Users can't specify non-default scopes for code running on GKE Workload Identity (and possibly AppEngine flex)

[ahmedtd]

The ComputeEngineCredentials class is used for pulling access and identity tokens when the library is running on GCE, GKE Workload Identity, and AppEngine flex. It doesn't support setting scopes on the resulting access token, because on GCE scopes are handled by assigning them to the VM.

However, this isn't the case on GKE Workload Identity (and possibly AppEngine flex, I am still confirming this). In this environment, there is no concept of a scope lock or default scopes for the access token. Instead the metadata server accepts a ?scopes query parameter on the /computeMetadata/v1/instance/service-accounts/default/token request and creates an access token with the requested scopes.

If no ?scopes are specified, then the returned access tokens has a hardcoded default set of scopes (cloud-platform and userInfo.email).

This means that users of ComputeEngineCredentials don't have a way to use non-cloud Google APIs when running on GKE Workload Identity, since non-cloud APIs are not included in the cloud-platform access scope.

The GCE Metadata Server accepts the ?scopes parameter without complaint, but ignores it.

I'd like to extend the ComputeEngineCredentials class with a createScoped implementation that will make a new ComputeEngineCredentials instance that passes the ?scopes query parameter, so that code like this will work when running on GKE Workload Identity:

GoogleCredentials.getApplicationDefault().createScoped("https://www.googleapis.com/auth/androidpublisher");