-vcs'
   }
 }

fails to start, I think because docker-worker is doing a local check for scope satisfaction that does not expand the role.

Comment 1

[Dustin J. Mitchell [:dustin] (he/him)]

https://github.com/taskcluster/docker-worker/pull/230

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

Attachment: Bug 1269443: remove now-unnecessary scopes;

Review commit: https://reviewboard.mozilla.org/r/81420/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/81420/

Comment 3

[Dustin J. Mitchell [:dustin] (he/him)]

Hm, PR230 appears not to do the necessary:

[taskcluster:error] Docker configuration could not be created.  This may indicate an authentication error when validating scopes necessary for running the task.
 Error: Insufficient scopes to attach cache volumes.  The task must have scope `docker-worker:cache:<cache-name>` for each cache in `payload.caches`.
[taskcluster 2016-09-27 16:01:59.026Z] Unsuccessful task run with exit code: -1 completed in 1.021 seconds 

https://tools.taskcluster.net/task-inspector/#LlsW59VNQBShyXqQtofuuA/0

the try repo role has `docker-worker:cache:level-1-*`.

Comment 4

[Dustin J. Mitchell [:dustin] (he/him)]

Comment on attachment 8795345 [details]
Bug 1269443: remove now-unnecessary scopes;

https://reviewboard.mozilla.org/r/81420/#review80070

Comment 5

[Dustin J. Mitchell [:dustin] (he/him)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=50f2a92f5c08

Comment 6

[Dustin J. Mitchell [:dustin] (he/him)]

OK, it's still broken :)

Comment 7

[Dustin J. Mitchell [:dustin] (he/him)]

Ah!  PR230 appears not to have landed?  Maybe I was just testing it in the ami-test workerType at the time.  I know Greg's in the process of working on new deployments right now.  Can you slide this patch in and we'll see if it improves things?

Comment 8

[Dustin J. Mitchell [:dustin] (he/him)]

Greg, did this patch end up getting deployed?

Comment 9

[Greg Arndt [:garndt]]

There appeared to have been some issues with the original patch when I was deploying, and I have since reworked it and opened up a new PR. https://github.com/taskcluster/docker-worker/pull/259

Comment 10

[Dustin J. Mitchell [:dustin] (he/him)]

From my testing, this is merged.  I'll remove the workaround in-tree.

Comment 11

[Dustin J. Mitchell [:dustin] (he/him)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=f15167a3c469

Comment 12

[Dustin J. Mitchell [:dustin] (he/him)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0ecee460f3858f310ec47a7bdf2e28de357e155f
Bug 1269443: remove now-unnecessary scopes; r=bstack

Comment 13

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/0ecee460f385