RELOPS-2548: Add FooFrix Azure subscription, gallery, and storage

[jwmossmoz]

FooFrix keeps its launcher, scheduler, queue, results, and dashboard in GCP. This change adds a dedicated Azure DevTest subscription for Windows VMs and image builds. Perf owns VM creation, deletion, and the harness/GCP integration. RelOps supplies the Azure resources and image-build path.

RELOPS-2548. Image support is tracked in RELOPS-2570.

azure_ad manages the Platform Performance group, the VM-provisioning application/service principal, and a separate image-build application/service principal. azure_foofrix manages the subscription, resource groups, Key Vault, worker and build managed identities, gallery, image definition, private artifact storage, and role assignments. The change uses direct Terraform resources.

Access:

• RelOps retains subscription Owner, Key Vault Administrator, and artifact read/write access.
• Platform Performance starts with Denis Palmeiro and Justin Link. The group has subscription Contributor, Storage Blob Data Contributor on artifacts, and Key Vault Secrets Officer. Six other members need accounts before they can be added.
• The VM provisioner has subscription Contributor, Key Vault Secrets Officer, and artifact read/write access. Its client secret must be created outside Terraform and stored in 1Password.
• The worker identity can read vault secrets and read/write artifacts.
• The separate image-build identity has Contributor on the FooFrix build resource group and gallery, Blob Data Reader on artifacts, and permission to attach the build managed identity. The build managed identity also has Blob Data Reader for downloads inside temporary Packer VMs.

The image-build identity trusts the exact GitHub OIDC subject repo:mozilla-platform-ops/worker-images:environment:foofrix-image-build. RELOPS-2570 must create and protect that environment and use it in the dedicated authorized workflow. The subject identifies the environment, not a workflow file. Packer must use the existing build resource group and attach the build managed identity; guest downloads need managed-identity authentication.

Terraform owns the isolated foofrix gallery and win11_64_24h2 definition. The definition uses the existing FXCI properties: Windows 11 24H2, x64, Hyper-V V2, generalized, and MicrosoftWindowsDesktop/Windows-11/win11-24h2-avd. Worker-images publishes versions. Outputs provide the gallery and image definition, build resource group, build application client ID, managed identity IDs, and artifact container URL.

The private artifacts container holds source, binaries, and image-build files in Standard LRS storage. Test results remain in GCS. FooFrix uses the existing Mozilla billing profile and invoice section; the daily cost exports have no subscription filter.

Validation:

• Terraform validation passed for both stacks. azure_ad has an existing directory-role deprecation warning.
• The offline Terraform plan test passed. It checks the build role scopes and team access.
• Repository pre-commit checks passed for all changed files.
• The earlier targeted subscription plan reported 1 addition, 0 changes, and 0 removals. The subscription definition is unchanged. That plan does not validate the new identity, image, or access resources.

Nothing has been applied. Apply azure_ad first. Subscription creation requires a targeted plan for azurerm_subscription.foofrix, followed by a full plan. No full live plan or image build was run for these additions. Client-secret creation and private credential handoff remain deployment tasks.

GCS authentication still needs agreement with Perf. If Azure managed identity to Google Workload Identity Federation is selected, the Entra audience application belongs in azure_ad; Google trust and bucket grants belong in GCP. Windows tooling, profiling compatibility, startup, and image validation remain in RELOPS-2570. This PR does not create VMs or change Taskcluster pools.

Integration requirements from dpalmeiro/foofrix:

• The configured defaults are project foofrix, bucket foofrix-findings, launcher identity foofrix-worker-launcher@foofrix.iam.gserviceaccount.com, and worker identity foofrix-worker@foofrix.iam.gserviceaccount.com. These are repository defaults, not a live GCP inventory.
• The harness uses both gcloud storage and the Google Storage SDK for results and queue state. Azure workers need credentials for both paths, including object updates/deletes and bucket metadata reads. Azure Blob Storage does not replace this integration automatically.
• The GPU image builds patched Chromium with is_debug=false, is_official_build=true, symbol_level=2, and enable_profiling=true. The image scripts target Linux/GCE. Chromium marker output excludes Windows, and the Samply wrapper uses Bash. Windows image work must include validation or changes for these paths.

[markcor]

Please create a Platform Performance Entra ID group and grant it Contributor on the FooFrix subscription.

Initial membership should include:

• Denis Palmeiro: dpalmeiro@mozilla.com, object ID 2e8c6f6d-9dae-42b3-a193-5ea7c4b09cb5. His Entra account has now been created.
• Justin Link: jlink@mozilla.com, object ID d76c0d0a-537a-42a3-9ac7-0d96caa8e054. His Entra account already exists.

The following intended members did not have matching accounts in the Mozilla Entra directory when checked. They will need accounts provisioned and group membership added in a follow-up: Frank Doty, Andrew Creskey, Jamie Nicol, Marc Leclair, Markus Stange, and Sky Ning.

This group provides the team's direct subscription access; FooFrix continues to own VM creation and deletion using its provisioning service principal.

[markcor]

Following the FooFrix and worker-images review, please include the remaining Azure foundation pieces below in this Terraform change. The dedicated subscription, isolated foofrix gallery, private artifacts container, worker identity, Key Vault, and VM-provisioning service principal already cover the core resource requirements.

1. Dedicated image-build identity. Create a separate FooFrix image-build application/service principal with GitHub OIDC trust for the dedicated worker-images workflow. Keep it separate from both the FooFrix VM provisioner and existing FXCI/TCEng image-build credentials. Scope its build-resource and gallery-publishing permissions to FooFrix. Coordinate the OIDC subject with the new workflow/environment.

2. Artifact access during image creation. Give the image-build identity Storage Blob Data Reader on artifacts. If the bootstrap script downloads resources inside the temporary Packer VM, provide an authenticated path there too, such as a dedicated build managed identity with container read access and permission for the builder to attach it. GitHub's authenticated session is not automatically available inside the guest. The container is for FooFrix resources, binaries, and source used to build images; results remain in GCS.

3. Platform Performance group and data access. Create the group and grant Contributor on the FooFrix subscription, plus Storage Blob Data Contributor on artifacts so the team can upload source and binaries. Add Key Vault Secrets Officer if team members will maintain AI keys directly; subscription Contributor alone does not grant blob/secret data access through Entra authentication. Initial membership is Denis Palmeiro (dpalmeiro@mozilla.com, object ID 2e8c6f6d-9dae-42b3-a193-5ea7c4b09cb5) and Justin Link (jlink@mozilla.com, object ID d76c0d0a-537a-42a3-9ac7-0d96caa8e054). Frank Doty, Andrew Creskey, Jamie Nicol, Marc Leclair, Markus Stange, and Sky Ning need accounts provisioned and membership added later.

   Denis's account has been created and its password reset to a temporary password. He must sign in, rotate it by setting his own password, and complete MFA setup. A password change at next sign-in is already required; MFA enrollment still needs to be completed. Deliver the temporary credential through the approved private handoff process, never in this PR or Terraform.

4. Gallery image definition. Follow the existing gallery ownership pattern: Terraform manages the Windows image definition (OS, architecture, generation, and identifiers), and worker-images publishes image versions. Settle those image properties with the image-support work rather than assuming them here. Expose the gallery name/resource group, image definition ID, and build identity client ID as needed for workflow configuration.

5. GCS authentication follow-up. If Azure managed identity to Google Workload Identity Federation is selected, manage the required Entra audience application in azure_ad; the Google trust and bucket grants belong on the GCP side. The harness defaults are project foofrix and bucket foofrix-findings. Hosted queue/state access includes reads, updates, and deletes as well as uploads, so upload-only permission is insufficient for that mode. This authentication design still needs to be finalized with Perf.

Ownership and next step: Perf owns VM provisioning/deletion and the FooFrix harness/GCP integration. RelOps supplies the Azure foundation and image-build path. Image support is tracked in RELOPS-2570 — Add FooFrix Windows image support to worker-images, linked to RELOPS-2548, assigned to Mark Cornmesser, and In Progress. We will follow TCEng's team-owned config/bootstrap approach with a dedicated authorized workflow, publishing into the isolated FooFrix gallery. Windows tooling, patched Chromium/profiling compatibility, standalone startup, and image validation are part of that follow-up; no Taskcluster pool migration is planned here.