Class GCSClientHelper
- All Implemented Interfaces:
Serializable
Storage client from Application Default
Credentials (ADC).
ADC resolves Workload Identity on GKE, GOOGLE_APPLICATION_CREDENTIALS, or gcloud user
credentials locally — no HMAC keys and no service-account JSON on disk.
The upload/download of a cache runs on the build agent (see the *Callable classes),
which may not share the controller's Google identity. To keep the IAM grant on the controller
only, this helper mints a short-lived OAuth access token from ADC on the controller and
ships it to the agent. That token is downscoped with a Credential Access Boundary to
objectAdmin on the single configured bucket, so an untrusted build cannot use it against
any other bucket the controller identity can reach. If a downscoped token cannot be minted (e.g.
end-user ADC that does not support token exchange), no token is shipped and the agent falls back
to resolving its own ADC (e.g. Workload Identity bound to the agent pod).
- See Also:
-
Method Summary