feat: Regional access boundaries#12766
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces support for Regional Access Boundaries (RAB) across various credential types, including Compute Engine, External Account, and Service Account credentials. It adds a RegionalAccessBoundaryManager to handle the asynchronous fetching, caching, and cooldown logic for RAB data, which is then included as an x-allowed-locations header in outgoing requests. Feedback includes removing unnecessary .rej files from the repository, replacing an unbounded thread pool with a bounded one for safety, and simplifying the logic for adding quota project IDs to request metadata.
...va/oauth2_http/java/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentials.java.rej
Outdated
Show resolved
Hide resolved
...auth-library-java/oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundaryManager.java
Outdated
Show resolved
Hide resolved
google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java
Outdated
Show resolved
Hide resolved
|
Closing this one out. Will open a PR to bring the lib upto speed with previous lib's RAB changes. Will open another PR for RAB env variable gate removal and using executor. |
1 participant
Contains changes for the feature Regional Access Boundary (Previously Called Trust Boundaries).
The following are salient changes: