feat: Skip RAB lookup in case of non-email response from MDS.#13331
feat: Skip RAB lookup in case of non-email response from MDS.#13331vverman wants to merge 4 commits into
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates ComputeEngineCredentials to return null for the Regional Access Boundary (RAB) URL if the service account is null or does not contain '@', which can happen with default service accounts in GKE environments. It also updates RegionalAccessBoundaryManager to handle a null URL gracefully, and adds a unit test to verify this behavior. There are no review comments, so I have no feedback to provide.
| if (url == null) { | ||
| future.set(null); | ||
| return; | ||
| } |
There was a problem hiding this comment.
qq, can you remind me again why we need to do future.set(null);?
There was a problem hiding this comment.
I was using a SettableFuture as a gate to deduplicate RAB refreshes which let's us set the future to indicate to dependent threads as to the result of the refresh.
However, I realized the same can be done with AtomicBoolean which is more easier to maintain. Hence updated the logic.
…olean for ease of reading.
2 participants
In ComputeEngineCredentials when running on GKE platform, the getAccount() call may return a value which isn't an email.
In this case the right behaviour is to skip RAB lookup which is what this PR does.
Added tests.