Create a prow.viewer custom org role

[spiffxp]

I want to empower others to see and troubleshoot whatever resources
constraints (or lack thereof) the release-blocking jobs are running under

Members of the k8s-infra-prow-viewers@kubernetes.io get this role on
projects related to prow

The role is a composite of:

• roles/compute.viewer
• roles/container.viewer
• roles/logging.viewer
• roles/monitoring.view

It's defined by a file and will be updated anytime
infra/gcp/ensure-e2e-projects.sh is run

I've currently manually created it and applied it to the
k8s-infra-prow-build project to verify access to expected resources

Members who have this role should be able to see two custom cloud
monitoring dashboards:

• https://console.cloud.google.com/monitoring/dashboards/custom/10510319052103514664?project=k8s-infra-prow-build&timeDomain=6h&authuser=1
• https://console.cloud.google.com/monitoring/dashboards/custom/10925237040785467832?authuser=1&project=k8s-infra-prow-build&timeDomain=6h

[spiffxp]

/cc @BenTheElder @liggitt
In case you have suggestions on what else people should be able to see

[BenTheElder]

cluster view maybe?

[thockin]

Could do with comments

[thockin]

This all LGTM. I have waffled in my head about using custom roles more. It would clearly simplify a lot of logic, but the fact that you have to expand premade roles like compute.viewer into their constituent parts, means that any further updates to that role will not automatically propagate to this role.

It's probably fine in practice, it's just distasteful to me.

[thockin]

/approve
/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: spiffxp, thockin

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [spiffxp,thockin]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dims]

@spiffxp i can confirm that i can see both dashboard! (had to drop the authuser=1 from the url though)

[spiffxp]

you have to expand premade roles like compute.viewer into their constituent parts

I wasn't thrilled by this either. I didn't script creation of this role, which would be the next logical step. Could periodically re-run that script to re-generate the role, so updates would propagate, but on a schedule of our own making.

I'll address the lack of comments in a followup, thanks.

[spiffxp]

Ran ./infra/gcp/ensure-e2e-projects.sh