opensearch-project/OpenSearch

Support GCP Workload Identity in the repository-gcs plugin

Open

#11,224 opened on Nov 15, 2023

View on GitHub
 (12 comments) (4 reactions) (1 assignee)Java (1,505 forks)batch import
Storage:Snapshotsenhancementgood first issuelow hanging fruit

Repository metrics

Stars
 (8,123 stars)
PR merge metrics
 (Avg merge 5d 9h) (266 merged PRs in 30d)

Description

Is your feature request related to a problem? Please describe. Storing snapshots with the repository-gcs plugin requires a gcp service account key that's stored as a kubernetes secret. We'd like to avoid this secret as it requires additional overhead like periodically rotating the secret for security. GCP's Workload Identity feature would be a better alternative that avoids the need for a secret.

Describe the solution you'd like Use GCP's workload identity feature for authentication in the repository-gcs plugin.

Describe alternatives you've considered A clear and concise description of any alternative solutions or features you've considered.

Additional context Add any other context or screenshots about the feature request here.

Contributor guide

Research direction
Understand how repository gcs plugin authenticates currently with service account keys. Study GCP Workload Identity documentation and find ways to integrate it, likely using GCP metadata server or environment credentials. Look for existing examples in other open source projects.
Tech stack
javagcp
Domain
backendcloudsecurityauthenticationapi
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
3-5 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
JavaGCP Workload IdentityOpenSearch plugins
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
50