Add support for external IdP OIDC token retrieval for Google Cloud Operators. #39873
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
boring-cyborg
bot
added
area:providers
provider:google
dybolo
force-pushed
the
google_cloud_extra_auth
branch
from
15f5961 to
8c027c9
Compare
|
@VladaZakharova -> maybe your team can review it ? |
yes, sure! |
moiseenkov
reviewed
Jun 3, 2024
|
Does it look good @moiseenkov ? Also @dybolo - you need to resolve conflicts now. |
dybolo
force-pushed
the
google_cloud_extra_auth
branch
from
35fb452 to
a509d85
Compare
using OAuth2.0 Crient Credentials Grant for Google Cloud Operators. This feature enables OIDC token retrieval from any generic Identity Provider (IdP) that uses the OAuth 2.0 Credentials Grant Flow. Additionally, it lays the groundwork for integrating other custom OIDC token retrieval methods. related: apache#35899 Co-authored-by: Gonçalo Azevedo <goncalo.r.azevedo@tecnico.ulisboa.pt>
dybolo
force-pushed
the
google_cloud_extra_auth
branch
from
a509d85 to
cee623c
Compare
moiseenkov
reviewed
Jun 10, 2024
moiseenkov
approved these changes
Jun 11, 2024
potiuk
approved these changes
Jun 11, 2024
potiuk
added a commit
to potiuk/airflow
that referenced
this pull request
Jun 12, 2024
The apache#39873 added an implicit dependency to google auth > 2.29.0 because it uses SubjectTokenSupplier added in that version. Our "Lowest-direct" tests caught it (yay!) so we should add the min requirement to the dependency.
potiuk
added a commit
that referenced
this pull request
Jun 12, 2024
The #39873 added an implicit dependency to google auth > 2.29.0 because it uses SubjectTokenSupplier added in that version. Our "Lowest-direct" tests caught it (yay!) so we should add the min requirement to the dependency.
96 tasks
romsharon98
pushed a commit
to romsharon98/airflow
that referenced
this pull request
Jul 26, 2024
…erators. (apache#39873) * Add support for external IdP OIDC token retrieval using OAuth2.0 Crient Credentials Grant for Google Cloud Operators. This feature enables OIDC token retrieval from any generic Identity Provider (IdP) that uses the OAuth 2.0 Credentials Grant Flow. Additionally, it lays the groundwork for integrating other custom OIDC token retrieval methods. related: apache#35899 Co-authored-by: Gonçalo Azevedo <goncalo.r.azevedo@tecnico.ulisboa.pt> --------- Co-authored-by: Gonçalo Azevedo <goncalo.r.azevedo@tecnico.ulisboa.pt>
romsharon98
pushed a commit
to romsharon98/airflow
that referenced
this pull request
Jul 26, 2024
The apache#39873 added an implicit dependency to google auth > 2.29.0 because it uses SubjectTokenSupplier added in that version. Our "Lowest-direct" tests caught it (yay!) so we should add the min requirement to the dependency.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This feature enables OIDC token retrieval from any generic Identity Provider (IdP) that uses the OAuth 2.0 Credentials Grant Flow. Additionally, it lays the groundwork for integrating other custom OIDC token retrieval methods.
Google SDK supports defining custom classes for retrieving OIDC tokens for authentication via Workload Identity Federation. This pull request introduces a class that implements this functionality using Credentials Grant Flow and implements a caching mechanism, which can be extended to new classes.
related: #35899
Co-authored-by: @gazev