gabotorresruiz commented on PR #43340: URL: https://github.com/apache/superset/pull/43340#issuecomment-5456770859
Design change in ee331bc783, driven by a production failure: on GKE clusters using direct workload identity federation (IAM grants to the Kubernetes principal, no Google service account bound), every download click failed with TransportError from the IAM signBytes API: 400 "Invalid form of account ID <project>.svc.id.goog". There is no service account to sign as in that identity mode, so no signing design can work there. The download endpoint now streams the object through Superset with the deployment's own storage credentials instead of redirecting to a signed URL. The ExportStorage protocol swaps generate_download_url for a chunked download method (FileNotFoundError becomes a clean 410), and the whole signing apparatus is removed: the GCS signBlob fallback, the serviceAccountTokenCreator prerequisite, the presigned TTL, and their docs. Security model is unchanged (the unguessable job id remains the credential) and strictly tighter: no transferable bearer URL is ever minted, and every download is observable and revocable server side. Unit and integration suites updated and green. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
