Skip to content

WIP - Support to create resources in GCP setting GOOGLE_CREDENTIAL_APPLICATIONS (via oblt-google-auth-buildkite-plugin) #3167

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
mrodm wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

WIP - Support to create resources in GCP setting GOOGLE_CREDENTIAL_APPLICATIONS (via oblt-google-auth-buildkite-plugin) #3167

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
60f871d
Add volume mount in elastic-agent for credential_source file
mrodm Dec 18, 2025
1506bba
Add file set in GOOGLE_APPLICATION_CREDENTIALS too
mrodm Dec 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions internal/agentdeployer/_static/docker-agent-base.yml.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,8 @@
{{- $agent_version := fact "agent_version" }}
{{- $agent_image := fact "agent_image" }}
{{- $enrollment_token := fact "enrollment_token" }}
{{- $google_application_credentials := fact "google_application_credentials" -}}
{{- $google_credential_source_file := fact "google_credential_source_file" -}}
services:
elastic-agent:
hostname: ${AGENT_HOSTNAME}
Expand Down Expand Up @@ -62,5 +64,21 @@ services:
source: ${SERVICE_LOGS_DIR}
target: /run/service_logs/
read_only: false
{{ if ne $google_application_credentials "" }}
# Mount Google Application Credentials file provided
# Required for external accounts authentication when creating resources via terraform in GCP
- type: bind
source: {{ $google_application_credentials }}
target: {{ $google_application_credentials }}
read_only: true
{{ end }}
{{ if ne $google_credential_source_file "" }}
# Mount Google credential source file (token file) provided
# Required for external accounts authentication when creating resources via terraform in GCP
- type: bind
source: {{ $google_credential_source_file }}
target: {{ $google_credential_source_file }}
read_only: true
{{ end }}
extra_hosts:
- "host.docker.internal:host-gateway"
44 changes: 31 additions & 13 deletions internal/agentdeployer/agent.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -306,21 +306,39 @@ func (d *DockerComposeAgentDeployer) installDockerCompose(ctx context.Context, a
return "", nil
}

googleApplicationCredentials := os.Getenv("GOOGLE_APPLICATION_CREDENTIALS")
if googleApplicationCredentials != "" {
if _, err := os.Stat(googleApplicationCredentials); err != nil {
logger.Warn("GOOGLE_APPLICATION_CREDENTIALS environment variable is set, but the file does not exist. Skipping inclusion in agent configuration.")
googleApplicationCredentials = ""
}
}

googleCredentialSourceFile := os.Getenv("GOOGLE_CREDENTIAL_SOURCE_FILE")
if googleCredentialSourceFile != "" {
if _, err := os.Stat(googleCredentialSourceFile); err != nil {
logger.Warn("GOOGLE_CREDENTIAL_SOURCE_FILE environment variable is set, but the file does not exist. Skipping inclusion in agent configuration.")
googleCredentialSourceFile = ""
}
}

resourceManager := resource.NewManager()
resourceManager.AddFacter(resource.StaticFacter{
"agent_image": agentImage,
"user": agentInfo.Agent.User,
"capabilities": strings.Join(agentInfo.Agent.LinuxCapabilities, ","),
"runtime": agentInfo.Agent.Runtime,
"pid_mode": agentInfo.Agent.PidMode,
"ports": strings.Join(agentInfo.Agent.Ports, ","),
"dockerfile_hash": hex.EncodeToString(hashDockerfile),
"agent_version": agentVersion,
"fleet_url": fleetURL,
"kibana_host": stack.DockerInternalHost(kibanaHost),
"elasticsearch_username": config.ElasticsearchUsername,
"elasticsearch_password": config.ElasticsearchPassword,
"enrollment_token": enrollmentToken,
"agent_image": agentImage,
"user": agentInfo.Agent.User,
"capabilities": strings.Join(agentInfo.Agent.LinuxCapabilities, ","),
"runtime": agentInfo.Agent.Runtime,
"pid_mode": agentInfo.Agent.PidMode,
"ports": strings.Join(agentInfo.Agent.Ports, ","),
"dockerfile_hash": hex.EncodeToString(hashDockerfile),
"agent_version": agentVersion,
"fleet_url": fleetURL,
"kibana_host": stack.DockerInternalHost(kibanaHost),
"elasticsearch_username": config.ElasticsearchUsername,
"elasticsearch_password": config.ElasticsearchPassword,
"enrollment_token": enrollmentToken,
"google_credential_source_file": googleCredentialSourceFile,
"google_application_credentials": googleApplicationCredentials,
})

resourceManager.RegisterProvider("file", &resource.FileProvider{
Expand Down