keze commented on a change in pull request #19164:
URL: https://github.com/apache/airflow/pull/19164#discussion_r736314685
##########
File path: airflow/providers/google/cloud/utils/credentials_provider.py
##########
@@ -283,6 +289,31 @@ def _get_credentials_using_key_path(self):
project_id = credentials.project_id
return credentials, project_id
+ def _get_credentials_using_key_secret_name(self):
+ self._log_debug('Getting connection using JSON key data from GCP
secret: %s', self.key_secret_name)
+
+ # Use ADC to access GCP Secret Manager.
+ adc_credentials, adc_project_id =
google.auth.default(scopes=self.scopes)
+ secret_manager_client =
_SecretManagerClient(credentials=adc_credentials)
Review comment:
> These configuration options are mainly intended for non-GCP
environments where you do not have access to the GCP metaserver.
I understand this point, but that is interface we allowed our users to use.
One huge customer has its own access control management service (general, not
just for airflow) and they want to plug it in and don't want to expose
insecurely keys, which makes sense.
As for impersonation, that is completely other topic, we have plan to fix
it, it is in our backlog.
Using [Google Cloud Secret Manager
Backend](http://airflow.apache.org/docs/apache-airflow-providers-google/stable/secrets-backends/google-cloud-secret-manager-backend.html)
instead of `SecretManagerClient` is not possible because it would create
infinite recursion of calls of `get_credentials_and_project_id`
https://github.com/apache/airflow/blob/cdbb481338f8a93290e9ca308bf111c3a30fa6ce/airflow/providers/google/cloud/secrets/secret_manager.py#L105
Actually, Google Cloud Secret Manager Backend under the hood uses
`SecretManagerClient` in the same way. so this implementation reduces
unnecessary coupling
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
