1407101 - please add scopes to moz-tree:level:1

Status: RESOLVED FIXED

(Taskcluster :: Operations and Service Requests, task)

Description

[Aki Sasaki (not active)]

Please add these scopes to moz-tree:level:1 :

project:releng:balrog:channel:*
project:releng:balrog:server:dep
project:releng:beetmover:action:*
project:releng:beetmover:bucket:dep
project:releng:googleplay:dep

We're essentially following signing, where all the format scopes are allowed, but we restrict by key type (release / nightly / dep). So the balrog channels and beetmover actions will all be allowed, but only against staging servers + buckets. Right now the googleplay:dep scope will throw an exception, but we can add a dry-run with that scope.

Comment 1

[Aki Sasaki (not active)]

Could we also add

project:releng:buildbot-bridge:*
queue:route:index.releases.v1.maple.*

to maple?

Comment 2

[Greg Arndt [:garndt]]

Scopes in the description have been added to moz-tree:level:1

https://tools.taskcluster.net/auth/roles/moz-tree%3Alevel%3A1

Comment 3

[Greg Arndt [:garndt]]

For now, I have manually updated maple to have those two scopes.

In the future, we'll find a way of defining project level scopes that tc-admin can use when creating the role.

Please reopen if there is an issue.

Comment 4

[Aki Sasaki (not active)]

Thanks!