1375200 - [generic-worker] Remove support for reading secrets from AWS worker type definition

Status: RESOLVED FIXED

(Taskcluster :: Workers, enhancement)

Description

[Pete Moore [:pmoore][:pete]]

Only do this, once the provisioner no longer supports the feature, i.e. when 1375197 is resolved fixed.

Comment 1

[Chris Cooper [:coop] (he/him)]

Work continues in the dependent bugs.

Comment 2

[John Ford [:jhford] CET/CEST Berlin Time]

This work does not directly block the worker manager's deployment (bug 1478941), but does block it from being used in production.  Worker Manager will only support generation of taskcluster credentials and will have no facilities for storing secrets directly.

Comment 3

[John Ford [:jhford] CET/CEST Berlin Time]

(In reply to Pete Moore [:pmoore][:pete] from comment #0)
> Only do this, once the provisioner no longer supports the feature, i.e. when
> 1375197 is resolved fixed.

I think this dependency is reversed.  We cannot remove secrets from the provisioner until they are no longer being read by workers.

Comment 4

[Pete Moore [:pmoore][:pete]]

Attachment: GitHub Pull Request for generic-worker

Still work-in-progress, will assign reviewer(s) as soon as CI is passing and I'm happy all the parts are implemented that are needed.

Adding PR already to provide transparency about the work I'm doing...

Comment 5

[Pete Moore [:pmoore][:pete]]

Attachment: GitHub Pull Request for generic-worker (part 2)

I missed a couple of things in the first PR ....

Comment 6

[Pete Moore [:pmoore][:pete]]

Attachment: GitHub Pull Request for generic-worker (part 3)

Comment 7

[Pete Moore [:pmoore][:pete]]

Attachment: GitHub Pull Request for generic-worker (part 4)

Comment 8

[Pete Moore [:pmoore][:pete]]

Released in generic-worker v13.0.2.