Feature #13134: [crunch-run] Support for secret_mounts - Arvados

Actions

Copy link

Feature #13134

closed

[crunch-run] Support for secret_mounts

Added by Peter Amstutz about 6 years ago. Updated almost 6 years ago.

Status:

Resolved

Priority:

Normal

Assigned To:

Peter Amstutz

Category:

Target version:

2018-03-14 Sprint

Story points:

Release:

Arvados 1.1.4

Release relationship:

Auto

Description

See Container secret mounts.

New field called "secret_mounts" which can container "json" or "text" type mounts. These are processed the same way as normal mounts.
Add support for "text" type mounts which are literal text which is written to file during setup (similar to "json" type, but unstructured.)
Ensure that contents of "secret_mounts" isn't logged (eg container.json)
Ensure that contents of "secret_mounts" isn't captured in output collection

Note: for completeness, we should also have "secret_environment" and "secret_command" that are merged with the public environment and public command line respectively.

Subtasks 2 (0 open — 2 closed)

Related issues

Actions

Copy link

Updated by Peter Amstutz about 6 years ago

Status changed from New to In Progress

Actions

Copy link

Updated by Peter Amstutz about 6 years ago

Subject changed from [crunch-run] Support for secrets to [crunch-run] Support for secret_mounts
Description updated (diff)

Actions

Copy link

Updated by Peter Amstutz about 6 years ago

Description updated (diff)

Actions

Copy link

Updated by Peter Amstutz about 6 years ago

Description updated (diff)

Actions

Copy link

Updated by Peter Amstutz about 6 years ago

Description updated (diff)

Actions

Copy link

Updated by Tom Clegg about 6 years ago

Related to Idea #13112: Provide a mechanism to store "secrets" securely added

Actions

Copy link

Updated by Tom Clegg about 6 years ago

Description updated (diff)

Actions

Copy link

Updated by Tom Morris about 6 years ago

Target version changed from Arvados Future Sprints to 2018-03-28 Sprint

Actions

Copy link

Updated by Tom Morris about 6 years ago

Assigned To set to Tom Clegg

Actions

Copy link

#10

Updated by Tom Morris about 6 years ago

Target version changed from 2018-03-28 Sprint to 2018-03-14 Sprint

Actions

Copy link

#11

Updated by Tom Clegg about 6 years ago

Status changed from In Progress to New
Target version changed from 2018-03-14 Sprint to 2018-03-28 Sprint

Actions

Copy link

#12

Updated by Tom Morris about 6 years ago

Target version changed from 2018-03-28 Sprint to 2018-03-14 Sprint

Actions

Copy link

#13

Updated by Tom Morris about 6 years ago

Assigned To changed from Tom Clegg to Peter Amstutz

Actions

Copy link

#14

Updated by Lucas Di Pentima about 6 years ago

Reviewing cc14a0ddb50d0d9b3aa03295e4212bd13b073be1

What happens when there are an equal mount and secret mount (is this allowed by the API server?), it seems that line 412 on crunchrun.go will prioritize the non-secret mount and will add it twice when there is mount duplication, but then will remove it because it’s supposedly a secret mount.

Actions

Copy link

#15

Updated by Peter Amstutz about 6 years ago

Lucas Di Pentima wrote:

Reviewing cc14a0ddb50d0d9b3aa03295e4212bd13b073be1

What happens when there are an equal mount and secret mount (is this allowed by the API server?), it seems that line 412 on crunchrun.go will prioritize the non-secret mount and will add it twice when there is mount duplication, but then will remove it because it’s supposedly a secret mount.

The API server is supposed to check for this case and reject it. I suppose crunch-run could also detect that and report and error instead of having some slightly weird undefined behavior.

Actions

Copy link

#16