chore: switch to v2 style workgroups (#8656)

* chore: rename mozilla-confidential workgroup

* chore: rename ads workgroup

* chore: rename contextual-services workgroup

Author: whd

bigquery_etl/backfill/utils.py

@@ -28,7 +28,7 @@
 BACKFILL_DESTINATION_DATASET = "backfills_staging_derived"
 
 # currently only supporting backfilling tables with workgroup access: mozilla-confidential.
-VALID_WORKGROUP_MEMBER = "workgroup:mozilla-confidential"
+VALID_WORKGROUP_MEMBER = "workgroup:mozilla-confidential/data-viewers"
 
 # Backfills older than this will not run due to staging table expiration
 MAX_BACKFILL_ENTRY_AGE_DAYS = 28
@@ -185,7 +185,7 @@ def validate_metadata_workgroups(sql_dir, qualified_table_name) -> bool:
     """
     Check if either table or dataset metadata workgroup is valid.
 
-    The backfill staging dataset currently only support backfilling datasets and tables for workgroup:mozilla-confidential.
+    The backfill staging dataset currently only support backfilling datasets and tables for workgroup:mozilla-confidential/data-viewers.
     """
     project, dataset, table = qualified_table_name_matching(qualified_table_name)
     query_file = Path(sql_dir) / project / dataset / table / "query.sql"
@@ -237,7 +237,7 @@ def validate_metadata_workgroups(sql_dir, qualified_table_name) -> bool:
 
 
 def _validate_workgroup_members(workgroup_access, metadata_filename):
-    """Return True if workgroup members is valid (workgroup:mozilla-confidential)."""
+    """Return True if workgroup members is valid (workgroup:mozilla-confidential/data-viewers)."""
     if workgroup_access:
         for workgroup in workgroup_access:
             if metadata_filename == METADATA_FILE:

bigquery_etl/metadata/parse_metadata.py

@@ -18,7 +18,10 @@
 METADATA_FILE = "metadata.yaml"
 DATASET_METADATA_FILE = "dataset_metadata.yaml"
 DEFAULT_WORKGROUP_ACCESS = [
-    dict(role="roles/bigquery.dataViewer", members=["workgroup:mozilla-confidential"])
+    dict(
+        role="roles/bigquery.dataViewer",
+        members=["workgroup:mozilla-confidential/data-viewers"],
+    )
 ]
 DEFAULT_TABLE_WORKGROUP_ACCESS = DEFAULT_WORKGROUP_ACCESS
 

docs/cookbooks/common_workflows.md

@@ -7,4 +7,4 @@ labels: {}
 workgroup_access:
 - role: roles/bigquery.dataViewer
   members:
-  - workgroup:mozilla-confidential
+  - workgroup:mozilla-confidential/data-viewers

sql/moz-fx-data-shared-prod/accounts_backend/dataset_metadata.yaml

@@ -9,4 +9,4 @@ labels: {}
 workgroup_access:
 - role: roles/bigquery.dataViewer
   members:
-  - workgroup:mozilla-confidential
+  - workgroup:mozilla-confidential/data-viewers

sql/moz-fx-data-shared-prod/accounts_db/dataset_metadata.yaml

@@ -7,5 +7,5 @@ labels: {}
 workgroup_access:
 - role: roles/bigquery.dataViewer
   members:
-  - workgroup:mozilla-confidential
+  - workgroup:mozilla-confidential/data-viewers
 syndication: {}

sql/moz-fx-data-shared-prod/accounts_db_derived/dataset_metadata.yaml

@@ -7,4 +7,4 @@ labels: {}
 workgroup_access:
 - role: roles/bigquery.dataViewer
   members:
-  - workgroup:mozilla-confidential
+  - workgroup:mozilla-confidential/data-viewers

sql/moz-fx-data-shared-prod/acoustic/dataset_metadata.yaml

@@ -7,4 +7,4 @@ labels: {}
 workgroup_access:
 - role: roles/bigquery.dataViewer
   members:
-  - workgroup:mozilla-confidential
+  - workgroup:mozilla-confidential/data-viewers

sql/moz-fx-data-shared-prod/acoustic_derived/dataset_metadata.yaml

@@ -8,5 +8,5 @@ labels: {}
 workgroup_access:
 - role: roles/bigquery.dataViewer
   members:
-  - workgroup:mozilla-confidential
+  - workgroup:mozilla-confidential/data-viewers
   - workgroup:pocket/prefect

sql/moz-fx-data-shared-prod/activity_stream/dataset_metadata.yaml

@@ -8,6 +8,6 @@ labels: {}
 workgroup_access:
 - role: roles/bigquery.dataViewer
   members:
-  - workgroup:mozilla-confidential
+  - workgroup:mozilla-confidential/data-viewers
   - workgroup:pocket/external
   - workgroup:pocket/prefect