-
Notifications
You must be signed in to change notification settings - Fork 1.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore(pubsub): add subscriber role test for streaming #9507
Conversation
pubsub/tests/system.py
Outdated
|
||
# TODO: A service account granting only the pubsub.subscriber role must | ||
# be used | ||
filename = "/some/service/account/file.json.json" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@busunkim96 Let's talk offline on how to inject such service account into Kokoro environment, and how to do the same for the convenience of developers (we cannot commit the actual service account .json
key file, of course).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There is now a service account with just Pub/Sub subscriber in ${KOKORO_GFILE_DIR}/pubsub-subscriber-service-account.json
You can set an environment variable in https://github.com/googleapis/google-cloud-python/blob/master/.kokoro/build.sh
I think there may actually be a way to use the existing service account to create a short-lived credential with only the Pub/Sub subscriber role. See https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials#sa-credentials-permissions and https://google-auth.readthedocs.io/en/latest/reference/google.auth.impersonated_credentials.html#module-google.auth.impersonated_credentials
This would also be nicer for developers trying to run the tests (they don't have to worry about having a separate service account with the correct role)
Pulling the messages using a streaming pull should work with accounts having only the pubsub.subscriber role. This commits add a test that covers this aspect.
626e057
to
80f051a
Compare
The test now correctly fails with 403 if the regression from #9339 is re-introduced. I opted to not add the path to the special service account file in I haven't explored the short-lived service accounts for local development yet, I got around it by skipping the test if not inside the Kokoro environment (but that could still be faked locally, if needed). |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good. Thank you, Peter!
Yay, merging then. |
Fixes #9382.
Pulling the messages using a streaming pull should work with accounts having only the
pubsub.subscriber
role. This commits adds a test that covers this aspect.How to test
test_streaming_pull_subscriber_permissions_sufficient
.Expected result:
The test should fail (permission error), proving that it would catch the regression in #9339, and undoing the above patch makes the test pass.