tc-logview cannot query mozcloud clusters yet

[lotas]

After switching to MozCloud deployments, fx-ci and community-tc logs can no longer be easily queried using tc-logview that had serviceAccount in a different GCP project.

TODO: find a way to create log-reader SA in new gcp project

[lotas]

To maintain least-privilege without static keys, we could move to an impersonated Service Account (SA) model. This allows the tool to "act as" a scoped identity using the user's active SSO session.

Technical Strategy:

• Identity: Provision a dedicated tc-log-reader SA via Terraform.
• Permissions: Grant the SA roles/logging.viewAccessor and grant roles/iam.serviceAccountTokenCreator on that SA
• Implementation: Update the Go tool to use google.golang.org/api/impersonate. This allows it to automatically use local Application Default Credentials (ADC) to fetch short-lived tokens.

TODO List:

• Terraform: Define the tc-log-reader Service Account in the GPA repo.
• IAM: Bind logging.viewAccessor to the SA and serviceAccountTokenCreator to the SRE group.
• Code: Refactor tc-logview to use the Go impersonate package instead of a static JSON path.
• Setup: Run gcloud auth application-default login --impersonate-service-account=[SA_EMAIL] for local keyless access.

[lotas]

Added ADC support to allow gcloud auth application-default login as a fallback authentication (no key_path is needed)
https://github.com/taskcluster/tc-logview/tree/v1.1.0

[lotas]

Added versioning as well tc-logview version reports current version.. Might be handy as features change over time

[lotas]

Added also short lived tokens for isolated envs:
Pre-issued OAuth2 access tokens via the TC_LOGVIEW_ACCESS_TOKEN env var. Intended for containers/agents that should run without access to the host's gcloud session or a long-lived service account key. The host mints a short-lived, SA-scoped token (e.g. gcloud auth print-access-token --impersonate-service-account=<SA>)

[lotas]

taskcluster/tc-logview#4 add support for the scoped log view client access tokens

https://github.com/mozilla/webservices-infra/pull/11197 webservices infra change