Bugzilla

The Background Hang Reporter (BHR) dashboard has a daily aggregation job that runs as a TaskCluster cron (tracked in bug 2048276). The job reads BHR ping data from BigQuery using a GCP service account JSON key (the SA was provisioned in DENG-11252). We need to store that key as a TaskCluster secret and grant the cron read access.

Per Greg (@sparky), rather than reuse the existing perftest secret we want the key under its own project namespace, so access stays scoped to a small group instead of everyone with perftest access.

Requests:

1. Create a secrets project namespace "bhr" (Background Hang Reporter) with a secret at:
       project/bhr/aggregation-gcp-key
   We will populate the value (the GCP service-account JSON key) once it exists, or let us know your preferred way to set it.

2. Grant the BHR aggregation cron the scope:
       secrets:get:project/bhr/aggregation-gcp-key
   so it can read the key at runtime. The cron is defined in mozilla-central and runs at level 3 (no try access). Cron task: <CONFIRM cron name>.

3. Restrict write/manage access to this secret to a small group rather than the broader perftest group: <CONFIRM group / users>.

Notes:
- This credential should not be available to try; level-3 cron only.
- The GCP-side IAM (what the SA can read in BigQuery) is handled separately in DENG-11252 and the authorized-view work; this bug is only about TaskCluster secret storage and the cron scope grant.

The Background Hang Reporter (BHR) dashboard has a daily aggregation job that runs as a TaskCluster cron (tracked in bug 2048276). The job reads BHR ping data from BigQuery using a GCP service account JSON key (the SA was provisioned in DENG-11252). We need to store that key as a TaskCluster secret and grant the cron read access.

Per Greg (@sparky), rather than reuse the existing perftest secret we want the key under its own project namespace, so access stays scoped to a small group instead of everyone with perftest access.

Requests:

1. Create a secrets project namespace "bhr" (Background Hang Reporter) with a secret at:
       project/bhr/aggregation-gcp-key
   We will populate the value (the GCP service-account JSON key) once it exists, or let us know your preferred way to set it.

2. Grant the BHR aggregation cron the scope:
       secrets:get:project/bhr/aggregation-gcp-key
   so it can read the key at runtime. The cron is defined in mozilla-central and runs at level 3 (no try access). 

3. Restrict write/manage access to this secret to a small group rather than the broader perftest group: <CONFIRM group / users>.

Notes:
- This credential should not be available to try; level-3 cron only.
- The GCP-side IAM (what the SA can read in BigQuery) is handled separately in DENG-11252 and the authorized-view work; this bug is only about TaskCluster secret storage and the cron scope grant.

The Background Hang Reporter (BHR) dashboard has a daily aggregation job that runs as a TaskCluster cron (tracked in bug 2048276). The job reads BHR ping data from BigQuery using a GCP service account JSON key (the SA was provisioned in DENG-11252). We need to store that key as a TaskCluster secret and grant the cron read access.

Per Greg (@sparky), rather than reuse the existing perftest secret we want the key under its own project namespace, so access stays scoped to a small group instead of everyone with perftest access.

Requests:

1. Create a secrets project namespace "bhr" (Background Hang Reporter) with a secret at:
       project/bhr/aggregation-gcp-key
   We will populate the value (the GCP service-account JSON key) once it exists, or let us know your preferred way to set it.

2. Grant the BHR aggregation cron the scope:
       secrets:get:project/bhr/aggregation-gcp-key
   so it can read the key at runtime. The cron is defined in mozilla-central and runs at level 3 (no try access). 


Notes:
- This credential should not be available to try; level-3 cron only.
- The GCP-side IAM (what the SA can read in BigQuery) is handled separately in DENG-11252 and the authorized-view work; this bug is only about TaskCluster secret storage and the cron scope grant.

The Background Hang Reporter (BHR) dashboard has a daily aggregation job, implemented as a TaskCluster cron kind ("bhr-aggregate") in bug 2048276. It is NOT yet landed on mozilla-central -- it is still in progress. Once it lands it will run as a cron on mozilla-central (daily, level 3) and read BHR ping data from BigQuery using a GCP service-account JSON key (the SA was provisioned in DENG-11252). The task reads that key from a TaskCluster secret via taskcluster-proxy (into GOOGLE_APPLICATION_CREDENTIALS).

The in-progress patch currently points the task at the existing perftest secret:
    secrets:get:project/perftest/gecko/level-{level}/bhr-aggregate/bigquery-service-account

Per Greg (Sparky), we would rather not reuse the perftest secret -- we want the key under our own project namespace so access stays scoped to a small group instead of everyone with perftest access.

Requests:

1. Create a secret under a new "bhr" (Background Hang Reporter) project namespace:
       project/bhr/aggregation-gcp-key
   We proposed a flat path; happy to use a level-templated path instead (e.g. project/bhr/gecko/level-{level}/aggregation-gcp-key) if that matches your conventions. We will populate the value (the GCP SA JSON key) once it exists, or let us know your preferred way to set it.

2. Authorize the "bhr-aggregate" cron role (mozilla-central, level 3) to read it:
       secrets:get:project/bhr/aggregation-gcp-key
   We will set the in-tree task's scopes to this new secret in the bug 2048276 patch before it lands (replacing the perftest scope above), so nothing points at the new secret until then.


Notes:
- The cron is not live yet, so this can be set up ahead of the code landing without affecting anything.
- Try is not involved; this should be readable only by the level-3 cron.
- The GCP-side IAM (what the SA can read in BigQuery) is handled separately in DENG-11252 / the authorized-view work; this bug is only about the TaskCluster secret and the cron's read authorization.