cyriltovena commented on code in PR #65433:
URL: https://github.com/apache/doris/pull/65433#discussion_r3615260617
##########
gensrc/proto/cloud.proto:
##########
@@ -274,6 +274,9 @@ enum CredProviderTypePB {
WEB_IDENTITY = 6; // STSAssumeRoleWebIdentityCredentialsProvider
CONTAINER = 7; // TaskRoleCredentialsProvider
ANONYMOUS = 8; // AnonymousAWSCredentialsProvider
+ // GKE Workload Identity. Requests to the GCS XML API are authenticated
+ // with a short-lived OAuth2 token from the GKE metadata server.
+ GCP_WORKLOAD_IDENTITY = 9;
Review Comment:
Thank you; I agree this is a real compatibility risk. f1274c521c adds
downgrade resilience for the raw-tag case by making explicit HMAC or role
credentials take precedence over a stale Workload Identity enum in both BE and
recycler, with tests. It does not add the requested activation gate: Meta
Service currently has no registry that can prove support across every BE and
recycler. I am leaving this thread open because a complete fix needs a
coordinated consumer-capability or rollout contract rather than a local version
guess.
##########
cloud/src/meta-service/meta_service_resource.cpp:
##########
@@ -1496,7 +1544,20 @@ void
MetaServiceImpl::alter_storage_vault(google::protobuf::RpcController* contr
}
if (use_credential_provider(obj)) {
- if (!obj.has_provider() || obj.provider() !=
ObjectStoreInfoPB::S3) {
+ if (is_gcp_workload_identity_cred_provider(obj)) {
Review Comment:
Thank you for pushing on both entry points. This is now complete in
adf2d7a7fd. The new ADD_BUILT_IN_VAULT RPC test exposed that this branch staged
the vault and instance writes but returned before the shared transaction
commit. The branch now continues through the normal atomic commit and refresh
notification. AddBuiltInGcpWorkloadIdentityVaultTest verifies the instance
mapping and canonical keyless vault persistence without AK/SK or encryption
metadata. Together with the existing CreateInstanceRequest.vault test, both
built-in paths are covered.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
