Skip to content

feat(cli): fall back to Application Default Credentials for secrets commands #898

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Aaron ("AJ") Steers (aaronsteers) merged 5 commits into from
Feb 6, 2026
Merged

feat(cli): fall back to Application Default Credentials for secrets commands #898

Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8137b0d
feat(cli): fall back to Application Default Credentials for secrets c…
devin-ai-integration[bot] Feb 6, 2026
22c36d4
fix: remove redundant cast flagged by mypy
devin-ai-integration[bot] Feb 6, 2026
bb88ac5
fix: wrap ADC fallback with helpful error message on auth failure
devin-ai-integration[bot] Feb 6, 2026
af7197b
fix: move google.auth.exceptions import into try/except block for gra…
devin-ai-integration[bot] Feb 6, 2026
0742128
feat: add stderr log messages indicating which GCP credentials path i…
devin-ai-integration[bot] Feb 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 23 additions & 11 deletions airbyte_cdk/cli/airbyte_cdk/_secrets.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@
from pathlib import Path
from typing import Any, cast

import google.auth.exceptions
Comment thread
devin-ai-integration[bot] marked this conversation as resolved.
Outdated
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
import requests
import rich_click as click
import yaml
Expand Down Expand Up @@ -414,7 +415,14 @@ def _get_secret_filepath(


def _get_gsm_secrets_client() -> "secretmanager.SecretManagerServiceClient": # type: ignore
"""Get the Google Secret Manager client."""
"""Get the Google Secret Manager client.

If the `GCP_GSM_CREDENTIALS` environment variable is set, the client will be
created using service account credentials from that JSON string. Otherwise, the
client will fall back to Application Default Credentials (ADC), which supports
user credentials from `gcloud auth application-default login`, GCE metadata
server credentials, and other standard GCP authentication methods.
"""
if not secretmanager:
raise ImportError(
"google-cloud-secret-manager package is required for Secret Manager integration. "
Expand All @@ -423,18 +431,22 @@ def _get_gsm_secrets_client() -> "secretmanager.SecretManagerServiceClient": #
)

credentials_json = os.environ.get("GCP_GSM_CREDENTIALS")
if not credentials_json:
raise ValueError(
"No Google Cloud credentials found. "
"Please set the `GCP_GSM_CREDENTIALS` environment variable."
if credentials_json:
return cast(
"secretmanager.SecretManagerServiceClient",
secretmanager.SecretManagerServiceClient.from_service_account_info(
json.loads(credentials_json)
),
)

return cast(
"secretmanager.SecretManagerServiceClient",
secretmanager.SecretManagerServiceClient.from_service_account_info(
json.loads(credentials_json)
),
)
try:
return secretmanager.SecretManagerServiceClient()
except google.auth.exceptions.DefaultCredentialsError:
raise ValueError(
"No Google Cloud credentials found. "
"Either set the `GCP_GSM_CREDENTIALS` environment variable with service account JSON, "
"or run `gcloud auth application-default login` to authenticate with your user account."
) from None


def _print_ci_secrets_masks(
Expand Down
Loading