symbolicator
symbolicator copied to clipboard
Allow dynamic credentials when fetching symbols from GCS in the GCP environment
GCP/GKE can provide dynamic credentials without having to specify static secrets such as client_email and private_key. This is security best practice. Here is a high level overview:
https://cloud.google.com/docs/authentication/application-default-credentials
We already use this approach for the shared cache by using the gcp_auth library:
https://github.com/getsentry/symbolicator/blob/12d4b31d74a3dc28ffdd77cf472b97ac7d10fc24/crates/symbolicator-service/src/caching/shared_cache/mod.rs#L103
We will probably need to expand the structure here: https://github.com/getsentry/symbolicator/blob/12d4b31d74a3dc28ffdd77cf472b97ac7d10fc24/crates/symbolicator-sources/src/sources/gcs.rs#L66-L74 and add the branch for the dynamic case somewhere here: https://github.com/getsentry/symbolicator/blob/12d4b31d74a3dc28ffdd77cf472b97ac7d10fc24/crates/symbolicator-service/src/download/gcs.rs#L43
See the end goal in https://github.com/getsentry/getsentry/pull/16971