ansible-collections/google.cloud
1
0
Fork 0
mirror of https://github.com/ansible-collections/google.cloud.git synced 2025-07-23 05:10:29 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Improve error handling for auth_kind 'serviceaccount'

Browse source 
Fixes ansible-collections/google.cloud#538.
This commit is contained in:
S. Shuck 2022-12-23 14:33:47 -05:00 • committed by Yusuke Tsutsumi
commit 226ec3dd3f
2 changed files with 27 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

39
plugins/module_utils/gcp_utils.py
View file

@ -215,27 +215,40 @@ class GcpSession(object):
def _credentials(self):
cred_type = self.module.params['auth_kind']
if cred_type == 'application':
credentials, project_id = google.auth.default(scopes=self.module.params['scopes'])
return credentials
if cred_type == 'serviceaccount' and self.module.params.get('service_account_file'):
path = os.path.realpath(os.path.expanduser(self.module.params['service_account_file']))
if not os.path.exists(path):
if cred_type == 'serviceaccount':
service_account_file = self.module.params.get('service_account_file')
service_account_contents = self.module.params.get('service_account_contents')
if service_account_file is not None:
path = os.path.realpath(os.path.expanduser(service_account_file))
try:
svc_acct_creds = service_account.Credentials.from_service_account_file(path)
except OSError as e:
self.module.fail_json(
msg="Unable to read service_account_file at %s: %s" % (path, e.strerror)
)
elif service_account_contents is not None:
try:
info = json.loads(service_account_contents)
except json.decoder.JSONDecodeError as e:
self.module.fail_json(
msg="Unable to decode service_account_contents as JSON: %s" % e
)
svc_acct_creds = service_account.Credentials.from_service_account_info(info)
else:
self.module.fail_json(
msg="Unable to find service_account_file at '%s'" % path
msg='Service Account authentication requires setting either service_account_file or service_account_contents'
)
return service_account.Credentials.from_service_account_file(path).with_scopes(self.module.params['scopes'])
if cred_type == 'serviceaccount' and self.module.params.get('service_account_contents'):
try:
cred = json.loads(self.module.params.get('service_account_contents'))
except json.decoder.JSONDecodeError as e:
self.module.fail_json(
msg="Unable to decode service_account_contents as JSON"
)
return service_account.Credentials.from_service_account_info(cred).with_scopes(self.module.params['scopes'])
return svc_acct_creds.with_scopes(self.module.params['scopes'])
if cred_type == 'machineaccount':
return google.auth.compute_engine.Credentials(
self.module.params['service_account_email'])
self.module.fail_json(msg="Credential type '%s' not implemented" % cred_type)
def _headers(self):