languages/dart-sdk
languages/dart-sdk
1
0
Fork 0
mirror of https://github.com/dart-lang/sdk synced 2024-09-30 06:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

[infra] Add bucket contraints to all buckets

Browse source 
Bucket constraints, listing the pools and service accounts that
builds from this bucket are allowed to use, are now required
on shadow buckets.

Adding them to all buckets in dart-ci, based on the pools and
service accounts the builders are currently using in each bucket.

Bug: b/285098783
Change-Id: I8a9af76a679c1dc93f6cbfdc7f66731608f8d6cf
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/308041
Reviewed-by: Jonas Termansen <sortie@google.com>
Commit-Queue: William Hesse <whesse@google.com>
This commit is contained in:
William Hesse 2023-06-09 13:24:22 +00:00 committed by Commit Queue
parent cc86de256d
commit 84161da683
3 changed files with 111 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

42
generated/cr-buildbucket.cfg
View file

@ -44,6 +44,10 @@ buckets {
}
}
shadow: "ci.shadow"
constraints {
pools: "luci.dart.ci"
service_accounts: "dart-luci-ci-builder@dart-ci.iam.gserviceaccount.com"
}
}
buckets {
name: "ci.sandbox"
@ -8808,12 +8812,26 @@ buckets {
}
}
shadow: "ci.sandbox.shadow"
constraints {
pools: "dart.tests"
pools: "luci.dart.try"
service_accounts: "dart-luci-try-builder@dart-ci.iam.gserviceaccount.com"
}
}
buckets {
name: "ci.sandbox.shadow"
constraints {
pools: "dart.tests"
pools: "luci.dart.try"
service_accounts: "dart-luci-try-builder@dart-ci.iam.gserviceaccount.com"
}
}
buckets {
name: "ci.shadow"
constraints {
pools: "luci.dart.ci"
service_accounts: "dart-luci-ci-builder@dart-ci.iam.gserviceaccount.com"
}
}
buckets {
name: "try"
@ -13357,6 +13375,10 @@ buckets {
}
}
shadow: "try.shadow"
constraints {
pools: "luci.dart.try"
service_accounts: "dart-luci-try-builder@dart-ci.iam.gserviceaccount.com"
}
}
buckets {
name: "try.monorepo"
@ -13955,12 +13977,24 @@ buckets {
}
}
shadow: "try.monorepo.shadow"
constraints {
pools: "dart.tests"
service_accounts: "dart-luci-try-builder@dart-ci.iam.gserviceaccount.com"
}
}
buckets {
name: "try.monorepo.shadow"
constraints {
pools: "dart.tests"
service_accounts: "dart-luci-try-builder@dart-ci.iam.gserviceaccount.com"
}
}
buckets {
name: "try.shadow"
constraints {
pools: "luci.dart.try"
service_accounts: "dart-luci-try-builder@dart-ci.iam.gserviceaccount.com"
}
}
buckets {
name: "try.shared"
@ -14007,9 +14041,17 @@ buckets {
}
}
shadow: "try.shared.shadow"
constraints {
pools: "luci.dart.try"
service_accounts: "dart-luci-try-builder@dart-ci.iam.gserviceaccount.com"
}
}
buckets {
name: "try.shared.shadow"
constraints {
pools: "luci.dart.try"
service_accounts: "dart-luci-try-builder@dart-ci.iam.gserviceaccount.com"
}
}
common_config {
builds_notification_topics {

20
generated/realms.cfg
View file

@ -93,6 +93,10 @@ realms {
}
realms {
name: "ci.sandbox.shadow"
bindings {
role: "role/buildbucket.builderServiceAccount"
principals: "user:dart-luci-try-builder@dart-ci.iam.gserviceaccount.com"
}
bindings {
role: "role/buildbucket.triggerer"
principals: "user:dart-internal-cbuild@dart-ci-internal.iam.gserviceaccount.com"
@ -102,6 +106,10 @@ realms {
}
realms {
name: "ci.shadow"
bindings {
role: "role/buildbucket.builderServiceAccount"
principals: "user:dart-luci-ci-builder@dart-ci.iam.gserviceaccount.com"
}
bindings {
role: "role/buildbucket.triggerer"
principals: "user:dart-luci-ci-builder@dart-ci.iam.gserviceaccount.com"
@ -160,6 +168,10 @@ realms {
}
realms {
name: "try.monorepo.shadow"
bindings {
role: "role/buildbucket.builderServiceAccount"
principals: "user:dart-luci-try-builder@dart-ci.iam.gserviceaccount.com"
}
bindings {
role: "role/buildbucket.triggerer"
principals: "group:project-dart-tryjob-access"
@ -169,6 +181,10 @@ realms {
}
realms {
name: "try.shadow"
bindings {
role: "role/buildbucket.builderServiceAccount"
principals: "user:dart-luci-try-builder@dart-ci.iam.gserviceaccount.com"
}
bindings {
role: "role/buildbucket.triggerer"
principals: "group:project-dart-tryjob-access"
@ -189,6 +205,10 @@ realms {
}
realms {
name: "try.shared.shadow"
bindings {
role: "role/buildbucket.builderServiceAccount"
principals: "user:dart-luci-try-builder@dart-ci.iam.gserviceaccount.com"
}
bindings {
role: "role/buildbucket.triggerer"
principals: "group:project-dart-tryjob-access"

51
project.star
View file

@ -85,6 +85,10 @@ luci.bucket(
acls = [
acl.entry(acl.BUILDBUCKET_TRIGGERER, users = [accounts.ci_builder]),
],
constraints = luci.bucket_constraints(
pools = ["luci.dart.ci"],
service_accounts = [accounts.ci_builder],
),
)
luci.bucket(
name = "ci.shadow",
@ -92,12 +96,20 @@ luci.bucket(
acls = [
acl.entry(acl.BUILDBUCKET_TRIGGERER, users = [accounts.ci_builder]),
],
constraints = luci.bucket_constraints(
pools = ["luci.dart.ci"],
service_accounts = [accounts.ci_builder],
),
)
luci.bucket(
name = "ci.sandbox",
acls = [
acl.entry(acl.BUILDBUCKET_TRIGGERER, users = CI_SANDBOX_TRIGGERERS),
],
constraints = luci.bucket_constraints(
pools = ["luci.dart.try", "dart.tests"],
service_accounts = [accounts.try_builder],
),
)
luci.bucket(
name = "ci.sandbox.shadow",
@ -105,6 +117,10 @@ luci.bucket(
acls = [
acl.entry(acl.BUILDBUCKET_TRIGGERER, users = CI_SANDBOX_TRIGGERERS),
],
constraints = luci.bucket_constraints(
pools = ["luci.dart.try", "dart.tests"],
service_accounts = [accounts.try_builder],
),
)
TRY_ACLS = [
acl.entry(
@ -126,6 +142,10 @@ luci.bucket(
],
),
],
constraints = luci.bucket_constraints(
pools = ["luci.dart.try"],
service_accounts = [accounts.try_builder],
),
)
# Shadow bucket for try.
@ -133,6 +153,10 @@ luci.bucket(
name = "try.shadow",
shadows = "try",
acls = TRY_ACLS,
constraints = luci.bucket_constraints(
pools = ["luci.dart.try"],
service_accounts = [accounts.try_builder],
),
)
# Tryjobs specific to the monorepo repo.
@ -149,6 +173,10 @@ luci.bucket(
],
),
],
constraints = luci.bucket_constraints(
pools = ["dart.tests"],
service_accounts = [accounts.try_builder],
),
)
# Shadow bucket for try.monorepo.
@ -165,11 +193,30 @@ luci.bucket(
],
),
],
constraints = luci.bucket_constraints(
pools = ["dart.tests"],
service_accounts = [accounts.try_builder],
),
)
# Tryjobs for all repos.
luci.bucket(name = "try.shared", acls = TRY_ACLS)
luci.bucket(name = "try.shared.shadow", shadows = "try.shared", acls = TRY_ACLS)
luci.bucket(
name = "try.shared",
acls = TRY_ACLS,
constraints = luci.bucket_constraints(
pools = ["luci.dart.try"],
service_accounts = [accounts.try_builder],
),
)
luci.bucket(
name = "try.shared.shadow",
shadows = "try.shared",
acls = TRY_ACLS,
constraints = luci.bucket_constraints(
pools = ["luci.dart.try"],
service_accounts = [accounts.try_builder],
),
)
# Swarming permissions in realms.cfg.