Rather than decrypting secrets on the scheduler and sending them
to the executors unencrypted, now that the private keys are in ZK
and the executors have access to them, we can defer decryption to
the executors. This means that when we move the build requests
from gearman to ZK, we avoid storing decrypted secrets in ZK.
We accomplish this by serializing the entire secret (parts or all
of which may be encrypted or plaintext) to YAML in the scheduler
and deserializing the YAML into a Secret object on the executor.
We do this because we already have support for indicating an
encrypted value via custom YAML tags.
This means that the build request (which is currently transmitted
via gearman and soon to be via ZK) serializes the rest of the job
to JSON. This means we're storing a serialized-to-YAML secret as
a scalar value in a serialized-to-JSON data structure. There's
nothing technically wrong with this, and it is the minimal version
of this change, however it's slightly unusual and may result in
a little extra work. We may want to consider serializing the
entire job request as YAML instead.
Change-Id: I6d94c1d8da8b68e5fb60c27e73039155a02fb485
fbb17e1f35