Propagate name of system service account to the bot.

appengine/swarming/swarming_bot/bot_code/bot_auth.py

 # Copyright 2016 The LUCI Authors. All rights reserved.
 # Use of this source code is governed under the Apache License, Version 2.0
 # that can be found in the LICENSE file.
 
 import collections
 import logging
 import threading
 import time
 
 from utils import auth_server
 
 import file_reader
 
 
 class AuthSystemError(Exception):
   """Fatal errors raised by AuthSystem class."""
 
 
 # Parsed value of JSON at path specified by --auth-params-file task_runner arg.
 AuthParams = collections.namedtuple('AuthParams', [
   # Dict with HTTP headers to use when calling Swarming backend (specifically).
   # They identify the bot to the Swarming backend. Ultimately generated by
   # 'get_authentication_headers' in bot_config.py.
   'swarming_http_headers',
 
   # Unix timestamp of when swarming_http_headers expire, or 0 if unknown.
   'swarming_http_headers_exp',
 
-  # Indicates the service account the task runs as. One of:
-  #   - 'none' if the task shouldn't use any authentication at all.
-  #   - 'bot' if the task should use bot's own service account.
-  #   - <email> if the task is using service acccount via delegation token.
+  # Indicates the service account to use for internal bot processes. One of:
+  #   - 'none' to not use authentication at all.
+  #   - 'bot' to use whatever bot is using to authenticate itself to Swarming.
+  #   - <email> to get tokens through API calls to Swarming.
+  'system_service_account',
+
+  # Indicates the service account the task runs as. Same range of values as for
+  # 'system_service_account'.
+  #
+  # It is distinct from 'system_service_account' to allow user-supplied payloads
+  # to use a service account also supplied by the user (and not the one used
+  # internally by the bot).
   'task_service_account',
 ])
 
 
 def prepare_auth_params_json(bot, manifest):
   """Returns a dict to put into JSON file passed to task_runner.
 
   This JSON file contains various tokens and configuration parameters that allow
   task_runner to make HTTP calls authenticated by bot's own credentials.
 
   The file is managed by bot_main.py (main Swarming bot process) and consumed by
   task_runner.py.
 
   It lives it the task work directory.
 
   Args:
     bot: instance of bot.Bot.
     manifest: dict with the task manifest, as generated by the backend in /poll.
   """
+  def account(acc_id):
+    acc = (manifest.get('service_accounts') or {}).get(acc_id) or {}
+    return acc.get('service_account') or 'none'
   return {
     'swarming_http_headers': bot.remote.get_authentication_headers(),
     'swarming_http_headers_exp': bot.remote.authentication_headers_expiration,
-    'task_service_account': manifest.get('service_account') or 'none',
+    'system_service_account': account('system'),
+    'task_service_account': account('task'),
   }
 
 
 def process_auth_params_json(val):
   """Takes a dict loaded from auth params JSON file and validates it.
 
   Args:
     val: decoded JSON value read from auth params JSON file.
 
   Returns:
@@ skipping 13 matching lines @@
   exp = val.get('swarming_http_headers_exp') or 0
   if not isinstance(exp, (int, long)):
     raise ValueError(
         'Expecting "swarming_http_headers_exp" to be int, got %r' % (exp,))
 
   # The headers must be ASCII for sure, so don't bother with picking the
   # correct unicode encoding, default would work. If not, it'll raise
   # UnicodeEncodeError, which is subclass of ValueError.
   headers = {str(k): str(v) for k, v in headers.iteritems()}
 
-  acc = val.get('task_service_account') or 'none'
-  if not isinstance(acc, basestring):
-    raise ValueError(
-        'Expecting "task_service_account" to be a string, got %r' % (acc,))
+  def read_account(key):
+    acc = val.get(key) or 'none'
+    if not isinstance(acc, basestring):
+      raise ValueError('Expecting "%s" to be a string, got %r' % (key, acc))
+    return str(acc)
 
-  return AuthParams(headers, exp, str(acc))
+  return AuthParams(
+      swarming_http_headers=headers,
+      swarming_http_headers_exp=exp,
+      system_service_account=read_account('system_service_account'),
+      task_service_account=read_account('task_service_account'))
 
 
 class AuthSystem(object):
   """Authentication subsystem used by task_runner.
 
   Contains two threads:
     * One thread periodically rereads the file with bots own authentication
       information (auth_params_file). This file is generated by bot_main.
     * Another thread hosts local HTTP server that servers authentication tokens
       to local processes. This is enabled only if the task is running in a
@@ skipping 42 matching lines @@
     except file_reader.FatalReadError as e:
       raise AuthSystemError('Cannot start FileReaderThread: %s' % e)
 
     # Initial validation.
     try:
       params = process_auth_params_json(reader.last_value)
     except ValueError as e:
       reader.stop()
       raise AuthSystemError('Cannot parse bot_auth_params.json: %s' % e)
 
-    # If using task auth, launch local HTTP server that serves tokens (let OS
-    # assign the port).
+    logging.info('Using following service accounts:')
+    logging.info('  system: %s', params.system_service_account)
+    logging.info('  task:   %s', params.task_service_account)
+
+    # If using service accounts, launch local HTTP server that serves tokens
+    # (let OS assign the port).
+    #
+    # TODO(vadimsh): Launch local auth server if using 'system' account (or both
+    # 'system' and 'task') too. This can be done only once all processes that
+    # inherit LUCI_CONTEXT know about 'system' and 'task' accounts distinction.
     server = None
     local_auth_context = None
     if params.task_service_account != 'none':
       try:
         server = auth_server.LocalAuthServer()
         local_auth_context = server.start(token_provider=self)
       except Exception as exc:
         reader.stop() # cleanup
         raise AuthSystemError('Failed to start local auth server - %s' % exc)
 
@@ skipping 101 matching lines @@
     # Default to some safe small expiration in case bot_main doesn't report it
     # to us. This may happen if get_authentication_header bot hook is not
     # reporting expiration time.
     exp = auth_params.swarming_http_headers_exp or (time.time() + 4*60)
     logging.info('Bot token expires in %d sec', exp - time.time())
 
     # TODO(vadimsh): For GCE bots specifically we can pass a list of OAuth
     # scopes granted to the GCE token and verify it contains all the requested
     # scopes.
     return auth_server.AccessToken(tok, exp)