1375190 - [docker-worker] Support reading workerType secrets from taskcluster-secrets service

Status: RESOLVED FIXED

(Taskcluster :: Workers, enhancement)

Description

[Pete Moore [:pmoore][:pete]]

See parent bug for more context.

Currently it looks like docker-worker reads some (confidential) worker type configuration from the "secrets" portion of its worker type definition. In order to support bug 1375155 in making worker type definitions public information, docker-worker will need to be able to get secrets from the taskcluster-secrets service instead. This assumption is based on finding some secrets in some worker types - if this feature already exists, but not all worker type definitions have been updated to use it, we can close this bug. Rolling out the feature and migrating secrets over will be separate bugs.

This bug is purely about implementing this new feature in docker-worker.

Comment 1

[Chris Cooper [:coop] (he/him)]

Found in triage.

Pete: you were going to do something with this batch of bugs, IIRC.

Comment 2

[Pete Moore [:pmoore][:pete]]

I haven't had bandwidth to work on this, but yes we would certainly like to get
to it.

Comment 3

[Pete Moore [:pmoore][:pete]]

Attachment: GitHub Pull Request for docker-worker

Not ready for review yet, but I've started work on the code changes.

Will flag for review as soon as CI is passing and I'm confident the changes are correct...

Comment 4

[Pete Moore [:pmoore][:pete]]

Comment on attachment 9043587 [details] [review]
GitHub Pull Request for docker-worker

Thanks guys!

Comment 5

[Pete Moore [:pmoore][:pete]]

I've deployed on ami-test and removed the worker type secrets from the worker type definition.

The worker successfully ran task E7ggXxODRvSZuLVQZFzcag, with working live logs, which implies it could successfully retrieve the livelog configuration from the worker type secret in the taskcluster secrets service.

Comment 6

[Pete Moore [:pmoore][:pete]]

Running a mozilla-central linux64 build for a sanity check:

https://tools.taskcluster.net/groups/ZSLswW7pSwiybCRFtZ0v8g/tasks/ZSLswW7pSwiybCRFtZ0v8g/runs/0/logs/public%2Flogs%2Flive.log

This is just a modified task copied from mozilla-central on treeherder, with the treeherder metadata removed, and the worker type changed to ami-test.

Comment 7

[Pete Moore [:pmoore][:pete]]

The linux64 job ran successfully, and :wcosta merged the PR.

Still need to make a docker-worker release.

Roll out to all docker-worker worker types is in bug 1375192.

Comment 8

[Johan Lorenzo [:jlorenzo]]

For the record, with Pete's help, I created/updated all secrets matching: worker-type:aws-provisioner-v1/mobile-*[1]. This was causing workers to not spin up. I also cleaned the secrets section in the worker definition, by leaving an empty dictionary[2].

[1] For instance: https://tools.taskcluster.net/secrets/worker-type%3Aaws-provisioner-v1%2Fmobile-3-b-ref-browser
[2] For instance: https://tools.taskcluster.net/aws-provisioner/mobile-3-b-ref-browser/view