Add Impersonate Service Account argument #2015
Conversation
…st' commands and the required changes to allow for the impersonation of service accounts without the need to change ADC
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
|
+1, this would enable to use impersonation in CI rather than giving the rights directly to the CI service account. |
|
/gcbrun |
| clientConfig.authClient = new Impersonated({ | ||
| sourceClient: authClient, | ||
| targetPrincipal: this.bigQueryCredentials.impersonateServiceAccount, | ||
| targetScopes: ['https://www.googleapis.com/auth/cloud-platform'] |
There was a problem hiding this comment.
Not sure what you would like done here?
There was a problem hiding this comment.
I mean using EXTRA_GOOGLE_SCOPES here instead of hard-coding
|
@wintermi, in the current version tests are failing due to linter checks: output You can check errors using this lint script. |
Resolved conflicts: - cli/index.ts: Kept both impersonate-service-account option (fork feature) and job-labels option (upstream feature) - package.json: Updated glob to ^10.5.0, kept google-auth-library dependency - yarn.lock: Regenerated with updated dependencies
|
Resynced the PR with the latest commit |
Fixed the linter issues |
|
@kolina ready for retesting, thanks |
|
/gcbrun |
| clientConfig.authClient = new Impersonated({ | ||
| sourceClient: authClient, | ||
| targetPrincipal: this.bigQueryCredentials.impersonateServiceAccount, | ||
| targetScopes: ['https://www.googleapis.com/auth/cloud-platform'] |
There was a problem hiding this comment.
I mean using EXTRA_GOOGLE_SCOPES here instead of hard-coding
| } | ||
|
|
||
| private getClient(projectId?: string) { | ||
| private async getClient(projectId?: string) { |
There was a problem hiding this comment.
In #2001 @ashish10alex added support for impersonating a service account through ADC. Will it be enough for your use case or you need an explicit option as well?
If the latter, can you please validate manually that it works?
3 participants
This PR adds an
--impersonate-service-accountargument to therunandtestcommands, along with the required changes to allow for the impersonation of service accounts without the need to change ADC or callgcloudThis would resolve issue #2000 and would be an alternative to solution than PR #2001
Impersonation could then be achieved by executing: