1805737 - GCP sccache for comm repositories not configured

Status: RESOLVED FIXED

(Release Engineering :: Firefox-CI Administration, defect)

Description

[Rob Lemley [:rjl]]

Sccache isn't working for Thunderbird builds since the migration to GCP. It looks like new buckets/service accounts need to be set up and then grants added. Something like [e-mail] (etc) perhaps?

Research info:

Firefox builds have in their environment:
SCCACHE_GCS_CREDENTIALS_URL=http://taskcluster/auth/v1/gcp/credentials/sccache-3/[e-mail]

where "sccache-3" appears to be the singular "GCP project" and "sccache-l1-us-central1" is the bucket name, which I think maps to a service account within the sccache-3 project.

To get access to those credentials, comm projects need scopes like:

• auth:gcp:access-token:sccache-3/sccache-l{1,2,3}*
  (via assume:project:taskcluster:{trust_domain}:level-{level}-sccache-buckets)

Which raises a question:
For the AWS S3 sccache buckets, comm builds were kept separate.
comm-central-level-${MOZ_SCM_LEVEL}-sccache-${region}
vs
taskcluster-level-${MOZ_SCM_LEVEL}-sccache-${region}

I believe the reason for the separation is just to avoid cross-contamination between Firefox and Thunderbird builds.

The way I am looking at this, buckets/service accounts need to be set up for comm repos. Rather than being named "sccache-l{1,2,3}-*",
perhaps "comm-sccache-l{1,2,3}-*"

Then mozconfig.cache in m-c will need adjusting, which I can do once this work is done.

Comment 1

[Andrew Halberstadt [:ahal]]

Hey glob, is this something your team could help with?

Comment 2

[:glob ✱]

Mike - any ideas who owns the sccache setup?

Comment 3

[Mike Hommey [:glandium]]

Unfortunately, no.

Comment 4

[:glob ✱]

Jason - is this something you're familiar with?

Comment 5

[chris valaas [:cvalaas]]

Hello!
It appears no one "owns" this sccache-3 project, so I'll see if I can create the buckets/service accounts needed...

Okay, I've added comm-sccache-l{1,2,3}-* buckets and similarly named service accounts with matching permissions.

Comment 6

[Rob Lemley [:rjl]]

Attachment: Bug 1805737 - Add GCP sccache grants for comm (Thunderbird) builds. r=#releng-reviewers

Comment 7

[Rob Lemley [:rjl]]

I think I got the grants correct based on what I came up with above.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/ci/ci-configuration/rev/28083e648dfd
Add GCP sccache grants for comm (Thunderbird) builds. r=releng-reviewers,gabriel