2056977 - Create TaskCluster secret project/bhr/aggregation-gcp-key and grant it to the BHR aggregation cron

Status: RESOLVED FIXED

(Release Engineering :: Firefox-CI Administration, task)

Description

[Chutian (Sky) Ning]

The Background Hang Reporter (BHR) dashboard has a daily aggregation job, implemented as a TaskCluster cron kind ("bhr-aggregate") in bug 2048276. It is NOT yet landed on mozilla-central -- it is still in progress. Once it lands it will run as a cron on mozilla-central (daily, level 3) and read BHR ping data from BigQuery using a GCP service-account JSON key (the SA was provisioned in DENG-11252). The task reads that key from a TaskCluster secret via taskcluster-proxy (into GOOGLE_APPLICATION_CREDENTIALS).

The in-progress patch currently points the task at the existing perftest secret:
secrets:get:project/perftest/gecko/level-{level}/bhr-aggregate/bigquery-service-account

Per Greg (Sparky), we would rather not reuse the perftest secret -- we want the key under our own project namespace so access stays scoped to a small group instead of everyone with perftest access.

Requests:

1. Create a secret under a new "bhr" (Background Hang Reporter) project namespace:
   project/bhr/aggregation-gcp-key
   We proposed a flat path; happy to use a level-templated path instead (e.g. project/bhr/gecko/level-{level}/aggregation-gcp-key) if that matches your conventions. We will populate the value (the GCP SA JSON key) once it exists, or let us know your preferred way to set it.

2. Authorize the "bhr-aggregate" cron role (mozilla-central, level 3) to read it:
   secrets:get:project/bhr/aggregation-gcp-key
   We will set the in-tree task's scopes to this new secret in the bug 2048276 patch before it lands (replacing the perftest scope above), so nothing points at the new secret until then.

Notes:

• The cron is not live yet, so this can be set up ahead of the code landing without affecting anything.
• Try is not involved; this should be readable only by the level-3 cron.
• The GCP-side IAM (what the SA can read in BigQuery) is handled separately in DENG-11252 / the authorized-view work; this bug is only about the TaskCluster secret and the cron's read authorization.

Comment 1

[BMO Github Automation]

Attachment: [mozilla-releng/fxci-config] feat(grants): Bug 2056977 add bhr secrets grants to cronjob (#1097)

Comment 2

[BMO Github Automation]

Authored by https://github.com/hneiva
https://github.com/mozilla-releng/fxci-config/commit/4025c3567b20e4f63d55dfcc39b0f196db279ed7
[main] feat(grants): Bug 2056977 add bhr secrets grants to cronjob (#1097)

Comment 3

[Heitor Neiva [:hneiva]]

created fxci-config grant for the scoped secrets
Sky sent me the secret via magic wormhole
created secret under https://firefox-ci-tc.services.mozilla.com/secrets/project%2Fbhr%2Faggregation-gcp-key