1622435 - Support worker re-registration

Status: RESOLVED MOVED

(Taskcluster :: Services, enhancement)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

This will involve workers calling reregisterWorker within the configured reregistrationTimeout.

The tricky bit is figuring out how to authenticate that call. We'll do some talking about that before diving in.

Comment 1

[Dustin J. Mitchell [:dustin] (he/him)]

I set a meeting for Monday to discuss this.

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

..and another on Thursday :)

Comment 3

[Dustin J. Mitchell [:dustin] (he/him)]

My understanding of this is that the rough agreement in https://docs.google.com/document/d/1brc2qbBVkKyIglyLhg2UoSESd3WCqIA3P1NUMpSkbEs/edit still stands:

Bootstrap:

• Authentication process doesn’t change (we have ideas for changes but they are out of scope) and is considered trusted
  • Result is TC credentials plus some secret information for reregistration
  • TC credentials & reregistration token have a TTL

Worker-runner guards this secret information closely: it is not shared with the worker, and is only written to disk in a secure fashion

Reregistration:

• Authentication:
  • API auth: Taskcluster credentials must have proper scopes, etc.
  • Worker record must still exist on worker-manager & not be expired
  • Worker proves it has the secret from the bootstrap process without disclosing it
• Result is new TC credentials and exchange of new secret information, with invalidation of the old secret information

Notes on the agreement:

• The RFC#157 worker key is shared with the worker, violating the “guards .. closely” above, so let’s not use it for this purpose
• The method of worker proving it has the secret is undetermined as yet
• Issues with this:
  • Secret information is stored on disk alongside other worker secrets (for workers that must restart)

Comment 4

[Dustin J. Mitchell [:dustin] (he/him)]

This has been added to the Worker Lifecycle Management project.

Comment 5

[Dustin J. Mitchell [:dustin] (he/him)]

This will require a DB schema change, which means we need to do bug 1630023 first..

Comment 6

[Brian Stack [:bstack]]

Moved to https://github.com/taskcluster/taskcluster/issues/2892