Using agent token in cloud-init user-data

[runephilosof-karnovgroup]

Some providers apply cloud-init to vps using http calls to a server in the network, some do it by providing a file etc to the vps.
The issue with the http api approach is that this endpoint can be called by all users of the vps and therefore could be called by a pipeline step to extract the agent-token.

Providers

• Hetzner (not affected)
• Linode (https://www.linode.com/docs/products/compute/compute-instances/guides/metadata/#access-the-metadata-service-api)
• Vultr
• Scaleway (https://www.scaleway.com/en/developers/api/instance/)
• Aws
• Google cloud
• Azure
• DigitalOcean
• Oracle
• Equinix Metal

Metadata/userdata/cloud-init is accessible to everything running on the agent, not only root.
So you should not save the woodpecker token in that.
Or alternatively, the server should invalidate the tokens after first use.

Originally posted by @runephilosof-karnovgroup in #15 (comment)

[anbraten]

@runephilosof-karnovgroup Do you have an idea how we could get the token securely onto that machine?

Worst case we could ssh to that machine and save a file somehow. 🤔

Or alternatively, the server should should invalidate the tokens after first use.

That would be tough to achieve as it would break most other agent setups.

[runephilosof-karnovgroup]

What is a valid use case of reusing agent specific registration tokens?
I am not suggesting invalidating the global agent registration token.

My own autoscaler uses the global agent registration token, because of this problem. It then matches up the agents with their agent IDs using their hostnames.

[anbraten]

What is a valid use case of reusing agent specific registration tokens?

It's currently just "the specific" agent token which is also used to identify the agent again when re-connecting / after restarts. Woodpecker currently has nothing like a registration token AFAIK.

My own autoscaler uses the global agent registration token, because of this problem. It then matches up the agents with their agent IDs using their hostnames.

How do you inject the global token then if not via cloud-init? As part of the image?

[runephilosof-karnovgroup]

What is a valid use case of reusing agent specific registration tokens?

It's currently just "the specific" agent token which is also used to identify the agent again when re-connecting / after restarts. Woodpecker currently has nothing like a registration token AFAIK.

I am suggesting it should have (in the other issue, let's keep that discussion there, it becomes confusing otherwise).

How do you inject the global token then if not via cloud-init? As part of the image?

Yes. I build it into the image.