Deck should not require a secret json file to sign URLs

[fejta]

We should be able to use built-in service accounts to sign URLs.
We can also use cookie auth to show private logs.

/assign @fejta @Katharine
/area prow
/area prow/deck
/area prow/spyglass

ref #15806

Some background:

ref googleapis/google-cloud-python#922
ref googleapis/google-cloud-go#1130 (comment)

Problematic area of code:

test-infra/prow/spyglass/gcsartifact_fetcher.go

Lines 166 to 183 in 493406d

	auth := struct {
	Type string `json:"type"`
	PrivateKey string `json:"private_key"`
	ClientEmail string `json:"client_email"`
	}{}
	if err := json.NewDecoder(f).Decode(&auth); err != nil {
	return "", err
	}
	if auth.Type != "service_account" {
	return "", fmt.Errorf("only service_account GCS auth is supported, got %q", auth.Type)
	}
	return storage.SignedURL(bucket, obj, &storage.SignedURLOptions{
	Method: "GET",
	Expires: time.Now().Add(10 * time.Minute),
	GoogleAccessID: auth.ClientEmail,
	PrivateKey: []byte(auth.PrivateKey),
	})
	}

[k8s-ci-robot]

@fejta: The label(s) area/prow/deck/spyglass cannot be applied, because the repository doesn't have them

In response to this:

/assign @fejta @Katharine
/area prow
/area prow/deck
/area prow/deck/spyglass

ref #15806
ref googleapis/google-cloud-python#922

test-infra/prow/spyglass/gcsartifact_fetcher.go

Lines 166 to 183 in 493406d

	auth := struct {
	Type string `json:"type"`
	PrivateKey string `json:"private_key"`
	ClientEmail string `json:"client_email"`
	}{}
	if err := json.NewDecoder(f).Decode(&auth); err != nil {
	return "", err
	}
	if auth.Type != "service_account" {
	return "", fmt.Errorf("only service_account GCS auth is supported, got %q", auth.Type)
	}
	return storage.SignedURL(bucket, obj, &storage.SignedURLOptions{
	Method: "GET",
	Expires: time.Now().Add(10 * time.Minute),
	GoogleAccessID: auth.ClientEmail,
	PrivateKey: []byte(auth.PrivateKey),
	})
	}

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-ci-robot]

@fejta: The label(s) area/prow/deck/spyglass cannot be applied, because the repository doesn't have them

In response to this:

/assign @fejta @Katharine
/area prow
/area prow/deck
/area prow/deck/spyglass

ref #15806

Some background:

ref googleapis/google-cloud-python#922
ref googleapis/google-cloud-go#1130 (comment)

test-infra/prow/spyglass/gcsartifact_fetcher.go

Lines 166 to 183 in 493406d

	auth := struct {
	Type string `json:"type"`
	PrivateKey string `json:"private_key"`
	ClientEmail string `json:"client_email"`
	}{}
	if err := json.NewDecoder(f).Decode(&auth); err != nil {
	return "", err
	}
	if auth.Type != "service_account" {
	return "", fmt.Errorf("only service_account GCS auth is supported, got %q", auth.Type)
	}
	return storage.SignedURL(bucket, obj, &storage.SignedURLOptions{
	Method: "GET",
	Expires: time.Now().Add(10 * time.Minute),
	GoogleAccessID: auth.ClientEmail,
	PrivateKey: []byte(auth.PrivateKey),
	})
	}

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.