New issue
Advanced search Search tips

Issue 728723 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Jun 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug

Blocking:
issue skia:6611



Sign in to add a comment

Swarming bot can't fetch CIPD client when running a task with a service account

Project Member Reported by vadimsh@chromium.org, Jun 1 2017

Issue description

Example: https://chrome-swarming.appspot.com/task?id=367c4d515b71dc10&refresh=10&show_raw=1

It seems it sends "Authorization" header when accessing Google Storage signed URL (to download the client), and GS freaks out. It should not be sending the header.
 

Comment 1 by rmis...@google.com, Jun 2 2017

Labels: -Pri-3 Pri-2
Making this higher priority because this is blocking https://bugs.chromium.org/p/skia/issues/detail?id=6611

It will not block the transition of CT GCE bots but will block the transition of Skia GCE bots because they require the CIPD client.

Could somebody please take a look? Thanks!

Comment 2 by rmis...@google.com, Jun 2 2017

Blocking: skia:6611

Comment 3 by no...@chromium.org, Jun 2 2017

swarming bot downloads CIPD client using cipd.py's _fetch_cipd_client https://cs.chromium.org/chromium/infra/luci/client/cipd.py?q=cipd.py+package:%5Echromium$&l=346
it uses net.py

net.py specifically turns off authentication for GS URLs
https://cs.chromium.org/chromium/src/tools/swarming_client/utils/net.py?q=net.py&dr&l=241
however, the underlying Engine may not have this logic. I could not find usages of set_engine_class. I assume it should be called to set an engine that supports service accounts.

Comment 4 by no...@chromium.org, Jun 2 2017

Owner: no...@chromium.org
Status: Started (was: Untriaged)
Looks like GS URL Regex is wrong https://codereview.chromium.org/2921943002

Comment 7 by rmis...@google.com, Jun 5 2017

Status: Fixed (was: Started)
I retried the task and it was successful: https://chrome-swarming.appspot.com/task?id=369141bcbd1cdb10&refresh=10&show_raw=1

Thanks!
The retried task has "service account: none", so it's not using authentication and can't act as confirmation for the fix. 

I see that retrying tasks drops "service account" setting :( 

Comment 9 by rmis...@google.com, Jun 5 2017

Status: Started (was: Fixed)
Oh, I did not notice that. Thanks for the catch. Reopening till we can confirm.

Sign in to add a comment