Feature Request: Support universe_domain for Sovereign Google Cloud Environments
#242
Comments
matgou
added a commit
to matgou/vault-plugin-secrets-gcp
that referenced
this issue
Feb 27, 2025
This commit introduces a new `universe_domain` parameter to the plugin configuration, allowing users to specify the Google Cloud environment for client connections. This enables support for specialized offerings and sovereign controls beyond the default googleapis.com. Key changes: - Added `universe_domain` field to the plugin configuration. - Modified IAM client creation to use the configured `universe_domain`. - Updated credentials parsing to utilize `cloud.google.com/go/auth/credentials.DetectDefault` and support local-signing JWT generation. - Adjusted token generation to use `cloud.google.com/go/auth/credentials.DetectDefault` for credential handling.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Recent updates to the Google Cloud SDK have introduced the
universe_domainparameter (see: googleapis/google-cloud-go#11059). This parameter is essential for connecting to Google Cloud services within sovereign cloud environments, which utilize distinct endpoints than iamcredentials.googleapis.com.Currently, the
vault-plugin-secrets-gcpplugin lacks support for this parameter, effectively preventing its use in those environments.Proposed Solution:
I propose adding support for the
universe_domainparameter to the plugin's configuration. This could be achieved by:universe_domainwithin the plugin's setup configuration.Important Consideration for Non-GDU Environments:
It's crucial to note that in non-Google Distributed Cloud (GDU) environments, a standard OAuth2 server may not be present (like oauth2.googleapis.com). Consequently, the plugin should be designed to use the IAM implementation for self-signed JWT authentication.
Importance of This Feature:
Implementing
universe_domainsupport is vital for enabling thevault-plugin-secrets-gcpplugin to function within sovereign cloud environments.The text was updated successfully, but these errors were encountered: