1486544 - [ci-admin] support grants to "utility roles"

Status: RESOLVED INCOMPLETE

(Firefox Build System :: Task Configuration, task)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

- grant: [<scopes>]
  to:
    role: <roleId>

Such "utility roles" will be useful to avoid repetition in grants.yml.

One unanswered question here is, how does grants.yml suggest what roles are managed?  For example, if we have a bunch of utility roles like project:mything:foo and project:mything:bar, we probably intend to manage all roles under project:mything:...  How do we indicate that in grants.yml?

One idea:

- grant: [<scopes>]
  to:
    role: <roleId>
    in: <rolePrefix>

where the <rolePrefix> is the managed prefix.  But that will result in a lot of repetition, too.

Comment 1

[Aaditya]

Hi Dustin,
Is the issue still open? This will be my first contribution to Mozilla. Might need some help navigating the field.

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

Hm, in the last week or so we've probably made this bug less useful. However, there's a bug related to the same project here:
https://github.com/taskcluster/tc-admin/issues/15

Do you want to take a look at that and think about how you might solve it?

Comment 3

[Aaditya]

Ok sure. I will take a look at it . Thanks!