feat: Add support for Agent Identity bound tokens - #1821
Conversation
Sorry, something went wrong.
This change introduces support for requesting certificate-bound access tokens for Agent Identities on GKE and Cloud Run.
| has_logged_warning = True | ||
| pass | ||
|
|
||
| time.sleep(interval) |
There was a problem hiding this comment.
This doesn't matter at all, but I think the sleep could be inside the except, to remove that pass
Sorry, something went wrong.
There was a problem hiding this comment.
Thanks for the suggestion! I've kept the time.sleep() outside the except block to handle two
distinct scenarios while polling for the certificate:
- The certificate configuration file (GOOGLE_API_CERTIFICATE_CONFIG) is not yet available. This
triggers the except block. - The configuration file is available, but the certificate file path specified inside it is not
yet on the filesystem. This case does not trigger an exception.
In both scenarios, we need to pause and retry. If we move the sleep into the except block, there won't be any pause and sleep for the second scenario would .
I've added a comment to the code to make this polling logic clearer for future developers.
Sorry, something went wrong.
| try: | ||
| from cryptography import x509 | ||
| from cryptography.x509.oid import ExtensionOID | ||
| except ImportError: |
There was a problem hiding this comment.
Do we have any tests that try running these functions without cryptography imported?
I don't really have enough context to know if that would be necessary, but IIRC I think it's pretty easy to un-import for specific test functions, so maybe consider if it would be
Sorry, something went wrong.
There was a problem hiding this comment.
Done!
Sorry, something went wrong.
| ) | ||
| assert not _agent_identity_utils._is_agent_identity_certificate(mock_cert) | ||
|
|
||
| def test__is_agent_identity_certificate_not_spiffe_uri(self): |
There was a problem hiding this comment.
| def test__is_agent_identity_certificate_not_spiffe_uri(self): | |
| def test_is_agent_identity_certificate_not_spiffe_uri(self): |
Sorry, something went wrong.
|
|
||
| @mock.patch("google.auth._agent_identity_utils.parse_certificate") | ||
| @mock.patch("google.auth._agent_identity_utils.get_agent_identity_certificate_path") | ||
| def test_get_and_parse_agent_identity_certificate_success( |
There was a problem hiding this comment.
Lets add a test case to simulate a sequence of failures followed by success:
Iteration 1: os.path.exists(config) -> False
Iteration 2: os.path.exists(config) -> True, but open() raises IOError (incomplete write).
Iteration 3: open() succeeds, but json.load raises ValueError (malformed JSON).
Iteration 4: Everything succeeds.
Assert that get_agent_identity_certificate_path returns successfully after these 4 attempts
Sorry, something went wrong.
daniel-sanche
left a comment
There was a problem hiding this comment.
LGTM
Sorry, something went wrong.
|
Added do not merge, for now, so this can be tested before release. We plan to merge this around early December |
Sorry, something went wrong.
…ate mismatches with retries (#1890) This PR includes adding changes which are for - - Adding support for Agent Identity bound tokens which will be used for Agent Identity (#1821) - Adding the retry logic when certificates mismatch for credentials used for Agent Identities on GKE and Cloud Run Workloads. (#1841) --------- Signed-off-by: Radhika Agrawal <agrawalradhika@google.com> Co-authored-by: nbayati <99771966+nbayati@users.noreply.github.com> Co-authored-by: Andy Zhao <andyzhao@google.com> Co-authored-by: Daniel Sanche <d.sanche14@gmail.com>
…ate mismatches with retries (#1890) This PR includes adding changes which are for - - Adding support for Agent Identity bound tokens which will be used for Agent Identity (googleapis/google-auth-library-python#1821) - Adding the retry logic when certificates mismatch for credentials used for Agent Identities on GKE and Cloud Run Workloads. (googleapis/google-auth-library-python#1841) --------- Signed-off-by: Radhika Agrawal <agrawalradhika@google.com> Co-authored-by: nbayati <99771966+nbayati@users.noreply.github.com> Co-authored-by: Andy Zhao <andyzhao@google.com> Co-authored-by: Daniel Sanche <d.sanche14@gmail.com>
This change introduces support for requesting certificate-bound access tokens for Agent Identities on GKE and Cloud Run. The design doc: go/sdk-agent-identity