symbolicator icon indicating copy to clipboard operation
symbolicator copied to clipboard

Allow dynamic credentials when fetching symbols from GCS in the GCP environment

Open oioki opened this issue 7 months ago • 1 comments

GCP/GKE can provide dynamic credentials without having to specify static secrets such as client_email and private_key. This is security best practice. Here is a high level overview: https://cloud.google.com/docs/authentication/application-default-credentials

We already use this approach for the shared cache by using the gcp_auth library: https://github.com/getsentry/symbolicator/blob/12d4b31d74a3dc28ffdd77cf472b97ac7d10fc24/crates/symbolicator-service/src/caching/shared_cache/mod.rs#L103

We will probably need to expand the structure here: https://github.com/getsentry/symbolicator/blob/12d4b31d74a3dc28ffdd77cf472b97ac7d10fc24/crates/symbolicator-sources/src/sources/gcs.rs#L66-L74 and add the branch for the dynamic case somewhere here: https://github.com/getsentry/symbolicator/blob/12d4b31d74a3dc28ffdd77cf472b97ac7d10fc24/crates/symbolicator-service/src/download/gcs.rs#L43

See the end goal in https://github.com/getsentry/getsentry/pull/16971

oioki avatar Mar 19 '25 13:03 oioki