Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: support both identity and token source for gke metadata server mode #286

Merged
merged 6 commits into from
Jul 26, 2024
+34 −5
Merged

feat: support both identity and token source for gke metadata server mode #286

Changes from 2 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
fe16b85
feat: use token or identity source for gke metadata server use case
nicolas-vivot Jul 18, 2024
bc3c2d9
chore: doc and cleanup
nicolas-vivot Jul 18, 2024
0f4064c
feat: introduce use_id_token configuration
nicolas-vivot Jul 24, 2024
3be8756
chore: update auth setup with defaults for other client types
nicolas-vivot Jul 25, 2024
3cf4a36
chore: fix tests
nicolas-vivot Jul 25, 2024
322445d
chore: clippy and small refactoring
nicolas-vivot Jul 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 26 additions & 5 deletions foundation/auth/src/project.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ use google_cloud_metadata::on_gce;
use crate::credentials::CredentialsFile;
use crate::misc::EMPTY;
use crate::token_source::authorized_user_token_source::UserAccountTokenSource;
use crate::token_source::compute_identity_source::ComputeIdentitySource;
use crate::token_source::compute_token_source::ComputeTokenSource;
use crate::token_source::reuse_token_source::ReuseTokenSource;
use crate::token_source::service_account_token_source::OAuth2ServiceAccountTokenSource;
Expand Down Expand Up @@ -89,18 +90,38 @@ pub async fn create_token_source_from_credentials(
Ok(Box::new(ReuseTokenSource::new(ts, token)))
}

/// Creates token source using gke metadata server.
///
/// Will use the audience if provided, generating an identity token source.
/// Otherwise, will use the scopes if provided, generating an access token source.
///
/// Returns an error if neither audience nor scopes are provided, or if any technical error occurs.
pub async fn create_token_source_from_metadata_server(config: &Config<'_>,) -> Result<Box<dyn TokenSource>, error::Error> {
match config.audience {
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In google-cloud-pubsub and others, since the audience is set when the client is generated, this application will force the idtoken.
We checked google-cloud-go and did not see any use of idtoken, so we would like to position this as an option.

pub async fn create_token_source_from_project(
    project: &Project,
    config: Config<'_>,
) -> Result<Box<dyn TokenSource>, error::Error> {
    match project {
        Project::FromFile(file) => {
            if config.use_id_token {
                id_token_source_from_credentials(Default::default(), file, config.audience.unwrap_or_default()).await
            }else {
                create_token_source_from_credentials(file, &config).await
            }
        },
        Project::FromMetadataServer(_) => {
            let ts = if config.use_id_token {
                ComputeIdentitySource::new(&config.audience.unwrap_or_default())?
            }else {
                ComputeTokenSource::new(&config.scopes_to_string(","))?
            };
            let token = ts.token().await?;
            Ok(Box::new(ReuseTokenSource::new(Box::new(ts), token)))
        }
    }
}

How about the following code? This would allow the use of idtoken even when credentials are used.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds good to me.
I will update based on your feedback and test it by tomorrow.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested. No issue found.

My tests covered both authentication tokens (OAuth and ID) from GKE, for in-house target services (cross project cloud run through PSC setup) as well as same project/cross project Google Cloud APIs (Vertex endpoints for example)

Some(audience) => {
let ts = ComputeIdentitySource::new(audience)?;
let token = ts.token().await?;
Ok(Box::new(ReuseTokenSource::new(Box::new(ts), token)))
},
None => {
if config.scopes.is_none() {
return Err(error::Error::ScopeOrAudienceRequired);
}
let ts = ComputeTokenSource::new(&config.scopes_to_string(","))?;
let token = ts.token().await?;
Ok(Box::new(ReuseTokenSource::new(Box::new(ts), token)))
}
}
}

/// create_token_source_from_project creates the token source.
pub async fn create_token_source_from_project(
project: &Project,
config: Config<'_>,
) -> Result<Box<dyn TokenSource>, error::Error> {
match project {
Project::FromFile(file) => create_token_source_from_credentials(file, &config).await,
Project::FromMetadataServer(_) => {
let ts = ComputeTokenSource::new(&config.scopes_to_string(","))?;
let token = ts.token().await?;
Ok(Box::new(ReuseTokenSource::new(Box::new(ts), token)))
}
Project::FromMetadataServer(_) => create_token_source_from_metadata_server(&config).await,
}
}

Expand Down