tree c915395e0e1ed31b96fb0cd683517055d2ba949f
parent c3a62a9469129445e4b377946d170a7b4553bc49
author Vadim Shtayura <vadimsh@google.com> 1636727766 +0000
committer Marc-Antoine Ruel <maruel@google.com> 1636727766 +0000

Declare "role/configs.validator" binding.

It defines who is allowed to call LUCI Config validation API to
validate this LUCI project's configs. This is usually done by
presubmit jobs, and thus configs.validator role is assigned to
try job task accounts.

Previously this ACL was defined in the global "config-validation"
group. It is deprecated and being replaced with per-project ACLs
defined in per-project configs (like in this CL).

There's still a global ACL to allow any googler to call
the validation API in any LUCI project they are allowed to see.
Thus the per-project binding applies only to service accounts
(they are not googlers).

Note: this CL was generated semi-automatically and reviewers are
picked automatically based on OWNERS file.

BUG=chromium:1068817
R=kjharland@google.com, maruel@google.com

Change-Id: Ibb5ece819f2d443c1d0521bcb8943559fa6f95d1
Reviewed-on: https://fuchsia-review.googlesource.com/c/infra/config/+/605576
Reviewed-by: Marc-Antoine Ruel <maruel@google.com>