Skip to content

Commit aa7a115

Browse files
antontroshinmsfussell
antontroshin
and
msfussell
authored
Update documentation for GCP Secret Manager and Object Store support of implicit authentication (#4592)
Signed-off-by: Anton Troshin <[email protected]> Co-authored-by: Mark Fussell <[email protected]>
1 parent f83e3dc commit aa7a115

File tree

3 files changed

+32
-21
lines changed

3 files changed

+32
-21
lines changed

‎daprdocs/content/en/reference/components-reference/supported-bindings/gcpbucket.md

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -58,19 +58,24 @@ The above example uses secrets as plain strings. It is recommended to use a secr
5858
| Field | Required | Binding support | Details | Example |
5959
|--------------------|:--------:|------------|-----|---------|
6060
| `bucket` | Y | Output | The bucket name | `"mybucket"` |
61-
| `type` | Y | Output | Tge GCP credentials type | `"service_account"` |
62-
| `project_id` | Y | Output | GCP project id| `projectId`
63-
| `private_key_id` | Y | Output | GCP private key id | `"privateKeyId"`
64-
| `private_key` | Y | Output | GCP credentials private key. Replace with x509 cert | `12345-12345`
65-
| `client_email` | Y | Output | GCP client email | `"[email protected]"`
66-
| `client_id` | Y | Output | GCP client id | `0123456789-0123456789`
67-
| `auth_uri` | Y | Output | Google account OAuth endpoint | `https://accounts.google.com/o/oauth2/auth`
68-
| `token_uri` | Y | Output | Google account token uri | `https://oauth2.googleapis.com/token`
69-
| `auth_provider_x509_cert_url` | Y | Output | GCP credentials cert url | `https://www.googleapis.com/oauth2/v1/certs`
70-
| `client_x509_cert_url` | Y | Output | GCP credentials project x509 cert url | `https://www.googleapis.com/robot/v1/metadata/x509/<PROJECT_NAME>.iam.gserviceaccount.com`
61+
| `project_id` | Y | Output | GCP project ID | `projectId` |
62+
| `type` | N | Output | The GCP credentials type | `"service_account"` |
63+
| `private_key_id` | N | Output | If using explicit credentials, this field should contain the `private_key_id` field from the service account json document | `"privateKeyId"` |
64+
| `private_key` | N | Output | If using explicit credentials, this field should contain the `private_key` field from the service account json. Replace with x509 cert | `12345-12345` |
65+
| `client_email` | N | Output | If using explicit credentials, this field should contain the `client_email` field from the service account json | `"[email protected]"` |
66+
| `client_id` | N | Output | If using explicit credentials, this field should contain the `client_id` field from the service account json | `0123456789-0123456789` |
67+
| `auth_uri` | N | Output | If using explicit credentials, this field should contain the `auth_uri` field from the service account json | `https://accounts.google.com/o/oauth2/auth` |
68+
| `token_uri` | N | Output | If using explicit credentials, this field should contain the `token_uri` field from the service account json | `https://oauth2.googleapis.com/token`|
69+
| `auth_provider_x509_cert_url` | N | Output | If using explicit credentials, this field should contain the `auth_provider_x509_cert_url` field from the service account json | `https://www.googleapis.com/oauth2/v1/certs`|
70+
| `client_x509_cert_url` | N | Output | If using explicit credentials, this field should contain the `client_x509_cert_url` field from the service account json | `https://www.googleapis.com/robot/v1/metadata/x509/<PROJECT_NAME>.iam.gserviceaccount.com`|
7171
| `decodeBase64` | N | Output | Configuration to decode base64 file content before saving to bucket storage. (In case of saving a file with binary content). `true` is the only allowed positive value. Other positive variations like `"True", "1"` are not acceptable. Defaults to `false` | `true`, `false` |
7272
| `encodeBase64` | N | Output | Configuration to encode base64 file content before return the content. (In case of opening a file with binary content). `true` is the only allowed positive value. Other positive variations like `"True", "1"` are not acceptable. Defaults to `false` | `true`, `false` |
7373

74+
## GCP Credentials
75+
76+
Since the GCP Storage Bucket component uses the GCP Go Client Libraries, by default it authenticates using **Application Default Credentials**. This is explained further in the [Authenticate to GCP Cloud services using client libraries](https://cloud.google.com/docs/authentication/client-libraries) guide.
77+
Also, see how to [Set up Application Default Credentials](https://cloud.google.com/docs/authentication/provide-credentials-adc).
78+
7479
## Binding support
7580

7681
This component supports **output binding** with the following operations:

‎daprdocs/content/en/reference/components-reference/supported-pubsub/setup-gcp-pubsub.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ The above example uses secrets as plain strings. It is recommended to use a secr
7676
7777
| Field | Required | Details | Example |
7878
|--------------------|:--------:|---------|---------|
79-
| projectId | Y | GCP project id| `myproject-123`
79+
| projectId | Y | GCP project ID | `myproject-123`
8080
| endpoint | N | GCP endpoint for the component to use. Only used for local development (for example) with [GCP Pub/Sub Emulator](https://cloud.google.com/pubsub/docs/emulator). The `endpoint` is unnecessary when running against the GCP production API. | `"http://localhost:8085"`
8181
| `consumerID` | N | The Consumer ID organizes one or more consumers into a group. Consumers with the same consumer ID work as one virtual consumer; for example, a message is processed only once by one of the consumers in the group. If the `consumerID` is not provided, the Dapr runtime set it to the Dapr application ID (`appID`) value. The `consumerID`, along with the `topic` provided as part of the request, are used to build the Pub/Sub subscription ID | Can be set to string value (such as `"channel1"`) or string format value (such as `"{podName}"`, etc.). [See all of template tags you can use in your component metadata.]({{< ref "component-schema.md#templated-metadata-values" >}})
8282
| identityProjectId | N | If the GCP pubsub project is different from the identity project, specify the identity project using this attribute | `"myproject-123"`

‎daprdocs/content/en/reference/components-reference/supported-secret-stores/gcp-secret-manager.md

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -50,16 +50,22 @@ The above example uses secrets as plain strings. It is recommended to use a loca
5050
5151
| Field | Required | Details | Example |
5252
|--------------------|:--------:|--------------------------------|---------------------|
53-
| type | Y | The type of the account. | `"service_account"` |
54-
| project_id | Y | The project ID associated with this component. | `"project_id"` |
55-
| private_key_id | N | The private key ID | `"privatekey"` |
56-
| client_email | Y | The client email address | `"[email protected]"` |
57-
| client_id | N | The ID of the client | `"11111111"` |
58-
| auth_uri | N | The authentication URI | `"https://accounts.google.com/o/oauth2/auth"` |
59-
| token_uri | N | The authentication token URI | `"https://oauth2.googleapis.com/token"` |
60-
| auth_provider_x509_cert_url | N | The certificate URL for the auth provider | `"https://www.googleapis.com/oauth2/v1/certs"` |
61-
| client_x509_cert_url | N | The certificate URL for the client | `"https://www.googleapis.com/robot/v1/metadata/x509/<project-name>.iam.gserviceaccount.com"`|
62-
| private_key | Y | The private key for authentication | `"privateKey"` |
53+
| `project_id` | Y | The project ID associated with this component. | `"project_id"` |
54+
| `type` | N | The type of the account. | `"service_account"` |
55+
| `private_key_id` | N | If using explicit credentials, this field should contain the `private_key_id` field from the service account json document | `"privateKeyId"`|
56+
| `private_key` | N | If using explicit credentials, this field should contain the `private_key` field from the service account json. Replace with x509 cert | `12345-12345`|
57+
| `client_email` | N | If using explicit credentials, this field should contain the `client_email` field from the service account json | `"[email protected]"`|
58+
| `client_id` | N | If using explicit credentials, this field should contain the `client_id` field from the service account json | `0123456789-0123456789`|
59+
| `auth_uri` | N | If using explicit credentials, this field should contain the `auth_uri` field from the service account json | `https://accounts.google.com/o/oauth2/auth`|
60+
| `token_uri` | N | If using explicit credentials, this field should contain the `token_uri` field from the service account json | `https://oauth2.googleapis.com/token`|
61+
| `auth_provider_x509_cert_url` | N | If using explicit credentials, this field should contain the `auth_provider_x509_cert_url` field from the service account json | `https://www.googleapis.com/oauth2/v1/certs`|
62+
| `client_x509_cert_url` | N | If using explicit credentials, this field should contain the `client_x509_cert_url` field from the service account json | `https://www.googleapis.com/robot/v1/metadata/x509/<PROJECT_NAME>.iam.gserviceaccount.com`|
63+
64+
65+
## GCP Credentials
66+
67+
Since the GCP Secret Manager component uses the GCP Go Client Libraries, by default it authenticates using **Application Default Credentials**. This is explained further in the [Authenticate to GCP Cloud services using client libraries](https://cloud.google.com/docs/authentication/client-libraries) guide.
68+
Also, see how to [Set up Application Default Credentials](https://cloud.google.com/docs/authentication/provide-credentials-adc).
6369

6470
## Optional per-request metadata properties
6571

0 commit comments

Comments
 (0)