Change the pool of machines to run webrtc bots with led.

Change-Id: I1df43c7ec4f314b42b6f93922fcdd482d687de39
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6574396
Reviewed-by: Ilya Nikolaevskiy <ilnik@chromium.org>
Commit-Queue: Jeremy Leconte <jleconte@google.com>
Cr-Commit-Position: refs/heads/main@{#1463351}

infra/config/generated/luci/cr-buildbucket.cfg

@@ -134260,7 +134260,8 @@ buckets {
     }
   }
   constraints {
-    pools: "luci.webrtc.ci"
+    pools: "luci.chromium.webrtc"
+    service_accounts: "chromium-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
     service_accounts: "webrtc-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
   }
 }
@@ -135380,11 +135381,22 @@ buckets {
       }
     }
   }
+  shadow: "webrtc.fyi.shadow"
   constraints {
-    pools: "luci.webrtc.ci"
+    pools: "luci.chromium.webrtc.fyi"
+    service_accounts: "chromium-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
     service_accounts: "webrtc-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
   }
 }
+buckets {
+  name: "webrtc.fyi.shadow"
+  constraints {
+    pools: "luci.chromium.webrtc.fyi"
+    service_accounts: "chromium-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+    service_accounts: "webrtc-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+  }
+  dynamic_builder_template {}
+}
 common_config {
   builds_notification_topics {
     name: "projects/findit-for-me/topics/buildbucket_notification"

infra/config/generated/luci/realms.cfg

@@ -812,6 +812,10 @@ realms {
     role: "role/scheduler.owner"
     principals: "group:project-webrtc-admins"
   }
+  bindings {
+    role: "role/swarming.poolUser"
+    principals: "group:project-webrtc-admins"
+  }
   bindings {
     role: "role/swarming.taskTriggerer"
     principals: "group:project-webrtc-admins"
@@ -858,6 +862,10 @@ realms {
     role: "role/scheduler.owner"
     principals: "group:project-webrtc-admins"
   }
+  bindings {
+    role: "role/swarming.poolUser"
+    principals: "group:project-webrtc-admins"
+  }
   bindings {
     role: "role/swarming.taskTriggerer"
     principals: "group:project-webrtc-admins"
@@ -877,3 +885,15 @@ realms {
     }
   }
 }
+realms {
+  name: "webrtc.fyi.shadow"
+  bindings {
+    role: "role/buildbucket.builderServiceAccount"
+    principals: "user:chromium-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+    principals: "user:webrtc-ci-builder@chops-service-accounts.iam.gserviceaccount.com"
+  }
+  bindings {
+    role: "role/buildbucket.creator"
+    principals: "group:project-webrtc-led-users"
+  }
+}

infra/config/subprojects/webrtc/webrtc.fyi.star

@@ -11,8 +11,11 @@ load("//lib/xcode.star", "xcode")
 luci.bucket(
     name = "webrtc.fyi",
     constraints = luci.bucket_constraints(
-        pools = ["luci.webrtc.ci"],
-        service_accounts = ["webrtc-ci-builder@chops-service-accounts.iam.gserviceaccount.com"],
+        pools = ["luci.chromium.webrtc.fyi"],
+        service_accounts = [
+            "chromium-ci-builder@chops-service-accounts.iam.gserviceaccount.com",
+            "webrtc-ci-builder@chops-service-accounts.iam.gserviceaccount.com",
+        ],
     ),
     bindings = [
         luci.binding(
@@ -38,6 +41,10 @@ luci.bucket(
             roles = "role/scheduler.owner",
             groups = "project-webrtc-admins",
         ),
+        luci.binding(
+            roles = "role/swarming.poolUser",
+            groups = "project-webrtc-admins",
+        ),
         luci.binding(
             roles = "role/swarming.taskTriggerer",
             groups = "project-webrtc-admins",
@@ -45,6 +52,29 @@ luci.bucket(
     ],
 )
 
+# Define the shadow bucket of `webrtc.fyi`.
+luci.bucket(
+    name = "webrtc.fyi.shadow",
+    shadows = "webrtc.fyi",
+    # Only the builds with allowed pool and service account can be created
+    # in this bucket.
+    constraints = luci.bucket_constraints(
+        pools = ["luci.chromium.webrtc.fyi"],
+        service_accounts = [
+            "chromium-ci-builder@chops-service-accounts.iam.gserviceaccount.com",
+            "webrtc-ci-builder@chops-service-accounts.iam.gserviceaccount.com",
+        ],
+    ),
+    bindings = [
+        # for led permissions.
+        luci.binding(
+            roles = "role/buildbucket.creator",
+            groups = "project-webrtc-led-users",
+        ),
+    ],
+    dynamic = True,
+)
+
 luci.gitiles_poller(
     name = "webrtc-gitiles-trigger",
     bucket = "webrtc",

infra/config/subprojects/webrtc/webrtc.star

@@ -10,8 +10,11 @@ load("//lib/targets.star", "targets")
 luci.bucket(
     name = "webrtc",
     constraints = luci.bucket_constraints(
-        pools = ["luci.webrtc.ci"],
-        service_accounts = ["webrtc-ci-builder@chops-service-accounts.iam.gserviceaccount.com"],
+        pools = ["luci.chromium.webrtc"],
+        service_accounts = [
+            "chromium-ci-builder@chops-service-accounts.iam.gserviceaccount.com",
+            "webrtc-ci-builder@chops-service-accounts.iam.gserviceaccount.com",
+        ],
     ),
     bindings = [
         luci.binding(
@@ -37,6 +40,10 @@ luci.bucket(
             roles = "role/scheduler.owner",
             groups = "project-webrtc-admins",
         ),
+        luci.binding(
+            roles = "role/swarming.poolUser",
+            groups = "project-webrtc-admins",
+        ),
         luci.binding(
             roles = "role/swarming.taskTriggerer",
             groups = "project-webrtc-admins",