Repository navigation
buildkite coordinator: give coordinator agents build-scoped artifact tokens - #16141
Merged
Merged
Conversation
copybara-service
Bot
force-pushed
the
test/cl1004266708
branch
3 times, most recently
from
October 22, 2026 02:42
a801d8e to
8f64b0b
Compare
…tokens We want to prevent builds from tampering with each others' uploaded artifacts. The *ideal* solution would be to grant each agent only `roles/storage.objectCreator` on the artifacts bucket, which would allow agents to upload their own artifacts but not tamper with existing artifacts. This would require using a random UUID in the upload path. Unfortunately, `buildkite-agent` uploads the artifact URL to Buildkite, where it becomes publicly visible, _before_ uploading the artifact to GCS. This leaves a window where a malicious job could snipe an artifact URL. So we take a different approach: use downscoped GCS tokens to grant each job the ability to _only_ access that build's prefix in the artifacts bucket. The tokens are generated by the coordinator and sent alongside each job assignment to agents. `buildkite-agent` doesn't support specifying access tokens for GCS uploads directly, so some cludge with a local token server on the agent is required for this to work. PiperOrigin-RevId: 1004440638
copybara-service
Bot
force-pushed
the
test/cl1004266708
branch
from
October 22, 2026 03:35
8f64b0b to
c5ab48f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
buildkite coordinator: give coordinator agents build-scoped artifact tokens
We want to prevent builds from tampering with each others' uploaded artifacts.
The ideal solution would be to grant each agent only
roles/storage.objectCreatoron the artifacts bucket, which would allow agentsto upload their own artifacts but not tamper with existing artifacts.
This would require using a random UUID in the upload path.
Unfortunately,
buildkite-agentuploads the artifact URL to Buildkite, whereit becomes publicly visible, before uploading the artifact to GCS. This
leaves a window where a malicious job could snipe an artifact URL.
So we take a different approach: use downscoped GCS tokens to grant each job
the ability to only access that build's prefix in the artifacts bucket.
The tokens are generated by the coordinator and sent alongside each job
assignment to agents.
buildkite-agentdoesn't support specifying access tokens for GCS uploadsdirectly, so some cludge with a local token server on the agent is required for
this to work.