run_2bb706ada35ca7ca

input

{
  "request": "Triage Jira ticket SREIN-1673: IAP help for Orchestrator / LLM Visibility App (PROD)",
  "references": [
    "https://mozilla-hub.atlassian.net/browse/SREIN-1673"
  ],
  "sourceContext": {
    "issue": "SREIN-1673"
  }
}

summary

SREIN-1673 requests IAP (Identity-Aware Proxy) be added in front of the Orchestrator/LLM Visibility App in PROD, while preserving existing OIDC auth. This requires provisioning an OAuth client for project moz-fx-orchestrator-prod and storing the client id/secret in GSM secret prod-gke-llm-visibility-iap-secrets, formatted as JSON with a "clientSecret" key. The ticket is unassigned/untouched (Backlog, 0 comments) and references a prior "fulfilled request for stage" as a precedent, but the actual link/ticket reference did not come through in the description text, so the stage ticket needs to be identified for consistency (naming conventions, IAP config, secret format).

findings

• Ticket is in Backlog status with zero comments — no triage or assignment has occurred yet.
• Core ask: add IAP in front of llm-visibility (orchestrator tenant) in PROD while keeping existing OIDC authentication intact — this is an additive auth layer, not a replacement.
• Requires provisioning a new OAuth client for the moz-fx-orchestrator-prod GCP project and storing credentials in a specific GSM secret.
• The secret must be stored in a specific JSON format with a clientSecret key, matching the pattern used for the prior stage environment request.
• The description references a previously fulfilled analogous request for the stage environment as a template/precedent, but the actual link/ticket key was not captured in the retrieved description text — this precedent ticket should be located to ensure consistency (naming, IAP config, secret structure) between stage and prod.
• No Confluence runbook or design doc was explicitly linked in the ticket, so no additional design context could be retrieved.

proposed actions

Thanks for the request. To move this forward for PROD (moz-fx-orchestrator-prod), could you confirm/provide the following:

1. The link or key of the prior 'fulfilled request for stage' ticket you referenced, so we can mirror the exact IAP configuration (OAuth consent screen settings, authorized redirect URIs, backend service, and secret naming) used there.
2. Confirmation of the GCP project (moz-fx-orchestrator-prod) and the load balancer / backend service that IAP should be enabled on.
3. Confirmation that OIDC should remain enabled at the application layer in addition to IAP (i.e., IAP + app-level OIDC, not IAP replacing OIDC).

Once confirmed, we'll: (a) create the OAuth 2.0 client credentials for the prod project, (b) store them in GSM secret `prod-gke-llm-visibility-iap-secrets` in the format `{"clientSecret": "..."}` (please also confirm whether client ID should be stored alongside, e.g. a `clientId` key, or only the secret per the stage precedent), and (c) enable IAP on the target backend, then update this ticket with the client ID for your app config.

Moving this out of Backlog and requesting the stage ticket reference/assignment to proceed.

tool calls

[
  {
    "capability": "jira.issue.read",
    "args": {
      "key": "SREIN-1673"
    },
    "result": {
      "key": "SREIN-1673",
      "summary": "IAP help for Orchestrator / LLM Visibility App (PROD)",
      "status": "Backlog",
      "description_text": "llm-visibility (orchestrator tenant) needs to add IAP in front of access (while keeping OIDC). We need an OAuth client provisioned for  moz-fx-orchestrator-prod  (client id + secret in GSM  prod-gke-llm-visibility-iap-secrets ). see fulfilled request for stage referenced here: key format needs to be in the format below: {\n\"clientSecret\": \"***\"\n}",
      "comment_count": 0,
      "comments": []
    }
  }
]

log