I've been investigating how to do this backfill for pioneer, since it's a more complicated situation due to VPC-SC and KMS. I'm going to create a separate beam-like backfill project for pioneer that exists within a service perimeter and grant it temporary access to BQ+KMS for the backfill. Since GCR is protected within the perimeter I will copy the flex template image from the standard location into the project, and potentially other GCS assets if VPC-SC restrictions cause issues.
Bug 1729069 Comment 14 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
I've been investigating how to do this backfill for pioneer, since it's a more complicated situation due to VPC-SC and KMS. I'm going to create a separate beam-like backfill project for pioneer that exists within a service perimeter and grant it temporary access to BQ+KMS for the backfill. Since GCR is protected within the perimeter I will copy the flex template image from the standard location into the project, and potentially other GCS assets if VPC-SC restrictions cause issues. EDIT: https://github.com/mozilla-services/cloudops-infra/pull/3343