Skip to content
This repository was archived by the owner on Mar 6, 2026. It is now read-only.

feat: allow users to call default service account endpoint if no email is passed #1687

Closed
harkamaljot wants to merge 6 commits into from
Closed

feat: allow users to call default service account endpoint if no email is passed #1687

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
92e8b96
do not update email addresses from mds
harkamaljot Mar 3, 2025
768b628
test changes
harkamaljot Mar 3, 2025
5522ab0
update tests and update secret
harkamaljot Mar 4, 2025
f756ba6
implement review changes
harkamaljot Apr 9, 2025
02bb9cf
fix broken tests
harkamaljot Apr 9, 2025
15d008a
Merge branch 'main' into default-service-account-endpoint
harkamaljot Apr 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions google/auth/compute_engine/credentials.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,8 +100,6 @@ def _retrieve_info(self, request):
request, service_account=self._service_account_email
)

self._service_account_email = info["email"]

# Don't override scopes requested by the user.
if self._scopes is None:
Comment thread
harkamaljot marked this conversation as resolved.
Outdated
self._scopes = info["scopes"]
Expand Down
Binary file modified system_tests/secrets.tar.enc
View file
Open in desktop
Binary file not shown.
8 changes: 4 additions & 4 deletions tests/compute_engine/test_credentials.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,7 +120,7 @@ def test_refresh_success(self, get, utcnow):
assert self.credentials.expiry == (utcnow() + datetime.timedelta(seconds=500))

# Check the credential info
assert self.credentials.service_account_email == "service-account@example.com"
assert self.credentials.service_account_email == "default"
Comment thread
harkamaljot marked this conversation as resolved.
assert self.credentials._scopes == ["one", "two"]

# Check that the credentials are valid (have a token and are not
Expand Down Expand Up @@ -160,7 +160,7 @@ def test_refresh_success_with_scopes(self, get, utcnow, mock_metrics_header_valu
assert self.credentials.expiry == (utcnow() + datetime.timedelta(seconds=500))

# Check the credential info
assert self.credentials.service_account_email == "service-account@example.com"
assert self.credentials.service_account_email == "default"
assert self.credentials._scopes == scopes

# Check that the credentials are valid (have a token and are not
Expand Down Expand Up @@ -501,7 +501,7 @@ def test_with_target_audience_integration(self):
responses.add(
responses.GET,
"http://metadata.google.internal/computeMetadata/v1/instance/"
"service-accounts/service-account@example.com/token",
"service-accounts/default/token",
status=200,
content_type="application/json",
json={
Expand Down Expand Up @@ -659,7 +659,7 @@ def test_with_quota_project_integration(self):
responses.add(
responses.GET,
"http://metadata.google.internal/computeMetadata/v1/instance/"
"service-accounts/service-account@example.com/token",
"service-accounts/default/token",
status=200,
content_type="application/json",
json={
Expand Down