infra/config/generated/realms.cfg

# Auto-generated by lucicfg.
# Do not modify manually.
#
# For the schema of this file, see RealmsCfg message:
#   https://config.luci.app/schemas/projects:realms.cfg

realms {
  name: "@root"
  bindings {
    role: "role/analysis.editor"
    principals: "group:project-infra-committers"
  }
  bindings {
    role: "role/analysis.queryUser"
    principals: "group:project-infra-committers"
  }
  bindings {
    role: "role/analysis.reader"
    principals: "group:all"
  }
  bindings {
    role: "role/buildbucket.reader"
    principals: "group:all"
  }
  bindings {
    role: "role/buildbucket.triggerer"
    principals: "group:project-infra-internal-led-breakglass"
  }
  bindings {
    role: "role/configs.reader"
    principals: "group:all"
  }
  bindings {
    role: "role/configs.validator"
    principals: "user:infra-try-builder@chops-service-accounts.iam.gserviceaccount.com"
  }
  bindings {
    role: "role/cq.committer"
    principals: "group:project-infra-committers"
  }
  bindings {
    role: "role/cq.dryRunner"
    principals: "group:project-infra-tryjob-access"
  }
  bindings {
    role: "role/logdog.reader"
    principals: "group:all"
  }
  bindings {
    role: "role/logdog.writer"
    principals: "group:luci-logdog-chromium-writers"
  }
  bindings {
    role: "role/scheduler.owner"
    principals: "group:project-infra-committers"
  }
  bindings {
    role: "role/scheduler.reader"
    principals: "group:all"
  }
  bindings {
    role: "role/swarming.poolOwner"
    principals: "group:mdb/chrome-troopers"
  }
  bindings {
    role: "role/swarming.taskTriggerer"
    principals: "group:project-infra-internal-led-breakglass"
  }
}
realms {
  name: "ci"
  bindings {
    role: "role/buildbucket.builderServiceAccount"
    principals: "user:infra-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
  }
  bindings {
    role: "role/resultdb.invocationCreator"
    principals: "user:infra-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
  }
  bindings {
    role: "role/swarming.taskTriggerer"
    principals: "group:flex-ci-led-users"
  }
}
realms {
  name: "ci.shadow"
  bindings {
    role: "role/buildbucket.builderServiceAccount"
    principals: "user:infra-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
  }
  bindings {
    role: "role/buildbucket.creator"
    principals: "group:flex-ci-led-users"
  }
  bindings {
    role: "role/resultdb.invocationCreator"
    principals: "user:infra-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
  }
}
realms {
  name: "codesearch"
  bindings {
    role: "role/buildbucket.builderServiceAccount"
    principals: "user:infra-codesearch@chops-service-accounts.iam.gserviceaccount.com"
  }
  bindings {
    role: "role/buildbucket.triggerer"
    principals: "group:mdb/chrome-ops-source"
    principals: "user:luci-scheduler@appspot.gserviceaccount.com"
  }
  bindings {
    role: "role/swarming.taskTriggerer"
    principals: "group:flex-try-led-users"
    principals: "group:google/luci-task-force@google.com"
    principals: "group:mdb/chrome-troopers"
  }
  bindings {
    role: "role/scheduler.triggerer"
    principals: "user:infra-codesearch@chops-service-accounts.iam.gserviceaccount.com"
    conditions {
      restrict {
        attribute: "scheduler.job.name"
        values: "codesearch-gen-chromium-android"
        values: "codesearch-gen-chromium-chromiumos"
        values: "codesearch-gen-chromium-cronet"
        values: "codesearch-gen-chromium-fuchsia"
        values: "codesearch-gen-chromium-ios"
        values: "codesearch-gen-chromium-linux"
        values: "codesearch-gen-chromium-mac"
        values: "codesearch-gen-chromium-webview"
        values: "codesearch-gen-chromium-win"
      }
    }
  }
}
realms {
  name: "codesearch.shadow"
  bindings {
    role: "role/buildbucket.builderServiceAccount"
    principals: "user:infra-codesearch@chops-service-accounts.iam.gserviceaccount.com"
  }
  bindings {
    role: "role/buildbucket.creator"
    principals: "group:flex-try-led-users"
    principals: "group:google/luci-task-force@google.com"
    principals: "group:mdb/chrome-troopers"
  }
}
realms {
  name: "cron"
  bindings {
    role: "role/buildbucket.builderServiceAccount"
    principals: "user:chromium-tarball-builder@chops-service-accounts.iam.gserviceaccount.com"
    principals: "user:wpt-autoroller@chops-service-accounts.iam.gserviceaccount.com"
  }
  bindings {
    role: "role/scheduler.triggerer"
    principals: "user:chromium-tarball-builder@chops-service-accounts.iam.gserviceaccount.com"
    conditions {
      restrict {
        attribute: "scheduler.job.name"
        values: "Build From Tarball"
        values: "publish_tarball"
      }
    }
  }
}
realms {
  name: "cron.shadow"
  bindings {
    role: "role/buildbucket.builderServiceAccount"
    principals: "user:chromium-tarball-builder@chops-service-accounts.iam.gserviceaccount.com"
  }
  bindings {
    role: "role/buildbucket.creator"
    principals: "group:mdb/chrome-troopers"
  }
}
realms {
  name: "pools/ci"
  bindings {
    role: "role/swarming.poolUser"
    principals: "group:flex-ci-led-users"
  }
}
realms {
  name: "pools/codesearch"
  bindings {
    role: "role/swarming.poolUser"
    principals: "group:flex-try-led-users"
    principals: "group:google/luci-task-force@google.com"
    principals: "group:mdb/chrome-troopers"
  }
}
realms {
  name: "pools/cron"
}
realms {
  name: "pools/try"
  bindings {
    role: "role/swarming.poolUser"
    principals: "group:flex-try-led-users"
  }
}
realms {
  name: "try"
  bindings {
    role: "role/buildbucket.builderServiceAccount"
    principals: "user:infra-try-builder@chops-service-accounts.iam.gserviceaccount.com"
    principals: "user:infra-try-recipes-tester@chops-service-accounts.iam.gserviceaccount.com"
  }
  bindings {
    role: "role/buildbucket.triggerer"
    principals: "group:project-infra-tryjob-access"
    principals: "group:service-account-cq"
    principals: "project:infra-internal"
    principals: "user:github-integration@cobalt-tools.iam.gserviceaccount.com"
  }
  bindings {
    role: "role/resultdb.invocationCreator"
    principals: "user:infra-try-builder@chops-service-accounts.iam.gserviceaccount.com"
  }
  bindings {
    role: "role/swarming.taskTriggerer"
    principals: "group:flex-try-led-users"
  }
}
realms {
  name: "try.shadow"
  bindings {
    role: "role/buildbucket.builderServiceAccount"
    principals: "user:infra-try-builder@chops-service-accounts.iam.gserviceaccount.com"
    principals: "user:infra-try-recipes-tester@chops-service-accounts.iam.gserviceaccount.com"
  }
  bindings {
    role: "role/buildbucket.creator"
    principals: "group:flex-try-led-users"
  }
  bindings {
    role: "role/resultdb.invocationCreator"
    principals: "user:infra-try-builder@chops-service-accounts.iam.gserviceaccount.com"
  }
}