1375156 - [generic-worker] Support reading workerType secrets from taskcluster-secrets service

Status: RESOLVED FIXED

(Taskcluster :: Workers, enhancement)

Description

[Pete Moore [:pmoore][:pete]]

Currently generic worker reads its (confidential) worker type configuration from the "secrets" portion of its worker type definition. In order to support bug 1375155 in making worker type definitions public information, generic-worker will need to be able to get secrets from the taskcluster-secrets service instead.

This bug is about adding support for this in generic-worker.

Comment 1

[Pete Moore [:pmoore][:pete]]

Note, initially it should continue to support the old mechanics of using worker type secrets, to ease roll out. The later we'll disable it in the worker, once all worker types have been migrated to use it.

Comment 3

[Pete Moore [:pmoore][:pete]]

Note, the implementation for this bug is a simple relocation of secret config/files from worker type definitions into a taskcluster secret named worker-type:aws-provisioner-v1/<workerType>.

Bug 1437464 offers a more comprehensive solution, but that will be more work to implement, so a simple relocation of secret content is all that will be done for the first pass, which is the purpose of this bug.

Comment 4

[Pete Moore [:pmoore][:pete]]

This was implemented in bug 1375200.