This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 763b0f94bb0c CAMEL-24521: camel-google-pubsub - document the
authentication that actually works (#25809)
763b0f94bb0c is described below
commit 763b0f94bb0c884488dda1ea4d1290dd6be30590
Author: Andrea Cosentino <[email protected]>
AuthorDate: Thu Aug 27 14:44:18 2026 +0200
CAMEL-24521: camel-google-pubsub - document the authentication that
actually works (#25809)
The Workload Identity Federation section claimed that all Google components
support WIF and showed setUseWorkloadIdentityFederation,
setWorkloadIdentityConfig
and setImpersonatedServiceAccount calls. Those setters do not exist: the
three
accessors are default methods on GoogleCommonConfiguration returning
false/null,
no component overrides them or declares a matching option, so the samples
do not
compile and the WIF branch of GoogleCredentialsHelper is never entered.
What the section got right is the GKE case, and for a different reason than
it
gave: the plain Application Default Credentials fallback resolves the
identity
attached to the workload by itself. That is what the section now describes,
with
a note that configuring an external identity provider or impersonation is
not
exposed as an endpoint option.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Signed-off-by: Andrea Cosentino <[email protected]>
---
.../catalog/docs/google-pubsub-component.adoc | 39 ++++++++--------------
.../src/main/docs/google-pubsub-component.adoc | 39 ++++++++--------------
2 files changed, 26 insertions(+), 52 deletions(-)
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/google-pubsub-component.adoc
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/google-pubsub-component.adoc
index d1c93f3d4aff..3f9869e6352b 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/google-pubsub-component.adoc
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/google-pubsub-component.adoc
@@ -178,40 +178,27 @@ By default, this component acquires credentials using
`GoogleCredentials.getAppl
This behavior can be disabled by setting _authenticate_ option to `false`, in
which case requests to Google API will be made without authentication details.
This is only desirable when developing against an emulator.
This behavior can be altered by supplying a path to a service account key file.
-==== Workload Identity Federation (WIF)
+==== Workload Identity on GKE and other Google-managed environments
-All Google components support
https://cloud.google.com/iam/docs/workload-identity-federation[Workload
Identity Federation], which enables workloads running outside of Google Cloud
(e.g., on AWS, Azure, GitHub Actions) or on GKE to authenticate without service
account key files.
+Because the default is Application Default Credentials, a workload that
already carries a Google
+identity needs no credential configuration at all: leave `serviceAccountKey`
unset and ADC resolves
+the identity attached to the workload. On GKE with
+https://cloud.google.com/kubernetes-engine/docs/concepts/workload-identity[Workload
Identity] that is
+the GCP service account bound to the pod's Kubernetes service account; the
same applies on Compute
+Engine and Cloud Run.
-**On GKE with Workload Identity:** No configuration is needed. Application
Default Credentials (ADC) automatically detects the GKE environment and uses
the Kubernetes service account's associated GCP identity.
-
-**With an explicit WIF configuration file:** Set
`useWorkloadIdentityFederation=true` and provide the path to the WIF JSON
config file via `workloadIdentityConfig`. This is the typical setup for GitHub
Actions, AWS, and Azure workloads.
-
-._Java-only: programmatic endpoint configuration for Workload Identity
Federation_
[source,java]
----
-// GKE with Workload Identity - ADC handles it automatically
+// on GKE with Workload Identity, Compute Engine or Cloud Run: nothing to
configure
from("google-pubsub:my-project:my-subscription")
.to("direct:process");
-
-// GitHub Actions / AWS / Azure with WIF config file
-GooglePubsubEndpoint endpoint =
context.getEndpoint("google-pubsub:my-project:my-subscription",
GooglePubsubEndpoint.class);
-endpoint.setUseWorkloadIdentityFederation(true);
-endpoint.setWorkloadIdentityConfig("/path/to/wif-config.json");
-----
-
-**With Service Account Impersonation:** Set `impersonatedServiceAccount` to a
target service account email. The external credentials obtained via WIF will
impersonate that service account, inheriting its permissions.
-
-._Java-only: programmatic endpoint configuration with service account
impersonation_
-[source,java]
-----
-// WIF with service account impersonation
-GooglePubsubEndpoint endpoint =
context.getEndpoint("google-pubsub:my-project:my-subscription",
GooglePubsubEndpoint.class);
-endpoint.setUseWorkloadIdentityFederation(true);
-endpoint.setWorkloadIdentityConfig("/path/to/wif-config.json");
-endpoint.setImpersonatedServiceAccount("[email protected]");
----
-NOTE: Workload Identity Federation support is available in all Google
components (PubSub, Storage, BigQuery, Firestore, Sheets, Calendar, Drive,
Mail, Functions, Secret Manager, Vision, Vertex AI, Speech-to-Text,
Text-to-Speech) through the common `GoogleCommonConfiguration` interface.
+NOTE: Configuring
+https://cloud.google.com/iam/docs/workload-identity-federation[Workload
Identity Federation] for an
+external identity provider (an explicit WIF credential configuration file for
AWS, Azure or GitHub
+Actions), or service account impersonation, is not exposed as an endpoint
option by the Google
+components.
=== Manual Acknowledgement
diff --git
a/components/camel-google/camel-google-pubsub/src/main/docs/google-pubsub-component.adoc
b/components/camel-google/camel-google-pubsub/src/main/docs/google-pubsub-component.adoc
index d1c93f3d4aff..3f9869e6352b 100644
---
a/components/camel-google/camel-google-pubsub/src/main/docs/google-pubsub-component.adoc
+++
b/components/camel-google/camel-google-pubsub/src/main/docs/google-pubsub-component.adoc
@@ -178,40 +178,27 @@ By default, this component acquires credentials using
`GoogleCredentials.getAppl
This behavior can be disabled by setting _authenticate_ option to `false`, in
which case requests to Google API will be made without authentication details.
This is only desirable when developing against an emulator.
This behavior can be altered by supplying a path to a service account key file.
-==== Workload Identity Federation (WIF)
+==== Workload Identity on GKE and other Google-managed environments
-All Google components support
https://cloud.google.com/iam/docs/workload-identity-federation[Workload
Identity Federation], which enables workloads running outside of Google Cloud
(e.g., on AWS, Azure, GitHub Actions) or on GKE to authenticate without service
account key files.
+Because the default is Application Default Credentials, a workload that
already carries a Google
+identity needs no credential configuration at all: leave `serviceAccountKey`
unset and ADC resolves
+the identity attached to the workload. On GKE with
+https://cloud.google.com/kubernetes-engine/docs/concepts/workload-identity[Workload
Identity] that is
+the GCP service account bound to the pod's Kubernetes service account; the
same applies on Compute
+Engine and Cloud Run.
-**On GKE with Workload Identity:** No configuration is needed. Application
Default Credentials (ADC) automatically detects the GKE environment and uses
the Kubernetes service account's associated GCP identity.
-
-**With an explicit WIF configuration file:** Set
`useWorkloadIdentityFederation=true` and provide the path to the WIF JSON
config file via `workloadIdentityConfig`. This is the typical setup for GitHub
Actions, AWS, and Azure workloads.
-
-._Java-only: programmatic endpoint configuration for Workload Identity
Federation_
[source,java]
----
-// GKE with Workload Identity - ADC handles it automatically
+// on GKE with Workload Identity, Compute Engine or Cloud Run: nothing to
configure
from("google-pubsub:my-project:my-subscription")
.to("direct:process");
-
-// GitHub Actions / AWS / Azure with WIF config file
-GooglePubsubEndpoint endpoint =
context.getEndpoint("google-pubsub:my-project:my-subscription",
GooglePubsubEndpoint.class);
-endpoint.setUseWorkloadIdentityFederation(true);
-endpoint.setWorkloadIdentityConfig("/path/to/wif-config.json");
-----
-
-**With Service Account Impersonation:** Set `impersonatedServiceAccount` to a
target service account email. The external credentials obtained via WIF will
impersonate that service account, inheriting its permissions.
-
-._Java-only: programmatic endpoint configuration with service account
impersonation_
-[source,java]
-----
-// WIF with service account impersonation
-GooglePubsubEndpoint endpoint =
context.getEndpoint("google-pubsub:my-project:my-subscription",
GooglePubsubEndpoint.class);
-endpoint.setUseWorkloadIdentityFederation(true);
-endpoint.setWorkloadIdentityConfig("/path/to/wif-config.json");
-endpoint.setImpersonatedServiceAccount("[email protected]");
----
-NOTE: Workload Identity Federation support is available in all Google
components (PubSub, Storage, BigQuery, Firestore, Sheets, Calendar, Drive,
Mail, Functions, Secret Manager, Vision, Vertex AI, Speech-to-Text,
Text-to-Speech) through the common `GoogleCommonConfiguration` interface.
+NOTE: Configuring
+https://cloud.google.com/iam/docs/workload-identity-federation[Workload
Identity Federation] for an
+external identity provider (an explicit WIF credential configuration file for
AWS, Azure or GitHub
+Actions), or service account impersonation, is not exposed as an endpoint
option by the Google
+components.
=== Manual Acknowledgement
