feat(bigquery): support GCP workload identity - #4607
Conversation
|
jkaflik
left a comment
jkaflik
left a comment
There was a problem hiding this comment.
Review follow-ups addressed.
|
Published the current PR head ( Customer Docker workflow completed successfully. Images are available with the tags |
| workloadIdentityTokenFileEnv: "/token", | ||
| } | ||
| config, err := resolveWorkloadIdentityDeploymentConfig(t.Context(), workloadIdentityConfigSource{ | ||
| lookupEnv: func(name string) (string, bool) { |
There was a problem hiding this comment.
Looks a bit strange to thread a stdlib function as a callback. Can the same be achieved with t.Setenv()?
| projectID func(context.Context) (string, error) | ||
| instanceAttributeValue func(context.Context, string) (string, error) |
There was a problem hiding this comment.
Have you explored GCE_METADATA_HOST? Callbacks are a bit hard on the brain
2 participants
Problem
BigQuery peers currently require long-lived service-account keys. ClickPipes needs a keyless mode where a single-tenant PeerDB deployment uses its projected Kubernetes token to impersonate its deployment-scoped tenant GSA.
Solution
service_account_workload_identitythrough the existing BigQueryauth_typefieldTarget service account and cluster context remain deployment configuration; peers only select the authentication mode.