[as14692]

Summary

Fix gMSA on Linux credentialSpec container cleanup for credentialfetcher tasks by properly assigning leaseId to taskResource, ensuring ticket cleanup when tasks are stopped.

Implementation details

• Assigned leaseId from gMSA client response to credentialSpec taskResource object
• This enables the task resource cleanup method to properly delete tickets using leaseId during task cleanup
• Previously, tickets remained after task stopping due to missing leaseId assignment in taskResource

Testing

Unit Test

• make test

Function Test

• Ran a credentialfetcher task on an AL2023 EC2 instance - Using gMSA for EC2 Linux containers on Amazon ECS
• Verified the ticket has been created in /var/credentials-fetcher/krbdir/
• Stopped the task
• Verified the ticket has been deleted after a default wait period of 3 hours

/var/log/ecs/ecs-agent.log.2025-02-06-01:level=info time=2025-02-06T01:50:40Z msg="Managed task has reached stopped; waiting for container cleanup" task="xxx"
/var/log/ecs/ecs-agent.log.2025-02-06-04:level=info time=2025-02-06T04:50:40Z msg="Resource cleanup complete" task="xxx" resource="credentialspec"

New tests cover the changes:

Description for the changelog

Bug: Ensure proper cleanup of gMSA Linux credentials by assigning leaseId to taskResource for credentialfetcher tasks

Additional Information

Does this PR include breaking model changes? If so, Have you added transformation functions? - No

Does this PR include the addition of new environment variables in the README? - No

Licensing

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[smhmhmd]

See if you can add a unit-test