tc-logview cannot query mozcloud clusters yet #8478

Activity

1. lotas

   added

   housekeepingEases the development of taskcluster, such as build/test/release automation, development docs, etcEases the development of taskcluster, such as build/test/release automation, development docs, etc

   stabilizationIssues that remove rough edges, deprecations, etc.Issues that remove rough edges, deprecations, etc.

   on Apr 13, 2026
2. lotas

   added this to TC intake boardon Apr 14, 2026
3. lotas

   moved this to Ready in TC intake boardon Apr 14, 2026
4. lotas

   moved this from Ready to pickup to Backlog / Inbox in TC intake boardon Apr 16, 2026
5. lotas commented on Apr 16, 2026

   

   lotas

   on Apr 16, 2026

   ContributorAuthor

   More actions

   To maintain least-privilege without static keys, we could move to an impersonated Service Account (SA) model. This allows the tool to "act as" a scoped identity using the user's active SSO session.

   Technical Strategy:

   • Identity: Provision a dedicated tc-log-reader SA via Terraform.
   • Permissions: Grant the SA roles/logging.viewAccessor and grant roles/iam.serviceAccountTokenCreator on that SA
   • Implementation: Update the Go tool to use google.golang.org/api/impersonate. This allows it to automatically use local Application Default Credentials (ADC) to fetch short-lived tokens.

   TODO List:

   • Terraform: Define the tc-log-reader Service Account in the GPA repo.
   • IAM: Bind logging.viewAccessor to the SA and serviceAccountTokenCreator to the SRE group.
   • Code: Refactor tc-logview to use the Go impersonate package instead of a static JSON path.
   • Setup: Run gcloud auth application-default login --impersonate-service-account=[SA_EMAIL] for local keyless access.
6. lotas

   moved this from Backlog / Inbox to Ready to pickup in TC intake boardon Apr 17, 2026
7. lotas

   moved this from Ready to pickup to In progress in TC intake boardon May 26, 2026
8. lotas

   self-assigned this

   on May 26, 2026
9. lotas commented on May 28, 2026

   

   lotas

   on May 28, 2026

   ContributorAuthor

   More actions

   Added ADC support to allow gcloud auth application-default login as a fallback authentication (no key_path is needed)
   https://github.com/taskcluster/tc-logview/tree/v1.1.0
10. lotas commented on May 28, 2026

    

    lotas

    on May 28, 2026

    ContributorAuthor

    More actions

    Added versioning as well tc-logview version reports current version.. Might be handy as features change over time
11. lotas commented on May 29, 2026

    

    lotas

    on May 29, 2026

    ContributorAuthor

    More actions

    Added also short lived tokens for isolated envs:
    Pre-issued OAuth2 access tokens via the TC_LOGVIEW_ACCESS_TOKEN env var. Intended for containers/agents that should run without access to the host's gcloud session or a long-lived service account key. The host mints a short-lived, SA-scoped token (e.g. gcloud auth print-access-token --impersonate-service-account=<SA>)
12. lotas commented on May 29, 2026

    

    lotas

    on May 29, 2026

    Last edited by lotas

    ContributorAuthor

    More actions

    taskcluster/tc-logview#4 add support for the scoped log view client access tokens

    https://github.com/mozilla/webservices-infra/pull/11197 webservices infra change
13. lotas

    closed this as completedon May 29, 2026
14. github-project-automation

    moved this from In progress to Done in TC intake boardon May 29, 2026