cube-js/cube

Can router and workers can support GKE Workload Identity ?

Open

#7,279 opened on Oct 19, 2023

View on GitHub
 (1 comment) (8 reactions) (0 assignees)Rust (19,563 stars) (1,965 forks)batch import
help wanted

Description

Is your feature request related to a problem? Please describe. Without defining "CUBESTORE_GCP_KEY_FILE" in router and worker, I got below error: thread 'main' panicked at 'SERVICE_ACCOUNT(_JSON) or GOOGLE_APPLICATION_CREDENTIALS(_JSON) environment parameter required: NotPresent'

Describe the solution you'd like Workload Identity allows a Kubernetes service account in your GKE cluster to act as an IAM service account. Pods that use the configured Kubernetes service account automatically authenticate as the IAM service account when accessing Google Cloud APIs.

Referring to https://cube.dev/docs/reference/configuration/environment-variables#cubestore_gcp_key_file "CUBESTORE_GCP_KEY_FILE" is Required when using Google Cloud Storage and A valid Google Cloud JSON key file is needed.

is there possible to support GKE Workload Identity in future?

Contributor guide

Tech stack
rustkubernetesgcp
Domain
infrastructurecloud
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
Kubernetes basicsGCP IAMCube Store configuration
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
30
Research direction
Investigate the Cube Store credentials initialization code (likely in the Rust crate for GCP storage). The error message indicates that SERVICE ACCOUNT or GOOGLE APPLICATION CREDENTIALS env vars are required. To support Workload Identity, the code should check if running on GKE (e.g., via metadata server) and use Application Default Credentials if no explicit key file is provided. Review the GCP SDK integration and see if ADC is automatically used. The issue references Cube Store documentation; ensure any changes are backward compatible.