1402152 - Use temporary credentials from claimWork, reclaimTask in reclaimTask, createArtifact, reportCompleted

Status: RESOLVED FIXED

(Taskcluster :: Workers, enhancement)

Description

[Jonas Finnemann Jensen (:jonasfj)]

queue.claimWork and queue.reclaimWork returns temporary credentials with sufficient scopes to:
 A) Operate on the task, that is:
    - reclaimTask
    - createArtifact
    - reportCompleted, reportFailed, reportException
 B) Cover task.scopes, such that a client with authorizedScopes = task.scopes
    can be used by the task to run arbitrary requests.
(DO NOT let tasks use the temporary credentials without limiting to task.scopes)

generic-worker is currently not doing this, I suspect it's a bug:
https://github.com/taskcluster/generic-worker/blob/c91adbc9fc65c28b3c9e76da1fb0f7f84a69eebf/taskstatus.go#L117

Should probably just say:
  task.Queue.ReclaimTask

(also the might be some locking of task.Queue required, not sure how that works.

Comment 1

[Pete Moore [:pmoore][:pete]]

Nice spot, thanks Jonas!

Locking shouldn't be required in this case, as generic-worker creates task.Queue on task initialisation in the main go routine, before other go routines are spawned that access it. Therefore there should be no races.

Making a patch now.

Comment 2

[Pete Moore [:pmoore][:pete]]

Attachment: Github Pull Request for generic-worker

Comment 3

[Jonas Finnemann Jensen (:jonasfj)]

Comment on attachment 8911717 [details] [review]
Github Pull Request for generic-worker

Awesome, thanks for fixing this.

Note:
A) Check that you are using these credentials for uploading artifacts
B) Look into removing a lot of credentials from various workers you've deployed

Comment 4

[[github robot]]

Commits pushed to master at https://github.com/taskcluster/generic-worker

https://github.com/taskcluster/generic-worker/commit/18ee7b435e01d4689a820dbe830d38f29881d1af
Bug 1402152 - use creds returned from claimWork to reclaim and resolve tasks

https://github.com/taskcluster/generic-worker/commit/9c8ddef5c11f27441a675a86334634060381c822
Merge pull request #66 from taskcluster/bug1402152

Bug 1402152 - use creds returned from claimWork to reclaim and resolve tasks

Comment 5

[Pete Moore [:pmoore][:pete]]

Released in https://github.com/taskcluster/generic-worker/releases/tag/v10.2.3