roles: add more pre-defined roles to audit.viewer and prow.viewer

[spiffxp]

This will hopefully address the audit job not seeing all bigquery assets: #2029 (comment)

For audit.viewer...

Include permissions from service-specific viewer roles based on a survey of services that are active across the organization:

• roles/bigquery.metadataViewer
• roles/bigquery.resourceViewer
• roles/cloudkms.publicKeyViewer
• roles/container.clusterViewer
• roles/logging.viewer # see note below
• roles/monitoring.viewer
• roles/pubsub.viewer

NOTE: the logging.queries.* permissions that would normally come in from roles/logging.viewer have been excluded, to prevent auditors from modifying existing logging queries in projects

Add TODO's for two services we should audit, but may need to avoid if there are potentially sensitive values accidentally stored in configuration-related resources:

• roles/cloudbuild.builds.viewer
• roles/run.viewer

Rephrase TODO for serviceusage role. We should really stop applying it at the organization level.

For prow.viewer, add:

• roles/browser
• roles/pubsub.viewer
• roles/secretmanager.viewer

[spiffxp]

/cc @hh @bernokl
/cc @dims @ameukam

[k8s-ci-robot]

@spiffxp: GitHub didn't allow me to request PR reviews from the following users: bernokl.

Note that only kubernetes members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

/cc @hh @bernokl
/cc @dims @ameukam

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[spiffxp]

/hold
Going to deploy this and then verify whether this addresses the bigquery access issue for the audit job

[spiffxp]

Ran ./infra/gcp/ensure-organization.sh and role updates are deployed

Using #2100 to test

[spiffxp]

/hold cancel
I think this should work, but may also need a bugfix in #2100 to merge to fully close out

[dims]

/approve
/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dims, spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [dims,spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[cpanato]

late /lgtm