1226018 - Modify BBB to look for scopes like `project:releng:buildbot-bridge:..`

Status: RESOLVED FIXED

(Release Engineering :: General, defect)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

This puts `releng` nicely in the scope name so that it's easy to spot and anyone modifying scopes has a big red "THINK CAREFULLY ABOUT THIS" flag (just like IT won't touch anything with "releng" in the hostname.. good sides and bad sides to that..)

It should be relatively simple to grant anything that currently has buildbot-bridge:foo the project:releng:buildbot-bridge:foo scope, then modify buildbot bridge to check for the latter, then remove the buidbot-bridge:foo scopes form task definitions, and once those tasks have completed, remove them from the roles.

Comment 1

[Dustin J. Mitchell [:dustin] (he/him)]

Ben, is this something you could hack on at some point?  It's not a huge change, I think.

Comment 2

[[e-mail] (:bhearsum)]

I'm pretty heads down in Balrog these days. If I'm understanding correctly this is s/buildbot-bridge:/releng:buildbot-bridge:/ (with an overlap period where both are valid for transitioning). If that's the case this should just be a simple tweak of https://github.com/mozilla/buildbot-bridge/blob/master/bbb/services.py#L385 and a few tests.

Comment 3

[Dustin J. Mitchell [:dustin] (he/him)]

Yes, that's right.  Is there a new owner for BBB?  I don't mind putting the patch up (sounds easy enough) but deploying, testing, and rolling back are a little out of my comfort zone.  Would you be able to help with that?

Comment 4

[[e-mail] (:bhearsum)]

I updated dev to use my not-yet-landed bbb patch and it's now broken, looping over a ton of tasks over and over. Probably due to the restart, not due to the changes, which are merely:
diff --git a/bbb/services.py b/bbb/services.py
index 5c9074e..67f58f6 100644
--- a/bbb/services.py
+++ b/bbb/services.py
@@ -384,17 +384,18 @@ class TCListener(ListenerService):
 
     def _isAuthorized(self, buildername, scopes):
         """Tests to see if the builder given is restricted, and if so, whether
         or not the scopes given are authorized to use it. Builders that do
         not match the overall restricted builder patterns do not require any
         scopes. Builders that do must have a buildbot-bridge:builder-name:
         scope that matches the builder name given."""
         requiredscopes = [
-            ["buildbot-bridge:builder-name:{}".format(buildername)]
+            ["buildbot-bridge:builder-name:{}".format(buildername)],
+            ["project:releng:buildbot-bridge:builder-name:{}".format(buildername)]
         ]
 
         for r in self.restricted_builders:
             # If the builder is restricted, check the scopes to see if they
             # are authorized to use it.
             if re.match(r, buildername):
                 return scope_match(scopes, requiredscopes)
         # If the builder is unrestricted, no special scopes are required to
diff --git a/bbb/test/test_services.py b/bbb/test/test_services.py

Comment 5

[[e-mail] (:bhearsum)]

Turns out there was a bunch of old tasks in the dev db (as far back as october!). I removed those.

Comment 6

[[e-mail] (:bhearsum)]

Alright, this worked fine in dev. I'll post the patch and get it landed to prod.

Comment 7

[[e-mail] (:bhearsum)]

Attachment: add the new scope

Comment 8

[[e-mail] (:bhearsum)]

Attachment: upgrade dev+prod buildbot bridge

Moving these both to 1.5.4, which is the same as 1.5.3 but with a packaging-only change included (https://github.com/mozilla/buildbot-bridge/pull/11).

Comment 9

[Dustin J. Mitchell [:dustin] (he/him)]

Comment on attachment 8717903 [details] [diff] [review]
upgrade dev+prod buildbot bridge

btw, puppetagain is hooked up to mozreview if that's more convenient

Comment 10

[[e-mail] (:bhearsum)]

This looks to be working fine in production, I think it's safe to remove any references to the old scope in credentials now.

Comment 11

[Dustin J. Mitchell [:dustin] (he/him)]

Done!