Change: worker registarion, how tags work

1 files changed, 24 insertions, 16 deletions

diff --git a/architecture.mdwn b/architecture.mdwn
index eee89a1..97a04c7 100644
--- a/architecture.mdwn
+++ b/architecture.mdwn
@@ -254,22 +254,30 @@ triggered.
 Worker (worker-manager) registration
 -----------------------------------------------------------------------------
 
-(Currently worker-manager only runs commands locally, and needs to run
-on each worker host. This will be changed later.)
-
-The sysadmin arranges to start a worker-manager for every build host.
-They may run on the same host, or not: the Ick architecture doesn't
-really care. If they run on the same host, the worker manager will
-start a sub-process. If on different hosts, the sub-process will be
-started using ssh.
-
-The CI admin may define tags for each worker. Attributes may include
-things like whether the worker can be trusted with credentials for
-logging into other workers, or for retrieving source code from the git
-server. Workers may not override such tags. Workers may, however,
-provide other tags, to e.g., report their CPU architecture or Debian
-release. The controller will eventually be able to use the tags to
-choose which worker should execute which pipeline steps.
+The sysadmin arranges to start a worker-manager on every build host.
+(FIXME: This may change. They may run on the same host, or not: the
+Ick architecture doesn't really care. But the current implementation
+only supports running commands on the same host.) If they run on the
+same host, the worker manager will start a sub-process. If on
+different hosts, the sub-process will be started using ssh.
+
+Each worker has a set of tags to describe its various attributes.
+Attributes include things like CPU architecture, operating system
+version, whether the worker can be trusted with credentials for
+logging into other systems, or for retrieving source code from the git
+server.
+
+The worker-manager will include tags to the IDP when it registers
+itself, and updates the tags when they change. The IDP will include
+tags in the access token, and the controller gets the tags from the
+access token.
+
+The sysadmin may force specific tags via the IDP. The IDP will ignore
+any such tags from the worker-manager. For example, whether a worker
+is trusted.
+
+The controller will be able to use the tags to choose which worker
+should execute which pipeline steps.
 
     @startuml
     hide footbox