oscerd opened a new pull request, #28157:
URL: https://github.com/apache/camel/pull/28157
`GoogleCredentialsHelper.getCredentials()` already supports Workload
Identity Federation (an `external_account`
credential configuration file, or the Application Default Credentials) and
service account impersonation
(`ImpersonatedCredentials`), but no component exposed the switches:
`useWorkloadIdentityFederation`,
`workloadIdentityConfig` and `impersonatedServiceAccount` exist only as
default methods of `GoogleCommonConfiguration`
returning `false`/`null`, so that branch was never reached (see the analysis
on the Jira, and CAMEL-24521 for the
related docs fix in #25809).
This PR adds the three options to the `google-storage` endpoint:
- `useWorkloadIdentityFederation` - authenticate with Workload Identity
Federation instead of a service account key.
- `workloadIdentityConfig` - the credential configuration file (classpath:,
file:, http: or https:), such as the one
`gcloud iam workload-identity-pools create-cred-config` generates for AWS,
Azure or an OIDC provider. When not set,
the Application Default Credentials are used, which detect Workload
Identity on GKE.
- `impersonatedServiceAccount` - a service account to impersonate with the
federated credentials.
### Changes
- `GoogleCloudStorageConfiguration`: the three `@UriParam` options (label
`security`) overriding the
`GoogleCommonConfiguration` defaults; regenerated metadata, catalog and
endpoint DSL.
- `google-storage-component.adoc`: a "Workload Identity Federation" section.
### Tests
- `GoogleCloudStorageWorkloadIdentityTest`: the endpoint binds the options
(they were rejected as unknown parameters
before); the credentials of a Storage endpoint come from the configuration
file (`ExternalAccountCredentials`); with
`impersonatedServiceAccount` they are `ImpersonatedCredentials` for that
account, with the federated credentials as
source. No network access: the credentials are only built.
- `camel-google-storage`: 64 tests, 0 failures.
- Full reactor `mvn clean install -DskipTests -DskipITs`: 706/706, only the
expected regenerated files (component metadata,
catalog, component and endpoint DSL).
The other Google components that use `GoogleCredentialsHelper` (for example
CAMEL-17368 for functions) can get the same
options in follow-ups.
JIRA: https://issues.apache.org/jira/browse/CAMEL-17369
_Claude Code on behalf of Andrea Cosentino (@oscerd)_
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
