1494962 - Create production scopes for using a generic-worker to run webrender CI jobs

Status: RESOLVED FIXED

(Taskcluster :: Operations and Service Requests, task)

Description

[Kartikaya Gupta (email:[e-mail])]

Previously we were using taskcluster-worker to run webrender's mac CI jobs, but we want to migrate to generic-worker. I have generic-worker working using the test provisioner, but we need to add scopes for production use. I'd like to use the "localprovisioner" provisioner and "webrender-ci-osx" worker type.

Comment 1

[Pete Moore [:pmoore][:pete]]

Let's set up a mozillians group for administering taskcluster entities (roles, scopes, worker types, hooks, ....) for webrender project, and then I'll set that up at the same time.

Comment 2

[Kartikaya Gupta (email:[e-mail])]

I created a mozillians group called "webrender-ci" to own the scopes and entities so it's not tied to me personally.

https://mozillians.org/en-US/group/webrender-ci/

Comment 3

[Pete Moore [:pmoore][:pete]]

Thanks Kats!

I've created a client that you can use. Please edit it, and generate a new access token for configuring your worker(s).

  1) https://tools.taskcluster.net/auth/clients/project%2Fwebrender-ci%2Fmacos

I've created a role for maintaining permissions for members of the webrender-ci mozillians group:

  2) https://tools.taskcluster.net/auth/roles/mozillians-group%3Awebrender-ci

I've also created a role for the worker type permissions:

  3) https://tools.taskcluster.net/auth/roles/worker-type%3Alocalprovisioner%2Fwebrender-ci-osx


I think this should be everything you need. Let me know if you hit any issues!

When you've decided on a workerGroup(s) and workerId(s) for your worker(s), please update scopes in 3) above to match the names you've chosen. Note the worker group is used to represent a pool of workers (e.g. physical location) and workerId is to identify the worker within that pool (e.g. hostname).

Also please check that members of the mozillians group can e.g. submit tasks for this worker type via the task creator, or perform administration of scopes etc. That will just confirm that everything is working as expected/desired.

Lastly, please make sure the webrender-ci group is invite-only in mozillians (I haven't checked, in case it is already).

Thanks!

Comment 4

[Pete Moore [:pmoore][:pete]]

Also created:

  https://tools.taskcluster.net/auth/roles/project%3Awebrender-ci%3Agrants%2Fgithub-repos

in order that people in webrender-ci can administer github.com/servo/webrender roles.

And another TODO for you kats, can you check you can update the scopes for the github repo, to use the new worker type name?

  https://tools.taskcluster.net/auth/roles/repo%3Agithub.com%2Fservo%2Fwebrender%3A*

Comment 5

[Pete Moore [:pmoore][:pete]]

(In reply to Pete Moore [:pmoore][:pete] from comment #4)
> Also created:
> 
>  
> https://tools.taskcluster.net/auth/roles/project%3Awebrender-ci%3Agrants%2Fgithub-repos
> 
> in order that people in webrender-ci can administer
> github.com/servo/webrender roles.
> 
> And another TODO for you kats, can you check you can update the scopes for
> the github repo, to use the new worker type name?
> 
>  
> https://tools.taskcluster.net/auth/roles/repo%3Agithub.com%2Fservo%2Fwebrender%3A*

.... and this time encoding the trailing `*` as `%2A`:

  https://tools.taskcluster.net/auth/roles/repo%3Agithub.com%2Fservo%2Fwebrender%3A%2A

Comment 6

[Kartikaya Gupta (email:[e-mail])]

(In reply to Pete Moore [:pmoore][:pete] from comment #4)
> And another TODO for you kats, can you check you can update the scopes for
> the github repo, to use the new worker type name?

I was able to edit the github repo role, it seems to be working now. Thanks!