Closed man8pr closed 7 months ago
Attention: 23 lines
in your changes are missing coverage. Please review.
Comparison is base (
b31f543
) 63.52% compared to head (7a4f527
) 60.06%.
:exclamation: Your organization needs to install the Codecov GitHub app to enable full functionality.
:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.
I think the scope of this PR is pretty vague, will we need both
getServiceAccount
andgetOrCreateServiceAccount
? I agree with @paullatzelsperger thatApplicationDefaultCredentials
scope is also misleading... you say that you introduced for testing reasons, but in fact it is part of the public API of theIamServiceImpl
.my suggestion would be to rephrase this PR as it is seen from the perspective of the caller (the provisioner, according to the description), that will help defining clearer interfaces and setting up the correct testing boundaries
Agreed and I will create an interface for ApplicationDefaultCredentials, and then an inner class for implementing it. Regarding the scope, I am currently keeping both the getServiceAccount and getOrCreateServiceAccount, but plan to send another PR immediately after this one to remove the getOrCreateServiceAccount, because the provisioner will only use the former.
as I said I see no end-to-end endeavor, is not clear who will use these new methods and how, they are dead code currently.
please start from the provisioner point of view, and, if that will become too broad to be coded in a single PR, please provide an explanation on how this will result at the end.
SG I will update the PR and add the Provisioner perspective with an additional commit
What this PR changes/adds
IAM interface allows to use ADC or existing service account to generate access tokens, instead of creating and deleting new service accounts for this purpose. GCS provisioner adapted to make use of the new functions provided by IAM.
Why it does that
The change avoids delays in the propagation of permissions to newly created service accounts.
Note
When using Application Default Credentials (i.e. when a service account is not specified), avoid user credentials and select the appropriate service account, http://cloud.google.com/docs/authentication/external/set-up-adc-on-cloud
Linked Issue(s)
Closes #110 #118