This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new f9f2b6195ea6 CAMEL-17369: camel-google-storage - support Workload
Identity Federation and service account impersonation (#28157)
f9f2b6195ea6 is described below
commit f9f2b6195ea654087dd4c5364da9193f82c4e93e
Author: Andrea Cosentino <[email protected]>
AuthorDate: Tue Oct 20 12:57:30 2026 +0200
CAMEL-17369: camel-google-storage - support Workload Identity Federation
and service account impersonation (#28157)
GoogleCredentialsHelper already loads Workload Identity Federation
credentials
and wraps them with ImpersonatedCredentials, but no component exposed the
switches: useWorkloadIdentityFederation, workloadIdentityConfig and
impersonatedServiceAccount were only default methods of
GoogleCommonConfiguration. The google-storage endpoint now has these
options.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Signed-off-by: Andrea Cosentino <[email protected]>
---
.../camel/catalog/components/google-storage.json | 10 +-
.../catalog/docs/google-storage-component.adoc | 23 +++
.../GoogleCloudStorageComponentConfigurer.java | 18 ++
.../GoogleCloudStorageEndpointConfigurer.java | 18 ++
.../GoogleCloudStorageEndpointUriFactory.java | 5 +-
.../component/google/storage/google-storage.json | 10 +-
.../src/main/docs/google-storage-component.adoc | 23 +++
.../storage/GoogleCloudStorageConfiguration.java | 52 +++++
.../GoogleCloudStorageWorkloadIdentityTest.java | 79 ++++++++
.../src/test/resources/wif-config.json | 9 +
.../dsl/GoogleStorageComponentBuilderFactory.java | 63 ++++++
.../GoogleCloudStorageEndpointBuilderFactory.java | 225 +++++++++++++++++++++
12 files changed, 530 insertions(+), 5 deletions(-)
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/google-storage.json
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/google-storage.json
index 6e2f7e1ee8ae..c074a07ef91b 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/google-storage.json
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/google-storage.json
@@ -44,7 +44,10 @@
"operation": { "index": 17, "kind": "property", "displayName":
"Operation", "group": "producer", "label": "producer", "required": false,
"type": "enum", "javaType":
"org.apache.camel.component.google.storage.GoogleCloudStorageOperations",
"enum": [ "copyObject", "listObjects", "deleteObject", "deleteBucket",
"listBuckets", "getObject", "createDownloadLink" ], "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.google.storage.Goo [...]
"autowiredEnabled": { "index": 18, "kind": "property", "displayName":
"Autowired Enabled", "group": "advanced", "label": "advanced", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true, "description":
"Whether autowiring is enabled. This is used for automatic autowiring options
(the option must be marked as autowired) by looking up in the registry to find
if there is a single instance of matching [...]
"healthCheckConsumerEnabled": { "index": 19, "kind": "property",
"displayName": "Health Check Consumer Enabled", "group": "health", "label":
"health", "required": false, "type": "boolean", "javaType": "boolean",
"deprecated": false, "autowired": false, "secret": false, "defaultValue": true,
"description": "Used for enabling or disabling all consumer based health checks
from this component" },
- "healthCheckProducerEnabled": { "index": 20, "kind": "property",
"displayName": "Health Check Producer Enabled", "group": "health", "label":
"health", "required": false, "type": "boolean", "javaType": "boolean",
"deprecated": false, "autowired": false, "secret": false, "defaultValue": true,
"description": "Used for enabling or disabling all producer based health checks
from this component. Notice: Camel has by default disabled all producer based
health-checks. You can turn on produce [...]
+ "healthCheckProducerEnabled": { "index": 20, "kind": "property",
"displayName": "Health Check Producer Enabled", "group": "health", "label":
"health", "required": false, "type": "boolean", "javaType": "boolean",
"deprecated": false, "autowired": false, "secret": false, "defaultValue": true,
"description": "Used for enabling or disabling all producer based health checks
from this component. Notice: Camel has by default disabled all producer based
health-checks. You can turn on produce [...]
+ "impersonatedServiceAccount": { "index": 21, "kind": "property",
"displayName": "Impersonated Service Account", "group": "security", "label":
"security", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"configurationClass":
"org.apache.camel.component.google.storage.GoogleCloudStorageConfiguration",
"configurationField": "configuration", "description": "The email of a service
account to impersonate with th [...]
+ "useWorkloadIdentityFederation": { "index": 22, "kind": "property",
"displayName": "Use Workload Identity Federation", "group": "security",
"label": "security", "required": false, "type": "boolean", "javaType":
"boolean", "deprecated": false, "autowired": false, "secret": false,
"defaultValue": false, "configurationClass":
"org.apache.camel.component.google.storage.GoogleCloudStorageConfiguration",
"configurationField": "configuration", "description": "Whether to authenticate
with Wo [...]
+ "workloadIdentityConfig": { "index": 23, "kind": "property",
"displayName": "Workload Identity Config", "group": "security", "label":
"security", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"configurationClass":
"org.apache.camel.component.google.storage.GoogleCloudStorageConfiguration",
"configurationField": "configuration", "description": "The Workload Identity
Federation credential configuration fil [...]
},
"headers": {
"CamelGoogleCloudStorageOperation": { "index": 0, "kind": "header",
"displayName": "", "group": "producer", "label": "producer", "required": false,
"javaType":
"org.apache.camel.component.google.storage.GoogleCloudStorageOperations",
"enum": [ "copyObject", "listObjects", "deleteObject", "deleteBucket",
"listBuckets", "getObject", "createDownloadLink" ], "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": false, "description": "The
operation to perform.", "const [...]
@@ -112,6 +115,9 @@
"schedulerProperties": { "index": 32, "kind": "parameter", "displayName":
"Scheduler Properties", "group": "scheduler", "label": "consumer,scheduler",
"required": false, "type": "object", "javaType":
"java.util.Map<java.lang.String, java.lang.Object>", "prefix": "scheduler.",
"multiValue": true, "deprecated": false, "autowired": false, "secret": false,
"description": "To configure additional properties when using a custom
scheduler or any of the Quartz, Spring based scheduler. This i [...]
"startScheduler": { "index": 33, "kind": "parameter", "displayName":
"Start Scheduler", "group": "scheduler", "label": "consumer,scheduler",
"required": false, "type": "boolean", "javaType": "boolean", "deprecated":
false, "autowired": false, "secret": false, "defaultValue": true,
"description": "Whether the scheduler should be auto started." },
"timeUnit": { "index": 34, "kind": "parameter", "displayName": "Time
Unit", "group": "scheduler", "label": "consumer,scheduler", "required": false,
"type": "enum", "javaType": "java.util.concurrent.TimeUnit", "enum": [
"NANOSECONDS", "MICROSECONDS", "MILLISECONDS", "SECONDS", "MINUTES", "HOURS",
"DAYS" ], "deprecated": false, "autowired": false, "secret": false,
"defaultValue": "MILLISECONDS", "description": "Time unit for initialDelay and
delay options." },
- "useFixedDelay": { "index": 35, "kind": "parameter", "displayName": "Use
Fixed Delay", "group": "scheduler", "label": "consumer,scheduler", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true, "description":
"Controls if fixed delay or fixed rate is used. See ScheduledExecutorService in
JDK for details." }
+ "useFixedDelay": { "index": 35, "kind": "parameter", "displayName": "Use
Fixed Delay", "group": "scheduler", "label": "consumer,scheduler", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true, "description":
"Controls if fixed delay or fixed rate is used. See ScheduledExecutorService in
JDK for details." },
+ "impersonatedServiceAccount": { "index": 36, "kind": "parameter",
"displayName": "Impersonated Service Account", "group": "security", "label":
"security", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"configurationClass":
"org.apache.camel.component.google.storage.GoogleCloudStorageConfiguration",
"configurationField": "configuration", "description": "The email of a service
account to impersonate with t [...]
+ "useWorkloadIdentityFederation": { "index": 37, "kind": "parameter",
"displayName": "Use Workload Identity Federation", "group": "security",
"label": "security", "required": false, "type": "boolean", "javaType":
"boolean", "deprecated": false, "autowired": false, "secret": false,
"defaultValue": false, "configurationClass":
"org.apache.camel.component.google.storage.GoogleCloudStorageConfiguration",
"configurationField": "configuration", "description": "Whether to authenticate
with W [...]
+ "workloadIdentityConfig": { "index": 38, "kind": "parameter",
"displayName": "Workload Identity Config", "group": "security", "label":
"security", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"configurationClass":
"org.apache.camel.component.google.storage.GoogleCloudStorageConfiguration",
"configurationField": "configuration", "description": "The Workload Identity
Federation credential configuration fi [...]
}
}
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/google-storage-component.adoc
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/google-storage-component.adoc
index 3f67cfcfa8c5..e088354e966a 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/google-storage-component.adoc
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/google-storage-component.adoc
@@ -55,6 +55,29 @@ Provide authentication credentials to your application code
by setting the envir
export GOOGLE_APPLICATION_CREDENTIALS="/home/user/Downloads/my-key.json"
----
+=== Workload Identity Federation
+
+Instead of a service account key, the component can authenticate with
+https://cloud.google.com/iam/docs/workload-identity-federation[Workload
Identity Federation], enabled with
+`useWorkloadIdentityFederation=true`:
+
+* With `workloadIdentityConfig`, the component loads a credential
configuration file of type `external_account`, such
+as the one that `gcloud iam workload-identity-pools create-cred-config`
generates, and exchanges the token of the external
+identity provider (AWS, Azure, an OIDC provider) for Google credentials.
+* Without it, the component uses the Application Default Credentials, which
detect Workload Identity on GKE.
+
+Set `impersonatedServiceAccount` to act as a service account with the
federated credentials. The federated identity
+needs the `Service Account Token Creator` role on that service account.
+
+._Java-only: constructing the endpoint URI programmatically_
+
+[source,java]
+----
+String endpoint =
"google-storage://myCamelBucket?useWorkloadIdentityFederation=true"
+ + "&workloadIdentityConfig=file:/etc/gcp/wif-config.json"
+ +
"&impersonatedServiceAccount=storage-wri...@my-project.iam.gserviceaccount.com";
+----
+
== URI Format
diff --git
a/components/camel-google/camel-google-storage/src/generated/java/org/apache/camel/component/google/storage/GoogleCloudStorageComponentConfigurer.java
b/components/camel-google/camel-google-storage/src/generated/java/org/apache/camel/component/google/storage/GoogleCloudStorageComponentConfigurer.java
index 5840bda27da1..3e8cdf59f70c 100644
---
a/components/camel-google/camel-google-storage/src/generated/java/org/apache/camel/component/google/storage/GoogleCloudStorageComponentConfigurer.java
+++
b/components/camel-google/camel-google-storage/src/generated/java/org/apache/camel/component/google/storage/GoogleCloudStorageComponentConfigurer.java
@@ -48,6 +48,8 @@ public class GoogleCloudStorageComponentConfigurer extends
PropertyConfigurerSup
case "healthCheckConsumerEnabled":
target.setHealthCheckConsumerEnabled(property(camelContext, boolean.class,
value)); return true;
case "healthcheckproducerenabled":
case "healthCheckProducerEnabled":
target.setHealthCheckProducerEnabled(property(camelContext, boolean.class,
value)); return true;
+ case "impersonatedserviceaccount":
+ case "impersonatedServiceAccount":
getOrCreateConfiguration(target).setImpersonatedServiceAccount(property(camelContext,
java.lang.String.class, value)); return true;
case "includebody":
case "includeBody":
getOrCreateConfiguration(target).setIncludeBody(property(camelContext,
boolean.class, value)); return true;
case "includefolders":
@@ -68,6 +70,10 @@ public class GoogleCloudStorageComponentConfigurer extends
PropertyConfigurerSup
case "storageClient":
getOrCreateConfiguration(target).setStorageClient(property(camelContext,
com.google.cloud.storage.Storage.class, value)); return true;
case "storagelocation":
case "storageLocation":
getOrCreateConfiguration(target).setStorageLocation(property(camelContext,
java.lang.String.class, value)); return true;
+ case "useworkloadidentityfederation":
+ case "useWorkloadIdentityFederation":
getOrCreateConfiguration(target).setUseWorkloadIdentityFederation(property(camelContext,
boolean.class, value)); return true;
+ case "workloadidentityconfig":
+ case "workloadIdentityConfig":
getOrCreateConfiguration(target).setWorkloadIdentityConfig(property(camelContext,
java.lang.String.class, value)); return true;
default: return false;
}
}
@@ -98,6 +104,8 @@ public class GoogleCloudStorageComponentConfigurer extends
PropertyConfigurerSup
case "healthCheckConsumerEnabled": return boolean.class;
case "healthcheckproducerenabled":
case "healthCheckProducerEnabled": return boolean.class;
+ case "impersonatedserviceaccount":
+ case "impersonatedServiceAccount": return java.lang.String.class;
case "includebody":
case "includeBody": return boolean.class;
case "includefolders":
@@ -118,6 +126,10 @@ public class GoogleCloudStorageComponentConfigurer extends
PropertyConfigurerSup
case "storageClient": return com.google.cloud.storage.Storage.class;
case "storagelocation":
case "storageLocation": return java.lang.String.class;
+ case "useworkloadidentityfederation":
+ case "useWorkloadIdentityFederation": return boolean.class;
+ case "workloadidentityconfig":
+ case "workloadIdentityConfig": return java.lang.String.class;
default: return null;
}
}
@@ -144,6 +156,8 @@ public class GoogleCloudStorageComponentConfigurer extends
PropertyConfigurerSup
case "healthCheckConsumerEnabled": return
target.isHealthCheckConsumerEnabled();
case "healthcheckproducerenabled":
case "healthCheckProducerEnabled": return
target.isHealthCheckProducerEnabled();
+ case "impersonatedserviceaccount":
+ case "impersonatedServiceAccount": return
getOrCreateConfiguration(target).getImpersonatedServiceAccount();
case "includebody":
case "includeBody": return
getOrCreateConfiguration(target).isIncludeBody();
case "includefolders":
@@ -164,6 +178,10 @@ public class GoogleCloudStorageComponentConfigurer extends
PropertyConfigurerSup
case "storageClient": return
getOrCreateConfiguration(target).getStorageClient();
case "storagelocation":
case "storageLocation": return
getOrCreateConfiguration(target).getStorageLocation();
+ case "useworkloadidentityfederation":
+ case "useWorkloadIdentityFederation": return
getOrCreateConfiguration(target).isUseWorkloadIdentityFederation();
+ case "workloadidentityconfig":
+ case "workloadIdentityConfig": return
getOrCreateConfiguration(target).getWorkloadIdentityConfig();
default: return null;
}
}
diff --git
a/components/camel-google/camel-google-storage/src/generated/java/org/apache/camel/component/google/storage/GoogleCloudStorageEndpointConfigurer.java
b/components/camel-google/camel-google-storage/src/generated/java/org/apache/camel/component/google/storage/GoogleCloudStorageEndpointConfigurer.java
index 13f2f4766275..858cba474498 100644
---
a/components/camel-google/camel-google-storage/src/generated/java/org/apache/camel/component/google/storage/GoogleCloudStorageEndpointConfigurer.java
+++
b/components/camel-google/camel-google-storage/src/generated/java/org/apache/camel/component/google/storage/GoogleCloudStorageEndpointConfigurer.java
@@ -46,6 +46,8 @@ public class GoogleCloudStorageEndpointConfigurer extends
PropertyConfigurerSupp
case "exchangePattern":
target.setExchangePattern(property(camelContext,
org.apache.camel.ExchangePattern.class, value)); return true;
case "filter":
target.getConfiguration().setFilter(property(camelContext,
java.lang.String.class, value)); return true;
case "greedy": target.setGreedy(property(camelContext, boolean.class,
value)); return true;
+ case "impersonatedserviceaccount":
+ case "impersonatedServiceAccount":
target.getConfiguration().setImpersonatedServiceAccount(property(camelContext,
java.lang.String.class, value)); return true;
case "includebody":
case "includeBody":
target.getConfiguration().setIncludeBody(property(camelContext, boolean.class,
value)); return true;
case "includefolders":
@@ -87,6 +89,10 @@ public class GoogleCloudStorageEndpointConfigurer extends
PropertyConfigurerSupp
case "timeUnit": target.setTimeUnit(property(camelContext,
java.util.concurrent.TimeUnit.class, value)); return true;
case "usefixeddelay":
case "useFixedDelay": target.setUseFixedDelay(property(camelContext,
boolean.class, value)); return true;
+ case "useworkloadidentityfederation":
+ case "useWorkloadIdentityFederation":
target.getConfiguration().setUseWorkloadIdentityFederation(property(camelContext,
boolean.class, value)); return true;
+ case "workloadidentityconfig":
+ case "workloadIdentityConfig":
target.getConfiguration().setWorkloadIdentityConfig(property(camelContext,
java.lang.String.class, value)); return true;
default: return false;
}
}
@@ -122,6 +128,8 @@ public class GoogleCloudStorageEndpointConfigurer extends
PropertyConfigurerSupp
case "exchangePattern": return org.apache.camel.ExchangePattern.class;
case "filter": return java.lang.String.class;
case "greedy": return boolean.class;
+ case "impersonatedserviceaccount":
+ case "impersonatedServiceAccount": return java.lang.String.class;
case "includebody":
case "includeBody": return boolean.class;
case "includefolders":
@@ -163,6 +171,10 @@ public class GoogleCloudStorageEndpointConfigurer extends
PropertyConfigurerSupp
case "timeUnit": return java.util.concurrent.TimeUnit.class;
case "usefixeddelay":
case "useFixedDelay": return boolean.class;
+ case "useworkloadidentityfederation":
+ case "useWorkloadIdentityFederation": return boolean.class;
+ case "workloadidentityconfig":
+ case "workloadIdentityConfig": return java.lang.String.class;
default: return null;
}
}
@@ -194,6 +206,8 @@ public class GoogleCloudStorageEndpointConfigurer extends
PropertyConfigurerSupp
case "exchangePattern": return target.getExchangePattern();
case "filter": return target.getConfiguration().getFilter();
case "greedy": return target.isGreedy();
+ case "impersonatedserviceaccount":
+ case "impersonatedServiceAccount": return
target.getConfiguration().getImpersonatedServiceAccount();
case "includebody":
case "includeBody": return target.getConfiguration().isIncludeBody();
case "includefolders":
@@ -235,6 +249,10 @@ public class GoogleCloudStorageEndpointConfigurer extends
PropertyConfigurerSupp
case "timeUnit": return target.getTimeUnit();
case "usefixeddelay":
case "useFixedDelay": return target.isUseFixedDelay();
+ case "useworkloadidentityfederation":
+ case "useWorkloadIdentityFederation": return
target.getConfiguration().isUseWorkloadIdentityFederation();
+ case "workloadidentityconfig":
+ case "workloadIdentityConfig": return
target.getConfiguration().getWorkloadIdentityConfig();
default: return null;
}
}
diff --git
a/components/camel-google/camel-google-storage/src/generated/java/org/apache/camel/component/google/storage/GoogleCloudStorageEndpointUriFactory.java
b/components/camel-google/camel-google-storage/src/generated/java/org/apache/camel/component/google/storage/GoogleCloudStorageEndpointUriFactory.java
index d6a9e2f3bbc6..5772d049cb7c 100644
---
a/components/camel-google/camel-google-storage/src/generated/java/org/apache/camel/component/google/storage/GoogleCloudStorageEndpointUriFactory.java
+++
b/components/camel-google/camel-google-storage/src/generated/java/org/apache/camel/component/google/storage/GoogleCloudStorageEndpointUriFactory.java
@@ -24,7 +24,7 @@ public class GoogleCloudStorageEndpointUriFactory extends
org.apache.camel.suppo
private static final Set<String> ENDPOINT_IDENTITY_PROPERTY_NAMES;
private static final Map<String, String> MULTI_VALUE_PREFIXES;
static {
- Set<String> props = new HashSet<>(36);
+ Set<String> props = new HashSet<>(39);
props.add("autoCreateBucket");
props.add("backoffErrorThreshold");
props.add("backoffIdleThreshold");
@@ -39,6 +39,7 @@ public class GoogleCloudStorageEndpointUriFactory extends
org.apache.camel.suppo
props.add("exchangePattern");
props.add("filter");
props.add("greedy");
+ props.add("impersonatedServiceAccount");
props.add("includeBody");
props.add("includeFolders");
props.add("initialDelay");
@@ -61,6 +62,8 @@ public class GoogleCloudStorageEndpointUriFactory extends
org.apache.camel.suppo
props.add("storageLocation");
props.add("timeUnit");
props.add("useFixedDelay");
+ props.add("useWorkloadIdentityFederation");
+ props.add("workloadIdentityConfig");
PROPERTY_NAMES = Collections.unmodifiableSet(props);
SECRET_PROPERTY_NAMES = Collections.emptySet();
ENDPOINT_IDENTITY_PROPERTY_NAMES = Collections.emptySet();
diff --git
a/components/camel-google/camel-google-storage/src/generated/resources/META-INF/org/apache/camel/component/google/storage/google-storage.json
b/components/camel-google/camel-google-storage/src/generated/resources/META-INF/org/apache/camel/component/google/storage/google-storage.json
index 6e2f7e1ee8ae..c074a07ef91b 100644
---
a/components/camel-google/camel-google-storage/src/generated/resources/META-INF/org/apache/camel/component/google/storage/google-storage.json
+++
b/components/camel-google/camel-google-storage/src/generated/resources/META-INF/org/apache/camel/component/google/storage/google-storage.json
@@ -44,7 +44,10 @@
"operation": { "index": 17, "kind": "property", "displayName":
"Operation", "group": "producer", "label": "producer", "required": false,
"type": "enum", "javaType":
"org.apache.camel.component.google.storage.GoogleCloudStorageOperations",
"enum": [ "copyObject", "listObjects", "deleteObject", "deleteBucket",
"listBuckets", "getObject", "createDownloadLink" ], "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.google.storage.Goo [...]
"autowiredEnabled": { "index": 18, "kind": "property", "displayName":
"Autowired Enabled", "group": "advanced", "label": "advanced", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true, "description":
"Whether autowiring is enabled. This is used for automatic autowiring options
(the option must be marked as autowired) by looking up in the registry to find
if there is a single instance of matching [...]
"healthCheckConsumerEnabled": { "index": 19, "kind": "property",
"displayName": "Health Check Consumer Enabled", "group": "health", "label":
"health", "required": false, "type": "boolean", "javaType": "boolean",
"deprecated": false, "autowired": false, "secret": false, "defaultValue": true,
"description": "Used for enabling or disabling all consumer based health checks
from this component" },
- "healthCheckProducerEnabled": { "index": 20, "kind": "property",
"displayName": "Health Check Producer Enabled", "group": "health", "label":
"health", "required": false, "type": "boolean", "javaType": "boolean",
"deprecated": false, "autowired": false, "secret": false, "defaultValue": true,
"description": "Used for enabling or disabling all producer based health checks
from this component. Notice: Camel has by default disabled all producer based
health-checks. You can turn on produce [...]
+ "healthCheckProducerEnabled": { "index": 20, "kind": "property",
"displayName": "Health Check Producer Enabled", "group": "health", "label":
"health", "required": false, "type": "boolean", "javaType": "boolean",
"deprecated": false, "autowired": false, "secret": false, "defaultValue": true,
"description": "Used for enabling or disabling all producer based health checks
from this component. Notice: Camel has by default disabled all producer based
health-checks. You can turn on produce [...]
+ "impersonatedServiceAccount": { "index": 21, "kind": "property",
"displayName": "Impersonated Service Account", "group": "security", "label":
"security", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"configurationClass":
"org.apache.camel.component.google.storage.GoogleCloudStorageConfiguration",
"configurationField": "configuration", "description": "The email of a service
account to impersonate with th [...]
+ "useWorkloadIdentityFederation": { "index": 22, "kind": "property",
"displayName": "Use Workload Identity Federation", "group": "security",
"label": "security", "required": false, "type": "boolean", "javaType":
"boolean", "deprecated": false, "autowired": false, "secret": false,
"defaultValue": false, "configurationClass":
"org.apache.camel.component.google.storage.GoogleCloudStorageConfiguration",
"configurationField": "configuration", "description": "Whether to authenticate
with Wo [...]
+ "workloadIdentityConfig": { "index": 23, "kind": "property",
"displayName": "Workload Identity Config", "group": "security", "label":
"security", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"configurationClass":
"org.apache.camel.component.google.storage.GoogleCloudStorageConfiguration",
"configurationField": "configuration", "description": "The Workload Identity
Federation credential configuration fil [...]
},
"headers": {
"CamelGoogleCloudStorageOperation": { "index": 0, "kind": "header",
"displayName": "", "group": "producer", "label": "producer", "required": false,
"javaType":
"org.apache.camel.component.google.storage.GoogleCloudStorageOperations",
"enum": [ "copyObject", "listObjects", "deleteObject", "deleteBucket",
"listBuckets", "getObject", "createDownloadLink" ], "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": false, "description": "The
operation to perform.", "const [...]
@@ -112,6 +115,9 @@
"schedulerProperties": { "index": 32, "kind": "parameter", "displayName":
"Scheduler Properties", "group": "scheduler", "label": "consumer,scheduler",
"required": false, "type": "object", "javaType":
"java.util.Map<java.lang.String, java.lang.Object>", "prefix": "scheduler.",
"multiValue": true, "deprecated": false, "autowired": false, "secret": false,
"description": "To configure additional properties when using a custom
scheduler or any of the Quartz, Spring based scheduler. This i [...]
"startScheduler": { "index": 33, "kind": "parameter", "displayName":
"Start Scheduler", "group": "scheduler", "label": "consumer,scheduler",
"required": false, "type": "boolean", "javaType": "boolean", "deprecated":
false, "autowired": false, "secret": false, "defaultValue": true,
"description": "Whether the scheduler should be auto started." },
"timeUnit": { "index": 34, "kind": "parameter", "displayName": "Time
Unit", "group": "scheduler", "label": "consumer,scheduler", "required": false,
"type": "enum", "javaType": "java.util.concurrent.TimeUnit", "enum": [
"NANOSECONDS", "MICROSECONDS", "MILLISECONDS", "SECONDS", "MINUTES", "HOURS",
"DAYS" ], "deprecated": false, "autowired": false, "secret": false,
"defaultValue": "MILLISECONDS", "description": "Time unit for initialDelay and
delay options." },
- "useFixedDelay": { "index": 35, "kind": "parameter", "displayName": "Use
Fixed Delay", "group": "scheduler", "label": "consumer,scheduler", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true, "description":
"Controls if fixed delay or fixed rate is used. See ScheduledExecutorService in
JDK for details." }
+ "useFixedDelay": { "index": 35, "kind": "parameter", "displayName": "Use
Fixed Delay", "group": "scheduler", "label": "consumer,scheduler", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true, "description":
"Controls if fixed delay or fixed rate is used. See ScheduledExecutorService in
JDK for details." },
+ "impersonatedServiceAccount": { "index": 36, "kind": "parameter",
"displayName": "Impersonated Service Account", "group": "security", "label":
"security", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"configurationClass":
"org.apache.camel.component.google.storage.GoogleCloudStorageConfiguration",
"configurationField": "configuration", "description": "The email of a service
account to impersonate with t [...]
+ "useWorkloadIdentityFederation": { "index": 37, "kind": "parameter",
"displayName": "Use Workload Identity Federation", "group": "security",
"label": "security", "required": false, "type": "boolean", "javaType":
"boolean", "deprecated": false, "autowired": false, "secret": false,
"defaultValue": false, "configurationClass":
"org.apache.camel.component.google.storage.GoogleCloudStorageConfiguration",
"configurationField": "configuration", "description": "Whether to authenticate
with W [...]
+ "workloadIdentityConfig": { "index": 38, "kind": "parameter",
"displayName": "Workload Identity Config", "group": "security", "label":
"security", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"configurationClass":
"org.apache.camel.component.google.storage.GoogleCloudStorageConfiguration",
"configurationField": "configuration", "description": "The Workload Identity
Federation credential configuration fi [...]
}
}
diff --git
a/components/camel-google/camel-google-storage/src/main/docs/google-storage-component.adoc
b/components/camel-google/camel-google-storage/src/main/docs/google-storage-component.adoc
index 3f67cfcfa8c5..e088354e966a 100644
---
a/components/camel-google/camel-google-storage/src/main/docs/google-storage-component.adoc
+++
b/components/camel-google/camel-google-storage/src/main/docs/google-storage-component.adoc
@@ -55,6 +55,29 @@ Provide authentication credentials to your application code
by setting the envir
export GOOGLE_APPLICATION_CREDENTIALS="/home/user/Downloads/my-key.json"
----
+=== Workload Identity Federation
+
+Instead of a service account key, the component can authenticate with
+https://cloud.google.com/iam/docs/workload-identity-federation[Workload
Identity Federation], enabled with
+`useWorkloadIdentityFederation=true`:
+
+* With `workloadIdentityConfig`, the component loads a credential
configuration file of type `external_account`, such
+as the one that `gcloud iam workload-identity-pools create-cred-config`
generates, and exchanges the token of the external
+identity provider (AWS, Azure, an OIDC provider) for Google credentials.
+* Without it, the component uses the Application Default Credentials, which
detect Workload Identity on GKE.
+
+Set `impersonatedServiceAccount` to act as a service account with the
federated credentials. The federated identity
+needs the `Service Account Token Creator` role on that service account.
+
+._Java-only: constructing the endpoint URI programmatically_
+
+[source,java]
+----
+String endpoint =
"google-storage://myCamelBucket?useWorkloadIdentityFederation=true"
+ + "&workloadIdentityConfig=file:/etc/gcp/wif-config.json"
+ +
"&impersonatedServiceAccount=storage-wri...@my-project.iam.gserviceaccount.com";
+----
+
== URI Format
diff --git
a/components/camel-google/camel-google-storage/src/main/java/org/apache/camel/component/google/storage/GoogleCloudStorageConfiguration.java
b/components/camel-google/camel-google-storage/src/main/java/org/apache/camel/component/google/storage/GoogleCloudStorageConfiguration.java
index 458d3ab75411..7bbcdf46eca8 100644
---
a/components/camel-google/camel-google-storage/src/main/java/org/apache/camel/component/google/storage/GoogleCloudStorageConfiguration.java
+++
b/components/camel-google/camel-google-storage/src/main/java/org/apache/camel/component/google/storage/GoogleCloudStorageConfiguration.java
@@ -37,6 +37,15 @@ public class GoogleCloudStorageConfiguration implements
Cloneable, GoogleCommonC
+ " classpath, but you can prefix with classpath:,
file:, or http: to load the resource from different systems.")
private String serviceAccountKey;
+ @UriParam(label = "security")
+ private boolean useWorkloadIdentityFederation;
+
+ @UriParam(label = "security")
+ private String workloadIdentityConfig;
+
+ @UriParam(label = "security")
+ private String impersonatedServiceAccount;
+
@UriParam(label = "producer",
enums =
"copyObject,listObjects,deleteObject,deleteBucket,listBuckets,getObject,createDownloadLink")
private GoogleCloudStorageOperations operation;
@@ -108,6 +117,49 @@ public class GoogleCloudStorageConfiguration implements
Cloneable, GoogleCommonC
this.serviceAccountKey = serviceAccountKey;
}
+ @Override
+ public boolean isUseWorkloadIdentityFederation() {
+ return useWorkloadIdentityFederation;
+ }
+
+ /**
+ * Whether to authenticate with Workload Identity Federation instead of a
service account key: with the credential
+ * configuration file given in workloadIdentityConfig or, when it is not
set, with the Application Default
+ * Credentials, which detect Workload Identity on GKE.
+ */
+ public void setUseWorkloadIdentityFederation(boolean
useWorkloadIdentityFederation) {
+ this.useWorkloadIdentityFederation = useWorkloadIdentityFederation;
+ }
+
+ @Override
+ public String getWorkloadIdentityConfig() {
+ return workloadIdentityConfig;
+ }
+
+ /**
+ * The Workload Identity Federation credential configuration file (JSON,
of type external_account), which says how
+ * to exchange a token of an external identity provider, such as AWS,
Azure or an OIDC provider, for Google
+ * credentials. Used when useWorkloadIdentityFederation is enabled. It is
loaded from the classpath by default;
+ * prefix it with classpath:, file:, http: or https: to load it from
another location.
+ */
+ public void setWorkloadIdentityConfig(String workloadIdentityConfig) {
+ this.workloadIdentityConfig = workloadIdentityConfig;
+ }
+
+ @Override
+ public String getImpersonatedServiceAccount() {
+ return impersonatedServiceAccount;
+ }
+
+ /**
+ * The email of a service account to impersonate with the credentials of
Workload Identity Federation, so the
+ * workload gets the permissions of that service account. Used when
useWorkloadIdentityFederation is enabled; the
+ * federated identity needs the Service Account Token Creator role on the
service account.
+ */
+ public void setImpersonatedServiceAccount(String
impersonatedServiceAccount) {
+ this.impersonatedServiceAccount = impersonatedServiceAccount;
+ }
+
public String getObjectName() {
return objectName;
}
diff --git
a/components/camel-google/camel-google-storage/src/test/java/org/apache/camel/component/google/storage/unit/GoogleCloudStorageWorkloadIdentityTest.java
b/components/camel-google/camel-google-storage/src/test/java/org/apache/camel/component/google/storage/unit/GoogleCloudStorageWorkloadIdentityTest.java
new file mode 100644
index 000000000000..398de8b09456
--- /dev/null
+++
b/components/camel-google/camel-google-storage/src/test/java/org/apache/camel/component/google/storage/unit/GoogleCloudStorageWorkloadIdentityTest.java
@@ -0,0 +1,79 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.google.storage.unit;
+
+import com.google.auth.Credentials;
+import com.google.auth.oauth2.ExternalAccountCredentials;
+import com.google.auth.oauth2.ImpersonatedCredentials;
+import org.apache.camel.component.google.common.GoogleCredentialsHelper;
+import org.apache.camel.component.google.storage.GoogleCloudStorageComponent;
+import
org.apache.camel.component.google.storage.GoogleCloudStorageConfiguration;
+import org.apache.camel.component.google.storage.GoogleCloudStorageEndpoint;
+import org.apache.camel.test.junit6.CamelTestSupport;
+import org.junit.jupiter.api.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * The Workload Identity Federation options of the endpoint reach the
credentials of the Storage client.
+ */
+class GoogleCloudStorageWorkloadIdentityTest extends CamelTestSupport {
+
+ private static final String SERVICE_ACCOUNT =
"[email protected]";
+
+ @Test
+ void endpointBindsTheWorkloadIdentityOptions() throws Exception {
+ GoogleCloudStorageConfiguration configuration = configuration(
+
"google-storage://myCamelBucket?useWorkloadIdentityFederation=true"
+ +
"&workloadIdentityConfig=classpath:wif-config.json"
+ +
"&impersonatedServiceAccount=" + SERVICE_ACCOUNT);
+
+ assertThat(configuration.isUseWorkloadIdentityFederation()).isTrue();
+
assertThat(configuration.getWorkloadIdentityConfig()).isEqualTo("classpath:wif-config.json");
+
assertThat(configuration.getImpersonatedServiceAccount()).isEqualTo(SERVICE_ACCOUNT);
+ }
+
+ @Test
+ void credentialsComeFromTheWorkloadIdentityConfig() throws Exception {
+ Credentials credentials =
GoogleCredentialsHelper.getCredentials(context, configuration(
+
"google-storage://myCamelBucket?useWorkloadIdentityFederation=true"
+
+ "&workloadIdentityConfig=classpath:wif-config.json"));
+
+ assertThat(credentials).isInstanceOf(ExternalAccountCredentials.class);
+ assertThat(((ExternalAccountCredentials)
credentials).getAudience()).endsWith("/providers/camel-provider");
+ }
+
+ @Test
+ void credentialsImpersonateTheServiceAccount() throws Exception {
+ Credentials credentials =
GoogleCredentialsHelper.getCredentials(context, configuration(
+
"google-storage://myCamelBucket?useWorkloadIdentityFederation=true"
+
+ "&workloadIdentityConfig=classpath:wif-config.json"
+
+ "&impersonatedServiceAccount="
+
+ SERVICE_ACCOUNT));
+
+ assertThat(credentials).isInstanceOf(ImpersonatedCredentials.class);
+ ImpersonatedCredentials impersonated = (ImpersonatedCredentials)
credentials;
+ assertThat(impersonated.getAccount()).isEqualTo(SERVICE_ACCOUNT);
+
assertThat(impersonated.getSourceCredentials()).isInstanceOf(ExternalAccountCredentials.class);
+ }
+
+ private GoogleCloudStorageConfiguration configuration(String uri) throws
Exception {
+ // not started: the endpoint would create its Storage client
+ GoogleCloudStorageComponent component =
context.getComponent("google-storage", GoogleCloudStorageComponent.class);
+ return ((GoogleCloudStorageEndpoint)
component.createEndpoint(uri)).getConfiguration();
+ }
+}
diff --git
a/components/camel-google/camel-google-storage/src/test/resources/wif-config.json
b/components/camel-google/camel-google-storage/src/test/resources/wif-config.json
new file mode 100644
index 000000000000..714e3bdeb04f
--- /dev/null
+++
b/components/camel-google/camel-google-storage/src/test/resources/wif-config.json
@@ -0,0 +1,9 @@
+{
+ "type": "external_account",
+ "audience":
"//iam.googleapis.com/projects/123456/locations/global/workloadIdentityPools/camel-pool/providers/camel-provider",
+ "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
+ "token_url": "https://sts.googleapis.com/v1/token";,
+ "credential_source": {
+ "file": "/var/run/secrets/camel/token"
+ }
+}
diff --git
a/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/GoogleStorageComponentBuilderFactory.java
b/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/GoogleStorageComponentBuilderFactory.java
index d5df840e2e76..c2a1a5224564 100644
---
a/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/GoogleStorageComponentBuilderFactory.java
+++
b/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/GoogleStorageComponentBuilderFactory.java
@@ -445,6 +445,66 @@ public interface GoogleStorageComponentBuilderFactory {
doSetProperty("healthCheckProducerEnabled",
healthCheckProducerEnabled);
return this;
}
+
+ /**
+ * The email of a service account to impersonate with the credentials
of
+ * Workload Identity Federation, so the workload gets the permissions
of
+ * that service account. Used when useWorkloadIdentityFederation is
+ * enabled; the federated identity needs the Service Account Token
+ * Creator role on the service account.
+ *
+ * The option is a: <code>java.lang.String</code> type.
+ *
+ * Group: security
+ *
+ * @param impersonatedServiceAccount the value to set
+ * @return the dsl builder
+ */
+ default GoogleStorageComponentBuilder
impersonatedServiceAccount(java.lang.String impersonatedServiceAccount) {
+ doSetProperty("impersonatedServiceAccount",
impersonatedServiceAccount);
+ return this;
+ }
+
+
+ /**
+ * Whether to authenticate with Workload Identity Federation instead of
+ * a service account key: with the credential configuration file given
+ * in workloadIdentityConfig or, when it is not set, with the
+ * Application Default Credentials, which detect Workload Identity on
+ * GKE.
+ *
+ * The option is a: <code>boolean</code> type.
+ *
+ * Default: false
+ * Group: security
+ *
+ * @param useWorkloadIdentityFederation the value to set
+ * @return the dsl builder
+ */
+ default GoogleStorageComponentBuilder
useWorkloadIdentityFederation(boolean useWorkloadIdentityFederation) {
+ doSetProperty("useWorkloadIdentityFederation",
useWorkloadIdentityFederation);
+ return this;
+ }
+
+ /**
+ * The Workload Identity Federation credential configuration file
(JSON,
+ * of type external_account), which says how to exchange a token of an
+ * external identity provider, such as AWS, Azure or an OIDC provider,
+ * for Google credentials. Used when useWorkloadIdentityFederation is
+ * enabled. It is loaded from the classpath by default; prefix it with
+ * classpath:, file:, http: or https: to load it from another location.
+ *
+ * The option is a: <code>java.lang.String</code> type.
+ *
+ * Group: security
+ *
+ * @param workloadIdentityConfig the value to set
+ * @return the dsl builder
+ */
+ default GoogleStorageComponentBuilder
workloadIdentityConfig(java.lang.String workloadIdentityConfig) {
+ doSetProperty("workloadIdentityConfig", workloadIdentityConfig);
+ return this;
+ }
}
class GoogleStorageComponentBuilderImpl
@@ -487,6 +547,9 @@ public interface GoogleStorageComponentBuilderFactory {
case "autowiredEnabled": ((GoogleCloudStorageComponent)
component).setAutowiredEnabled((boolean) value); return true;
case "healthCheckConsumerEnabled": ((GoogleCloudStorageComponent)
component).setHealthCheckConsumerEnabled((boolean) value); return true;
case "healthCheckProducerEnabled": ((GoogleCloudStorageComponent)
component).setHealthCheckProducerEnabled((boolean) value); return true;
+ case "impersonatedServiceAccount":
getOrCreateConfiguration((GoogleCloudStorageComponent)
component).setImpersonatedServiceAccount((java.lang.String) value); return true;
+ case "useWorkloadIdentityFederation":
getOrCreateConfiguration((GoogleCloudStorageComponent)
component).setUseWorkloadIdentityFederation((boolean) value); return true;
+ case "workloadIdentityConfig":
getOrCreateConfiguration((GoogleCloudStorageComponent)
component).setWorkloadIdentityConfig((java.lang.String) value); return true;
default: return false;
}
}
diff --git
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/GoogleCloudStorageEndpointBuilderFactory.java
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/GoogleCloudStorageEndpointBuilderFactory.java
index 02160fc5e8ec..f5c63e0ead8d 100644
---
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/GoogleCloudStorageEndpointBuilderFactory.java
+++
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/GoogleCloudStorageEndpointBuilderFactory.java
@@ -877,6 +877,81 @@ public interface GoogleCloudStorageEndpointBuilderFactory {
doSetProperty("useFixedDelay", useFixedDelay);
return this;
}
+ /**
+ * The email of a service account to impersonate with the credentials
of
+ * Workload Identity Federation, so the workload gets the permissions
of
+ * that service account. Used when useWorkloadIdentityFederation is
+ * enabled; the federated identity needs the Service Account Token
+ * Creator role on the service account.
+ *
+ * The option is a: <code>java.lang.String</code> type.
+ *
+ * Group: security
+ *
+ * @param impersonatedServiceAccount the value to set
+ * @return the dsl builder
+ */
+ default GoogleCloudStorageEndpointConsumerBuilder
impersonatedServiceAccount(String impersonatedServiceAccount) {
+ doSetProperty("impersonatedServiceAccount",
impersonatedServiceAccount);
+ return this;
+ }
+ /**
+ * Whether to authenticate with Workload Identity Federation instead of
+ * a service account key: with the credential configuration file given
+ * in workloadIdentityConfig or, when it is not set, with the
+ * Application Default Credentials, which detect Workload Identity on
+ * GKE.
+ *
+ * The option is a: <code>boolean</code> type.
+ *
+ * Default: false
+ * Group: security
+ *
+ * @param useWorkloadIdentityFederation the value to set
+ * @return the dsl builder
+ */
+ default GoogleCloudStorageEndpointConsumerBuilder
useWorkloadIdentityFederation(boolean useWorkloadIdentityFederation) {
+ doSetProperty("useWorkloadIdentityFederation",
useWorkloadIdentityFederation);
+ return this;
+ }
+ /**
+ * Whether to authenticate with Workload Identity Federation instead of
+ * a service account key: with the credential configuration file given
+ * in workloadIdentityConfig or, when it is not set, with the
+ * Application Default Credentials, which detect Workload Identity on
+ * GKE.
+ *
+ * The option will be converted to a <code>boolean</code> type.
+ *
+ * Default: false
+ * Group: security
+ *
+ * @param useWorkloadIdentityFederation the value to set
+ * @return the dsl builder
+ */
+ default GoogleCloudStorageEndpointConsumerBuilder
useWorkloadIdentityFederation(String useWorkloadIdentityFederation) {
+ doSetProperty("useWorkloadIdentityFederation",
useWorkloadIdentityFederation);
+ return this;
+ }
+ /**
+ * The Workload Identity Federation credential configuration file
(JSON,
+ * of type external_account), which says how to exchange a token of an
+ * external identity provider, such as AWS, Azure or an OIDC provider,
+ * for Google credentials. Used when useWorkloadIdentityFederation is
+ * enabled. It is loaded from the classpath by default; prefix it with
+ * classpath:, file:, http: or https: to load it from another location.
+ *
+ * The option is a: <code>java.lang.String</code> type.
+ *
+ * Group: security
+ *
+ * @param workloadIdentityConfig the value to set
+ * @return the dsl builder
+ */
+ default GoogleCloudStorageEndpointConsumerBuilder
workloadIdentityConfig(String workloadIdentityConfig) {
+ doSetProperty("workloadIdentityConfig", workloadIdentityConfig);
+ return this;
+ }
}
/**
@@ -1220,6 +1295,81 @@ public interface
GoogleCloudStorageEndpointBuilderFactory {
doSetProperty("operation", operation);
return this;
}
+ /**
+ * The email of a service account to impersonate with the credentials
of
+ * Workload Identity Federation, so the workload gets the permissions
of
+ * that service account. Used when useWorkloadIdentityFederation is
+ * enabled; the federated identity needs the Service Account Token
+ * Creator role on the service account.
+ *
+ * The option is a: <code>java.lang.String</code> type.
+ *
+ * Group: security
+ *
+ * @param impersonatedServiceAccount the value to set
+ * @return the dsl builder
+ */
+ default GoogleCloudStorageEndpointProducerBuilder
impersonatedServiceAccount(String impersonatedServiceAccount) {
+ doSetProperty("impersonatedServiceAccount",
impersonatedServiceAccount);
+ return this;
+ }
+ /**
+ * Whether to authenticate with Workload Identity Federation instead of
+ * a service account key: with the credential configuration file given
+ * in workloadIdentityConfig or, when it is not set, with the
+ * Application Default Credentials, which detect Workload Identity on
+ * GKE.
+ *
+ * The option is a: <code>boolean</code> type.
+ *
+ * Default: false
+ * Group: security
+ *
+ * @param useWorkloadIdentityFederation the value to set
+ * @return the dsl builder
+ */
+ default GoogleCloudStorageEndpointProducerBuilder
useWorkloadIdentityFederation(boolean useWorkloadIdentityFederation) {
+ doSetProperty("useWorkloadIdentityFederation",
useWorkloadIdentityFederation);
+ return this;
+ }
+ /**
+ * Whether to authenticate with Workload Identity Federation instead of
+ * a service account key: with the credential configuration file given
+ * in workloadIdentityConfig or, when it is not set, with the
+ * Application Default Credentials, which detect Workload Identity on
+ * GKE.
+ *
+ * The option will be converted to a <code>boolean</code> type.
+ *
+ * Default: false
+ * Group: security
+ *
+ * @param useWorkloadIdentityFederation the value to set
+ * @return the dsl builder
+ */
+ default GoogleCloudStorageEndpointProducerBuilder
useWorkloadIdentityFederation(String useWorkloadIdentityFederation) {
+ doSetProperty("useWorkloadIdentityFederation",
useWorkloadIdentityFederation);
+ return this;
+ }
+ /**
+ * The Workload Identity Federation credential configuration file
(JSON,
+ * of type external_account), which says how to exchange a token of an
+ * external identity provider, such as AWS, Azure or an OIDC provider,
+ * for Google credentials. Used when useWorkloadIdentityFederation is
+ * enabled. It is loaded from the classpath by default; prefix it with
+ * classpath:, file:, http: or https: to load it from another location.
+ *
+ * The option is a: <code>java.lang.String</code> type.
+ *
+ * Group: security
+ *
+ * @param workloadIdentityConfig the value to set
+ * @return the dsl builder
+ */
+ default GoogleCloudStorageEndpointProducerBuilder
workloadIdentityConfig(String workloadIdentityConfig) {
+ doSetProperty("workloadIdentityConfig", workloadIdentityConfig);
+ return this;
+ }
}
/**
@@ -1426,6 +1576,81 @@ public interface
GoogleCloudStorageEndpointBuilderFactory {
doSetProperty("storageLocation", storageLocation);
return this;
}
+ /**
+ * The email of a service account to impersonate with the credentials
of
+ * Workload Identity Federation, so the workload gets the permissions
of
+ * that service account. Used when useWorkloadIdentityFederation is
+ * enabled; the federated identity needs the Service Account Token
+ * Creator role on the service account.
+ *
+ * The option is a: <code>java.lang.String</code> type.
+ *
+ * Group: security
+ *
+ * @param impersonatedServiceAccount the value to set
+ * @return the dsl builder
+ */
+ default GoogleCloudStorageEndpointBuilder
impersonatedServiceAccount(String impersonatedServiceAccount) {
+ doSetProperty("impersonatedServiceAccount",
impersonatedServiceAccount);
+ return this;
+ }
+ /**
+ * Whether to authenticate with Workload Identity Federation instead of
+ * a service account key: with the credential configuration file given
+ * in workloadIdentityConfig or, when it is not set, with the
+ * Application Default Credentials, which detect Workload Identity on
+ * GKE.
+ *
+ * The option is a: <code>boolean</code> type.
+ *
+ * Default: false
+ * Group: security
+ *
+ * @param useWorkloadIdentityFederation the value to set
+ * @return the dsl builder
+ */
+ default GoogleCloudStorageEndpointBuilder
useWorkloadIdentityFederation(boolean useWorkloadIdentityFederation) {
+ doSetProperty("useWorkloadIdentityFederation",
useWorkloadIdentityFederation);
+ return this;
+ }
+ /**
+ * Whether to authenticate with Workload Identity Federation instead of
+ * a service account key: with the credential configuration file given
+ * in workloadIdentityConfig or, when it is not set, with the
+ * Application Default Credentials, which detect Workload Identity on
+ * GKE.
+ *
+ * The option will be converted to a <code>boolean</code> type.
+ *
+ * Default: false
+ * Group: security
+ *
+ * @param useWorkloadIdentityFederation the value to set
+ * @return the dsl builder
+ */
+ default GoogleCloudStorageEndpointBuilder
useWorkloadIdentityFederation(String useWorkloadIdentityFederation) {
+ doSetProperty("useWorkloadIdentityFederation",
useWorkloadIdentityFederation);
+ return this;
+ }
+ /**
+ * The Workload Identity Federation credential configuration file
(JSON,
+ * of type external_account), which says how to exchange a token of an
+ * external identity provider, such as AWS, Azure or an OIDC provider,
+ * for Google credentials. Used when useWorkloadIdentityFederation is
+ * enabled. It is loaded from the classpath by default; prefix it with
+ * classpath:, file:, http: or https: to load it from another location.
+ *
+ * The option is a: <code>java.lang.String</code> type.
+ *
+ * Group: security
+ *
+ * @param workloadIdentityConfig the value to set
+ * @return the dsl builder
+ */
+ default GoogleCloudStorageEndpointBuilder
workloadIdentityConfig(String workloadIdentityConfig) {
+ doSetProperty("workloadIdentityConfig", workloadIdentityConfig);
+ return this;
+ }
}
/**
