New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 865113 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Last visit > 30 days ago
Closed: Aug 17
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 1
Type: Bug



Sign in to add a comment

Add findit account to project-chromium-ci-task-accounts auth group

Project Member Reported by robert...@chromium.org, Jul 18

Issue description

Needed to fix: https://luci-scheduler.appspot.com/jobs/chromium/export-bot-db-to-findit-gs

Findit's service account for builder linux_chromium_bot_db_exporter under the luci.chromium.ci bucket: findit-builder@chops-service-accounts.iam.gserviceaccount.com
 
I misread that, you want findit task account in luci.chromium.ci bucket. that's a chrome-infra-auth change.
Owner: hinoka@chromium.org
Status: Fixed (was: Untriaged)
Added, try again.
Owner: robert...@chromium.org
Status: Assigned (was: Fixed)
So it turns out a task account can't belong to more than one pool, since it defeats all sort of assumptions.
Explanation here:
https://chrome-internal.googlesource.com/infradata/config/+/master/configs/luci-token-server/service_accounts.cfg#6

Can you move linux_chromium_bot_db_exporter to one of the findit buckets?
An account can be shared by multiple pools, but it is undesirable (if avoidable). Let me know if its absolutely impossible to move linux_chromium_bot_db_exporter to findit bucket, I'll help with setting up account sharing.

Another option it just to use chromium-ci-builder@chops-service-accounts.iam.gserviceaccount.com account already present on chromium.ci pool.
Status: Fixed (was: Assigned)

Sign in to add a comment