@@ -12,6 +12,7 @@ import (
1212 "os"
1313 "path/filepath"
1414 "runtime"
15+ "sync"
1516 "time"
1617
1718 "cloud.google.com/go/compute/metadata"
@@ -41,19 +42,76 @@ type Credentials struct {
4142 // running on Google Cloud Platform.
4243 JSON []byte
4344
45+ udMu sync.Mutex // guards universeDomain
4446 // universeDomain is the default service domain for a given Cloud universe.
4547 universeDomain string
4648}
4749
4850// UniverseDomain returns the default service domain for a given Cloud universe.
51+ //
4952// The default value is "googleapis.com".
53+ //
54+ // Deprecated: Use instead (*Credentials).GetUniverseDomain(), which supports
55+ // obtaining the universe domain when authenticating via the GCE metadata server.
56+ // Unlike GetUniverseDomain, this method, UniverseDomain, will always return the
57+ // default value when authenticating via the GCE metadata server.
58+ // See also [The attached service account](https://cloud.google.com/docs/authentication/application-default-credentials#attached-sa).
5059func (c * Credentials ) UniverseDomain () string {
5160 if c .universeDomain == "" {
5261 return universeDomainDefault
5362 }
5463 return c .universeDomain
5564}
5665
66+ // GetUniverseDomain returns the default service domain for a given Cloud
67+ // universe.
68+ //
69+ // The default value is "googleapis.com".
70+ //
71+ // It obtains the universe domain from the attached service account on GCE when
72+ // authenticating via the GCE metadata server. See also [The attached service
73+ // account](https://cloud.google.com/docs/authentication/application-default-credentials#attached-sa).
74+ // If the GCE metadata server returns a 404 error, the default value is
75+ // returned. If the GCE metadata server returns an error other than 404, the
76+ // error is returned.
77+ func (c * Credentials ) GetUniverseDomain () (string , error ) {
78+ c .udMu .Lock ()
79+ defer c .udMu .Unlock ()
80+ if c .universeDomain == "" && metadata .OnGCE () {
81+ // If we're on Google Compute Engine, an App Engine standard second
82+ // generation runtime, or App Engine flexible, use the metadata server.
83+ err := c .computeUniverseDomain ()
84+ if err != nil {
85+ return "" , err
86+ }
87+ }
88+ // If not on Google Compute Engine, or in case of any non-error path in
89+ // computeUniverseDomain that did not set universeDomain, set the default
90+ // universe domain.
91+ if c .universeDomain == "" {
92+ c .universeDomain = universeDomainDefault
93+ }
94+ return c .universeDomain , nil
95+ }
96+
97+ // computeUniverseDomain fetches the default service domain for a given Cloud
98+ // universe from Google Compute Engine (GCE)'s metadata server. It's only valid
99+ // to use this method if your program is running on a GCE instance.
100+ func (c * Credentials ) computeUniverseDomain () error {
101+ var err error
102+ c .universeDomain , err = metadata .Get ("universe/universe_domain" )
103+ if err != nil {
104+ if _ , ok := err .(metadata.NotDefinedError ); ok {
105+ // http.StatusNotFound (404)
106+ c .universeDomain = universeDomainDefault
107+ return nil
108+ } else {
109+ return err
110+ }
111+ }
112+ return nil
113+ }
114+
57115// DefaultCredentials is the old name of Credentials.
58116//
59117// Deprecated: use Credentials instead.
@@ -91,6 +149,12 @@ type CredentialsParams struct {
91149 // Note: This option is currently only respected when using credentials
92150 // fetched from the GCE metadata server.
93151 EarlyTokenRefresh time.Duration
152+
153+ // UniverseDomain is the default service domain for a given Cloud universe.
154+ // Only supported in authentication flows that support universe domains.
155+ // This value takes precedence over a universe domain explicitly specified
156+ // in a credentials config file or by the GCE metadata server. Optional.
157+ UniverseDomain string
94158}
95159
96160func (params CredentialsParams ) deepCopy () CredentialsParams {
@@ -175,8 +239,9 @@ func FindDefaultCredentialsWithParams(ctx context.Context, params CredentialsPar
175239 if metadata .OnGCE () {
176240 id , _ := metadata .ProjectID ()
177241 return & Credentials {
178- ProjectID : id ,
179- TokenSource : computeTokenSource ("" , params .EarlyTokenRefresh , params .Scopes ... ),
242+ ProjectID : id ,
243+ TokenSource : computeTokenSource ("" , params .EarlyTokenRefresh , params .Scopes ... ),
244+ universeDomain : params .UniverseDomain ,
180245 }, nil
181246 }
182247
@@ -217,6 +282,9 @@ func CredentialsFromJSONWithParams(ctx context.Context, jsonData []byte, params
217282 }
218283
219284 universeDomain := f .UniverseDomain
285+ if params .UniverseDomain != "" {
286+ universeDomain = params .UniverseDomain
287+ }
220288 // Authorized user credentials are only supported in the googleapis.com universe.
221289 if f .Type == userCredentialsKey {
222290 universeDomain = universeDomainDefault
0 commit comments