action #6096: Restrict workers to have full API access by random, individual tokens (was: change worker authentication) - openQA Project - openSUSE Project Management Tool

Actions

Copy link

action #6096

closed

Restrict workers to have full API access by random, individual tokens (was: change worker authentication)

Added by lnussel about 9 years ago. Updated about 4 years ago.

Status:

Rejected

Priority:

Low

Assignee:

okurz

Category:

Feature requests

Target version:

QA - future

Start date:

2015-01-28

Due date:

% Done:

Estimated time:

Description

workers currently use user tokens and therefore have access to the full API. Workers should have differnt privileges that only allows them to grab jobs, set jobs to finish etc. That makes sure test code run by a worker cannot accidentally nor intentionally mess with the API.

Related issues 2 (0 open — 2 closed)

Actions

Copy link

Updated by coolo about 9 years ago

And as dicussed in the hall earlier: every worker should have its own random token - and we should IMO offer an option to allow every worker to generate that token himself, i.e. plug&play.

Actions

Copy link

Updated by lnussel about 9 years ago

coolo wrote:

And as dicussed in the hall earlier: every worker should have its own random token - and we should IMO offer an option to allow every worker to generate that token himself, i.e. plug&play.

Yes. As long as we rely on nfs anyways I think the idea with dropping a token to the shared space would be ok for now too.

Actions

Copy link

Updated by lnussel about 9 years ago

Related to action #6602: move worker credentials to workers.ini added

Actions

Copy link

Updated by okurz over 8 years ago

Category set to 132

Actions

Copy link

Updated by okurz over 7 years ago

Target version set to future

Actions

Copy link

Updated by okurz almost 6 years ago

Target version changed from future to future

Actions

Copy link

Updated by okurz almost 5 years ago

Category changed from 132 to Feature requests

Actions

Copy link

Updated by okurz over 4 years ago

Status changed from New to Rejected
Assignee set to okurz

I think by now the design has changed enough to make this whole thing obsolete, e.g. we do not rely on NFS anymore.

Actions

Copy link

Updated by coolo over 4 years ago

Status changed from Rejected to New
Assignee deleted (~~okurz~~)

this has nothing to do with nfs

Actions

Copy link

#10

Updated by okurz over 4 years ago

Subject changed from change worker authentication to Restrict workers to have full API access by random, individual tokens (was: change worker authentication)

Changed the subject to reflect what I think you might want

Actions

Copy link

#11