[
https://issues.apache.org/jira/browse/CAMEL-17369?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18108750#comment-18108750
]
Andrea Cosentino commented on CAMEL-17369:
------------------------------------------
While auditing the camel-google modules I checked how far Workload Identity
Federation actually got, since {{GoogleCredentialsHelper}} already contains the
plumbing for it.
The helper supports it (external-account credentials from a WIF config file,
plus {{ImpersonatedCredentials}} wrapping), but *no component exposes the
switches*: {{useWorkloadIdentityFederation}}, {{workloadIdentityConfig}} and
{{impersonatedServiceAccount}} exist only as default methods on
{{GoogleCommonConfiguration}} returning false/null. No component overrides
them, none declares a matching {{@UriParam}}, and no catalog JSON lists them,
so {{config.isUseWorkloadIdentityFederation()}} is always false and the WIF
branch is unreachable.
So what remains for this issue is the wiring, not the credential code. Note
also that the *GKE* case already works today through the plain ADC fallback
({{GoogleCredentials.getApplicationDefault()}} detects GKE Workload Identity
itself) - what is missing is the explicit WIF config file and impersonation.
Filed CAMEL-24521 for the related problem that the google-pubsub docs already
advertise this for all Google components and show setter calls that do not
exist.
_Claude Code on behalf of oscerd_
> Camel-google-storage - Support GKE's workload identity
> ------------------------------------------------------
>
> Key: CAMEL-17369
> URL: https://issues.apache.org/jira/browse/CAMEL-17369
> Project: Camel
> Issue Type: Improvement
> Components: camel-google
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
> Fix For: 4.x
>
>
> Like CAMEL-16883
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
