search

GoogleCloudPlatform / cloud-run-proxy

Local proxy for authenticating requests to Cloud Run
Apache License 2.0
127 stars 20 forks source link

Add support for pulling ID Tokens from the metadata server #8

Closed sethvargo closed 2 years ago

sethvargo commented 2 years ago

This adds support for cloud-run-proxy to pull ID Tokens from the metadata server instead of always assuming gcloud. This means it will work on a GCE VM or Cloud Run service.

However, this requires a user to specify an audience value for the JWT. When using the gcloud token, Cloud Run trusts the gcloud client IDs as valid aud values, but the only truly accepted value is the URL of the server. That's fine - we have the URL of the service because we need it to proxy, but it does introduce an edge case where a Cloud Run service is fronted by a Load Balancer and the Load Balancer is serving a vanity URL. In this case, the user must specify the "host" value as the Load Balancer DNS entry, but the "audience" value must be the .run.app URL.

sethvargo commented 2 years ago

@yanweiguo updated

yanweiguo commented 2 years ago

Left one more comment. LGTM