mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-16 05:20:22 +08:00
Robert Sturla
48545cfb59
* feat(core): add shared GCP constants module Single source of truth for GCP naming: env var aliases, provider config keys, token search order, and Vertex-specific env vars. Consumed by openshell-server, openshell-providers, and openshell-sandbox. - Add google_cloud.rs with metadata emulator host and loopback address - Define PROJECT_ID, REGION, and SERVICE_ACCOUNT_EMAIL env var aliases - Add provider config key constants for gcp provider implementations - Define TOKEN_ENV_KEYS search order (SA token takes priority over ADC) - Add Vertex-specific env vars for Goose and Claude Code SDK integration - Add STATIC_CONFIG_KEYS as union of all alias arrays for env resolution - Export module via openshell-core lib.rs Signed-off-by: Robert Sturla <rsturla@redhat.com> * feat(providers): add google-cloud and vertex provider plugins Add GoogleCloudProvider and VertexProvider implementing inject_env to project GCP config (project ID, region, SA email, metadata host) into sandbox environment variables. Replace the inline Vertex AI env injection in the server with the registry-based inject_env dispatch. Also adds the google-cloud.yaml provider profile with SA JWT and ADC OAuth2 credential refresh flows. Signed-off-by: Robert Sturla <rsturla@redhat.com> * feat(sandbox): add GCE metadata emulator for GCP Add a loopback HTTP server on 127.0.0.1:8174 inside the sandbox network namespace that emulates the GCE instance metadata API. GCP client SDKs discover it via GCE_METADATA_HOST and obtain credential placeholders that the proxy resolves to real tokens at egress. Add metadata_server module with MetadataHandler trait and netns-aware TCP binding via std::thread (not spawn_blocking) to avoid tokio pool namespace contamination Add google_cloud_metadata module implementing the GCE metadata API subset (token, project-id, email, scopes, service-accounts) Add child_env_resolved() and gcp_token_response() to ProviderCredentialState for GCP-aware credential projection Wire metadata server into sandbox lifecycle before SSH handler Collapse multi-line HTTP response format string into single line Signed-off-by: Robert Sturla <rsturla@redhat.com> * docs(sandbox): add GCP credentials documentation Document the google-cloud provider setup for ADC and service account flows, injected environment variables, metadata emulator behavior, and network policy configuration for GCP APIs. Signed-off-by: Robert Sturla <rsturla@redhat.com> * feat(cli): support --from-gcloud-adc for google-cloud providers Widen --from-gcloud-adc to accept google-cloud providers. The ADC credential key is derived from the provider profile rather than hardcoded per type, so future GCP provider types get ADC support by declaring the right refresh metadata in their profile YAML. Add ProviderTypeProfile::adc_credential() to find the ADC-compatible credential from a profile's refresh metadata. Remove unused VERTEX_AI_ADC_TOKEN_KEY and GCP_ADC_TOKEN_KEY constants. Signed-off-by: Robert Sturla <rsturla@redhat.com> --------- Signed-off-by: Robert Sturla <rsturla@redhat.com>
65 lines
2.3 KiB
YAML
65 lines
2.3 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
id: google-cloud
|
|
display_name: Google Cloud (GCP APIs)
|
|
description: Native GCP SDK credentials for sandboxes via metadata emulator
|
|
category: other
|
|
inference_capable: false
|
|
|
|
credentials:
|
|
# Service account JWT flow: gateway signs a JWT and exchanges it for an
|
|
# access token. Configure with `openshell provider refresh configure`.
|
|
- name: service_account_token
|
|
description: GCP access token minted from service account JWT
|
|
env_vars: [GCP_SA_ACCESS_TOKEN]
|
|
required: false
|
|
auth_style: bearer
|
|
header_name: authorization
|
|
refresh:
|
|
strategy: google_service_account_jwt
|
|
token_url: https://oauth2.googleapis.com/token
|
|
scopes: [https://www.googleapis.com/auth/cloud-platform]
|
|
refresh_before_seconds: 300
|
|
max_lifetime_seconds: 3600
|
|
material:
|
|
- name: client_email
|
|
description: Service account email address
|
|
required: true
|
|
- name: private_key
|
|
description: Service account RSA private key (PEM)
|
|
required: true
|
|
secret: true
|
|
- name: subject
|
|
description: Email for domain-wide delegation (optional)
|
|
|
|
# ADC OAuth2 flow: gateway exchanges a gcloud ADC refresh token for an
|
|
# access token. Configure with `openshell provider refresh configure`.
|
|
- name: adc_token
|
|
description: GCP access token from gcloud application default credentials
|
|
env_vars: [GCP_ADC_ACCESS_TOKEN]
|
|
required: false
|
|
auth_style: bearer
|
|
header_name: authorization
|
|
refresh:
|
|
strategy: oauth2_refresh_token
|
|
token_url: https://oauth2.googleapis.com/token
|
|
scopes: [https://www.googleapis.com/auth/cloud-platform]
|
|
refresh_before_seconds: 300
|
|
max_lifetime_seconds: 3600
|
|
material:
|
|
- name: client_id
|
|
description: OAuth2 client ID from ADC JSON
|
|
required: true
|
|
- name: client_secret
|
|
description: OAuth2 client secret from ADC JSON
|
|
required: true
|
|
secret: true
|
|
- name: refresh_token
|
|
description: OAuth2 refresh token from ADC JSON
|
|
required: true
|
|
secret: true
|
|
|
|
discovery:
|
|
credentials: [service_account_token, adc_token]
|