Handling of the New Auto Token Rotation Feature #1196
Description
Describe the solution you'd like
The new runner authentication method includes an auto-rotation feature (disabled by default). For this feature to function, the expiration interval must be configured within GitLab. Once the interval is set and the time is reached, the Gitlab runner automatically initiate a process to reset the token, with the new token stored in the configuration file. The SSM 'token counter' method will be removed in the upcoming version 8.0.0 of this module (As noted
here ). I am proposing that that implementation is not removed and instead is re-used to handle the new auto-rotation feature. Otherwise this module will not be compatible with Gitlab instances that have the auto-rotation feature enabled.
Describe alternatives you've considered
None
Suggest a solution
There are two possible solutions:
First Solution (easiest):
Mark the handling of token rotation as out of scope and add a disclaimer in the documentation.
Second Solution:
Do not remove the "usage counter" SSM parameter and use that along with the reset-token command. The process would be as follows:
- SED config.toml for
token_expires_atif it exists move to step 2 otherwise skip. - Check the usage counter, if it is 0 then continue to step 2
- Run the
reset-tokencommand - https://docs.gitlab.com/runner/commands/#gitlab-runner-reset-token - SED config.toml for Token value
- Update token value in SSM Parameter
Additional context
The token rotation handling event should most likely occur during the termination of the runners. In my use case I rotate out the runners every week which results in the latest AMI version being used but that would not be suitable for everyone. Handling a race condition properly is hard.