search

woodpecker-ci / autoscaler

Scale your woodpecker agents automatically to the moon and back based on the current load.
Apache License 2.0
30 stars 5 forks source link

Using agent token in cloud-init user-data #91

Open runephilosof-karnovgroup opened 7 months ago

runephilosof-karnovgroup commented 7 months ago

Some providers apply cloud-init to vps using http calls to a server in the network, some do it by providing a file etc to the vps. The issue with the http api approach is that this endpoint can be called by all users of the vps and therefore could be called by a pipeline step to extract the agent-token.

Providers

Metadata/userdata/cloud-init is accessible to everything running on the agent, not only `root`. So you should not save the woodpecker token in that. Or alternatively, the server should invalidate the tokens after first use.

Originally posted by @runephilosof-karnovgroup in https://github.com/woodpecker-ci/autoscaler/issues/15#issuecomment-1853696818

anbraten commented 7 months ago

@runephilosof-karnovgroup Do you have an idea how we could get the token securely onto that machine?

Worst case we could ssh to that machine and save a file somehow. 🤔

Or alternatively, the server should should invalidate the tokens after first use.

That would be tough to achieve as it would break most other agent setups.

runephilosof-karnovgroup commented 7 months ago

What is a valid use case of reusing agent specific registration tokens? I am not suggesting invalidating the global agent registration token.

My own autoscaler uses the global agent registration token, because of this problem. It then matches up the agents with their agent IDs using their hostnames.

anbraten commented 7 months ago

What is a valid use case of reusing agent specific registration tokens?

It's currently just "the specific" agent token which is also used to identify the agent again when re-connecting / after restarts. Woodpecker currently has nothing like a registration token AFAIK.

My own autoscaler uses the global agent registration token, because of this problem. It then matches up the agents with their agent IDs using their hostnames.

How do you inject the global token then if not via cloud-init? As part of the image?

runephilosof-karnovgroup commented 7 months ago

What is a valid use case of reusing agent specific registration tokens?

It's currently just "the specific" agent token which is also used to identify the agent again when re-connecting / after restarts. Woodpecker currently has nothing like a registration token AFAIK.

I am suggesting it should have (in the other issue, let's keep that discussion there, it becomes confusing otherwise).

How do you inject the global token then if not via cloud-init? As part of the image?

Yes. I build it into the image.