support url-sourced external account #222
Conversation
Hakuyume
force-pushed
the
external-account-url-sourced
branch
2 times, most recently
from
8ca11e5
to
cecc05e
Compare
Hakuyume
force-pushed
the
external-account-url-sourced
branch
from
cecc05e
to
99cea66
Compare
| /// JSON schema of URL-sourced credentials' format. | ||
| #[derive(Serialize, Deserialize, Debug, Clone)] | ||
| #[serde(tag = "type")] | ||
| pub enum UrlCredentialSourceFormat { |
There was a problem hiding this comment.
This enum represents the format of document that the url returns. I avoid UrlFormat since it sounds "the format of url". I don't think UrlCredentialSourceFormat is good. Suggestion welcome.
There was a problem hiding this comment.
Using modules is another option
pub mod credential_source {
pub mod url {
pub enum Format { ... }
}
}
There was a problem hiding this comment.
no I think it's fine the way you've done it
| @@ -47,10 +48,33 @@ pub enum CredentialSource { | |||
| /// file | |||
| file: String, | |||
| }, | |||
| // TODO: Microsoft Azure and URL-sourced credentials | |||
| /// JSON schema of URL-sourced credentials' format. | ||
| #[derive(Serialize, Deserialize, Debug, Clone)] | ||
| #[serde(tag = "type")] | ||
| pub enum UrlCredentialSourceFormat { |
There was a problem hiding this comment.
no I think it's fine the way you've done it
| @@ -72,6 +101,39 @@ impl ExternalAccountFlow { | |||
| { | |||
| let subject_token = match &self.secret.credential_source { | |||
| CredentialSource::File { file } => tokio::fs::read_to_string(file).await?, | |||
| CredentialSource::Url { | |||
There was a problem hiding this comment.
this looks good to me, have you tested it in a real deployment? Unfortunately I don't have the means to do it myself, lacking an appropriate cloud environment.
There was a problem hiding this comment.
I confirmed this code works for my case (workload identity federation in github actions).
This PR adds url-sourced external account (describe in
https://google.aip.dev/auth/4117#determining-the-subject-token-in-microsoft-azure-and-url-sourced-credentials ).