From a6d20bd65c7d2417c142798c9fe2e7e89f04ff9e Mon Sep 17 00:00:00 2001 From: David van der Spek Date: Fri, 13 Dec 2024 14:00:32 +0100 Subject: [PATCH] fix(google): set default scope for sa impersonation Signed-off-by: David van der Spek --- google/google.go | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/google/google.go b/google/google.go index 7b82e7a08..505d2591a 100644 --- a/google/google.go +++ b/google/google.go @@ -192,6 +192,12 @@ func (f *credentialsFile) tokenSource(ctx context.Context, params CredentialsPar tok := &oauth2.Token{RefreshToken: f.RefreshToken} return cfg.TokenSource(ctx, tok), nil case externalAccountKey: + scopes := params.Scopes + if f.ServiceAccountImpersonationURL != "" { + if len(scopes) == 0 { + scopes = []string{"https://www.googleapis.com/auth/cloud-platform"} + } + } cfg := &externalaccount.Config{ Audience: f.Audience, SubjectTokenType: f.SubjectTokenType, @@ -203,7 +209,7 @@ func (f *credentialsFile) tokenSource(ctx context.Context, params CredentialsPar ClientID: f.ClientID, CredentialSource: &f.CredentialSource, QuotaProjectID: f.QuotaProjectID, - Scopes: params.Scopes, + Scopes: scopes, WorkforcePoolUserProject: f.WorkforcePoolUserProject, } return externalaccount.NewTokenSource(ctx, *cfg) @@ -229,10 +235,14 @@ func (f *credentialsFile) tokenSource(ctx context.Context, params CredentialsPar if err != nil { return nil, err } + scopes := params.Scopes + if len(scopes) == 0 { + scopes = []string{"https://www.googleapis.com/auth/cloud-platform"} + } imp := impersonate.ImpersonateTokenSource{ Ctx: ctx, URL: f.ServiceAccountImpersonationURL, - Scopes: params.Scopes, + Scopes: scopes, Ts: ts, Delegates: f.Delegates, }