CORS-4423: GCP: Use WithCredentialsJSON when Possible#10624
Open
patrickdillon wants to merge 2 commits into
Open
CORS-4423: GCP: Use WithCredentialsJSON when Possible#10624patrickdillon wants to merge 2 commits into
patrickdillon wants to merge 2 commits into
Conversation
openshift-ci-robot
added
the
jira/valid-reference
Contributor
|
@patrickdillon: This pull request references CORS-4509 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughGCP credential option handling is centralized and reused by KMS and monitoring client setup. ChangesGCP credential handling and dependency refresh
Estimated code review effort: 3 (Moderate) | ~25 minutes 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
pkg/asset/installconfig/gcp/services.go (1)
62-71: ⚡ Quick winAdd nil guards for exported function.
CredentialOptionis exported, so external callers could pass a nil*Sessionor a session with nilCredentials, causing a panic atssn.Credentials.JSON. Internal callers all validate viaGetSession()first, but defensive checks here prevent misuse.Also, per coding guidelines, this new exported function in
pkg/needs unit test coverage.Proposed nil guard
func CredentialOption(ssn *Session) option.ClientOption { + if ssn == nil || ssn.Credentials == nil { + return nil + } if len(ssn.Credentials.JSON) > 0 { return option.WithCredentialsJSON(ssn.Credentials.JSON) } return option.WithCredentials(ssn.Credentials) }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/asset/installconfig/gcp/services.go` around lines 62 - 71, The exported function CredentialOption lacks defensive nil checks, so external callers passing a nil *Session or a session with nil Credentials would cause a panic when accessing ssn.Credentials.JSON. Add nil guard checks at the start of the CredentialOption function to validate that both ssn and ssn.Credentials are not nil, returning an appropriate zero value or error when either is nil. Additionally, add unit test coverage in pkg/asset/installconfig/gcp/services_test.go to verify the function handles these nil input cases gracefully, as required for exported functions in pkg/.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@pkg/asset/installconfig/gcp/services.go`:
- Around line 62-71: The exported function CredentialOption lacks defensive nil
checks, so external callers passing a nil *Session or a session with nil
Credentials would cause a panic when accessing ssn.Credentials.JSON. Add nil
guard checks at the start of the CredentialOption function to validate that both
ssn and ssn.Credentials are not nil, returning an appropriate zero value or
error when either is nil. Additionally, add unit test coverage in
pkg/asset/installconfig/gcp/services_test.go to verify the function handles
these nil input cases gracefully, as required for exported functions in pkg/.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 7f9625b2-456f-41f3-8dc6-9a89d35bb56c
📒 Files selected for processing (3)
pkg/asset/installconfig/gcp/client.gopkg/asset/installconfig/gcp/services.gopkg/quota/gcp/gcp.go
tthvo
reviewed
Jun 15, 2026
openshift-ci
Bot
added
approved
patrickdillon
force-pushed
the
gcp-creds-json
branch
from
47b89bd to
472487b
Compare
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: tthvo The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Contributor
Author
|
/hold cancel Updated to use the non-deprecated function. Still need to test again in gcd, but let's kick off the ci regression tests. |
openshift-ci
Bot
removed
the
do-not-merge/hold
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 6-7: The go.mod file pins google.golang.org/api to version
v0.285.0, which does not exist and violates supply chain security guidelines.
Update the google.golang.org/api dependency to the latest stable version
v0.284.0 (released June 9, 2026) which is compatible with the KMS and Monitoring
library versions already specified (v1.26.0 and v1.24.3 respectively) and
supports the required functionality for universe domain configuration and
authentication.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 46d976ad-452b-42ba-83c9-4d4c613eef28
⛔ Files ignored due to path filters (296)
go.sumis excluded by!**/*.sumvendor/cloud.google.com/go/.release-please-manifest-individual.jsonis excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/.release-please-manifest-submodules.jsonis excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/.release-please-manifest.jsonis excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/CHANGES.mdis excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/README.mdis excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/CHANGES.mdis excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/credentials/detect.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/credentials/filetypes.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/credentials/internal/gdch/gdch.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/grpctransport/grpctransport.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/httptransport/httptransport.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/httptransport/transport.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/internal/credsfile/credsfile.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/internal/credsfile/filetype.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/internal/credsfile/parse.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/internal/internal.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/internal/jwt/jwt.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/internal/transport/transport.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/auth/internal/version.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/go.workis excluded by!**/*.work,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/go.work.sumis excluded by!**/*.sum,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/internal/.repo-metadata-full.jsonis excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/kms/apiv1/.repo-metadata.jsonis excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/kms/apiv1/autokey_admin_client.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/kms/apiv1/autokey_client.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/kms/apiv1/auxiliary.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/kms/apiv1/auxiliary_go123.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/kms/apiv1/doc.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/kms/apiv1/ekm_client.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/kms/apiv1/gapic_metadata.jsonis excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/kms/apiv1/helpers.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/kms/apiv1/hsm_management_client.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/kms/apiv1/key_management_client.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/kms/apiv1/kmspb/autokey.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/kms/apiv1/kmspb/autokey_admin.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/kms/apiv1/kmspb/autokey_admin_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/kms/apiv1/kmspb/autokey_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/kms/apiv1/kmspb/ekm_service.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/kms/apiv1/kmspb/ekm_service_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/kms/apiv1/kmspb/hsm_management.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/kms/apiv1/kmspb/hsm_management_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/kms/apiv1/kmspb/resources.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/kms/apiv1/kmspb/service.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/kms/apiv1/kmspb/service_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/kms/internal/version.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/longrunning/CHANGES.mdis excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/longrunning/autogen/.repo-metadata.jsonis excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/longrunning/autogen/helpers.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/longrunning/autogen/longrunningpb/operations.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/longrunning/autogen/longrunningpb/operations_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/longrunning/autogen/operations_client.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/alert_policy_client.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/group_client.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/helpers.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/metric_client.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/alert.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/alert_service.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/alert_service_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/common.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/dropped_labels.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/group.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/group_service.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/group_service_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/metric.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/metric_service.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/metric_service_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/mutation_record.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/notification.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/notification_service.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/notification_service_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/query_service.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/query_service_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/service.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/service_service.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/service_service_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/snooze.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/snooze_service.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/snooze_service_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/span_context.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/uptime.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/uptime_service.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/monitoringpb/uptime_service_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/notification_channel_client.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/query_client.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/service_monitoring_client.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/snooze_client.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/apiv3/v2/uptime_check_client.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/monitoring/internal/version.gois excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/release-please-config-individual.jsonis excluded by!vendor/**,!**/vendor/**vendor/cloud.google.com/go/release-please-config-yoshi-submodules.jsonis excluded by!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/udpa/annotations/migrate.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/udpa/annotations/security.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/udpa/annotations/sensitive.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/udpa/annotations/status.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/udpa/annotations/versioning.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/udpa/type/v1/typed_struct.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/annotations/v3/migrate.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/annotations/v3/security.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/annotations/v3/sensitive.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/annotations/v3/status.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/annotations/v3/versioning.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/core/v3/authority.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/core/v3/cidr.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/core/v3/collection_entry.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/core/v3/context_params.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/core/v3/extension.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/core/v3/resource.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/core/v3/resource_locator.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/core/v3/resource_name.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/data/orca/v3/orca_load_report.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/service/orca/v3/orca.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/service/orca/v3/orca_grpc.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/type/matcher/v3/cel.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/type/matcher/v3/domain.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/type/matcher/v3/http_inputs.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/type/matcher/v3/ip.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/type/matcher/v3/matcher.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/type/matcher/v3/range.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/type/matcher/v3/regex.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/type/matcher/v3/string.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/type/v3/cel.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/type/v3/range.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/cncf/xds/go/xds/type/v3/typed_struct.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/admin/v3/certs.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/admin/v3/certs.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/admin/v3/clusters.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/admin/v3/clusters.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/admin/v3/config_dump.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/admin/v3/config_dump.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/admin/v3/config_dump_shared.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/admin/v3/config_dump_shared.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/admin/v3/init_dump.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/admin/v3/init_dump.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/admin/v3/listeners.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/admin/v3/listeners.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/admin/v3/memory.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/admin/v3/memory.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/admin/v3/metrics.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/admin/v3/metrics.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/admin/v3/mutex_stats.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/admin/v3/mutex_stats.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/admin/v3/server_info.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/admin/v3/server_info.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/admin/v3/server_info_vtproto.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/admin/v3/tap.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/admin/v3/tap.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/annotations/deprecation.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/annotations/resource.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/annotations/resource.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/accesslog/v3/accesslog.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/accesslog/v3/accesslog.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/bootstrap/v3/bootstrap.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/bootstrap/v3/bootstrap.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/bootstrap/v3/bootstrap_vtproto.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3/circuit_breaker.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3/circuit_breaker.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3/cluster.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3/cluster.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3/cluster_vtproto.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3/filter.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3/filter.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3/outlier_detection.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3/outlier_detection.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/common/matcher/v3/matcher.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/common/matcher/v3/matcher.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/common/mutation_rules/v3/mutation_rules.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/common/mutation_rules/v3/mutation_rules.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/address.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/address.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/backoff.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/backoff.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/base.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/base.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/cel.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/cel.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/cel_vtproto.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/config_source.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/config_source.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/event_service_config.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/event_service_config.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/extension.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/extension.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/grpc_method_list.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/grpc_method_list.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/grpc_service.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/grpc_service.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/health_check.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/health_check.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/http_service.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/http_service.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/http_uri.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/http_uri.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/protocol.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/protocol.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/protocol_vtproto.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/proxy_protocol.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/proxy_protocol.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/resolver.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/resolver.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/socket_cmsg_headers.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/socket_cmsg_headers.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/socket_option.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/socket_option.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/substitution_format_string.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/substitution_format_string.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/udp_socket_config.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/core/v3/udp_socket_config.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3/endpoint.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3/endpoint.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3/endpoint_components.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3/endpoint_components.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3/load_report.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3/load_report.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/listener/v3/api_listener.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/listener/v3/api_listener.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/listener/v3/listener.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/listener/v3/listener.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/listener/v3/listener_components.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/listener/v3/listener_components.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/listener/v3/listener_vtproto.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/listener/v3/quic_config.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/listener/v3/quic_config.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/listener/v3/quic_config_vtproto.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/listener/v3/udp_listener_config.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/listener/v3/udp_listener_config.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/metrics/v3/metrics_service.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/metrics/v3/metrics_service.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/metrics/v3/metrics_service_vtproto.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/metrics/v3/stats.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/metrics/v3/stats.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/overload/v3/overload.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/overload/v3/overload.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/rbac/v3/rbac.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/rbac/v3/rbac.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/rbac/v3/rbac_vtproto.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/route/v3/route.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/route/v3/route.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/route/v3/route_components.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/route/v3/route_components.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/route/v3/route_components_vtproto.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/route/v3/route_vtproto.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/route/v3/scoped_route.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/route/v3/scoped_route.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/tap/v3/common.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/tap/v3/common.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/trace/v3/datadog.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/trace/v3/datadog.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/trace/v3/dynamic_ot.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/trace/v3/dynamic_ot.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/trace/v3/http_tracer.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/trace/v3/http_tracer.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/trace/v3/lightstep.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/trace/v3/lightstep.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/trace/v3/opentelemetry.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/trace/v3/opentelemetry.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/trace/v3/service.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/trace/v3/service.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/trace/v3/skywalking.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/trace/v3/skywalking.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/trace/v3/trace.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/trace/v3/xray.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/trace/v3/xray.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/trace/v3/zipkin.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/config/trace/v3/zipkin.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/data/accesslog/v3/accesslog.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/data/accesslog/v3/accesslog.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/clusters/aggregate/v3/cluster.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/clusters/aggregate/v3/cluster.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/common/fault/v3/fault.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/common/fault/v3/fault.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/fault/v3/fault.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/fault/v3/fault.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/rbac/v3/rbac.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/rbac/v3/rbac.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/router/v3/router.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/router/v3/router.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/router/v3/router_vtproto.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager_vtproto.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3/client_side_weighted_round_robin.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3/client_side_weighted_round_robin.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/load_balancing_policies/common/v3/common.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/load_balancing_policies/common/v3/common.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/load_balancing_policies/least_request/v3/least_request.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/load_balancing_policies/least_request/v3/least_request.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/load_balancing_policies/pick_first/v3/pick_first.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/load_balancing_policies/pick_first/v3/pick_first.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/load_balancing_policies/ring_hash/v3/ring_hash.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/load_balancing_policies/ring_hash/v3/ring_hash.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/load_balancing_policies/wrr_locality/v3/wrr_locality.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/load_balancing_policies/wrr_locality/v3/wrr_locality.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/rbac/audit_loggers/stream/v3/stream.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/rbac/audit_loggers/stream/v3/stream.pb.validate.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3/cert.pb.gois excluded by!**/*.pb.go,!vendor/**,!**/vendor/**
📒 Files selected for processing (4)
go.modpkg/asset/installconfig/gcp/client.gopkg/asset/installconfig/gcp/services.gopkg/quota/gcp/gcp.go
🚧 Files skipped from review as they are similar to previous changes (3)
- pkg/asset/installconfig/gcp/client.go
- pkg/asset/installconfig/gcp/services.go
- pkg/quota/gcp/gcp.go
Member
|
/test gcp-custom-endpoints-proxy-wif |
Contributor
Author
|
/hold https://pkg.go.dev/golang.org/x/oauth2/google#CredentialsFromJSONWithTypeAndParams |
openshift-ci
Bot
added
do-not-merge/hold
patrickdillon
force-pushed
the
gcp-creds-json
branch
from
472487b to
1b9ee1d
Compare
Contributor
|
New changes are detected. LGTM label has been removed. |
patrickdillon
force-pushed
the
gcp-creds-json
branch
from
1b9ee1d to
821000b
Compare
openshift-ci
Bot
removed
the
needs-rebase
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pkg/asset/installconfig/gcp/services.go`:
- Around line 72-78: The JSON-backed auth branch in services.go is too
permissive because it trusts the caller-supplied type field and can pass
non-service-account configs into option.WithAuthCredentialsJSON. Update the
credential handling in the JSON check to only use option.WithAuthCredentialsJSON
when the parsed type is service_account and the JSON includes a non-empty
private_key; for all other cases, fall back to option.WithCredentials in the
same code path.
- Around line 83-96: CredentialOptions currently swallows GetUniverseDomain()
errors, which can hide non-default universe settings and fall back to
googleapis.com. Update CredentialOptions in both gcp/services.go and
gcp/client.go to return ([]option.ClientOption, error) instead of silently
ignoring lookup failures, and thread that error through getOptions and the
client/service creation callers so they fail fast with the universe-domain
error. Use the existing CredentialOptions and getOptions symbols to keep the
changes consistent across the two call paths.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
Contributor
Author
|
/test verify-vendor |
patrickdillon
force-pushed
the
gcp-creds-json
branch
from
821000b to
be15709
Compare
tthvo
reviewed
Jun 24, 2026
tthvo
reviewed
Jun 24, 2026
| PrivateKey string `json:"private_key"` | ||
| } | ||
| if json.Unmarshal(ssn.Credentials.JSON, &f) == nil && f.Type == option.ServiceAccount && f.PrivateKey != "" { | ||
| opts = append(opts, option.WithAuthCredentialsJSON(f.Type, ssn.Credentials.JSON)) |
Member
There was a problem hiding this comment.
There is another deprecated func in v0.36.0 with the same risk according to docs:
installer/pkg/asset/installconfig/gcp/session.go
Lines 184 to 186 in a34cc48
Also , there are quite a few types here. Should we:
- Parse the type from JSON
- Validate that it is a known type
- Optionally validate other fields (e.g.
private_key)? It seems like user's responsibility to check it instead of the installer?
Reference: https://github.com/argoproj/argo-cd/pull/27883/changes
Contributor
Author
There was a problem hiding this comment.
So I have been considering this, and added a comment in the commit message. The priority is for the installer to work in every auth manner supported by GCP. So given that, I'm not sure it is viable for us to authenticate the user creds. For standard installer users, we would not consider them externally provided credentials, but in the case where a system is built on top of the installer, such as managed services, that could potentially accept external credentials, in which case those layered applications, would need to validate the credentials themselves.
patrickdillon
changed the title
Contributor
|
@patrickdillon: This pull request references CORS-4423 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Contributor
Author
|
/jira-refresh |
Member
|
/jira refresh |
Contributor
|
@tthvo: This pull request references CORS-4423 which is a valid jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Member
|
@coderabbitai full review |
✅ Action performedFull review finished. |
Member
|
@coderabbitai Mind adjusting your PR summary based on Patrick's #10624 (comment)? The |
|
Feedback to incorporate: In ✏️ Learnings added
✅ Action performedSummary regeneration triggered. |
Updates GCP client initialization to support alternate universe domains. option.WithCredentialsJSON is used to handle most auth cases because it utilizes a different authentication flow using a self-signed JWT which is sent directly to GCP/GCD, rather than oauth2. The oauth2 flow of option.WithCredentials is problematic for GCD because service account keys (and other JSON creds), for some reason, set their token uri to https://oauth2.apis-berlin-build0.goog/token, an endpoint that doesn't exist; it is clearly documented in GCD docs that oauth2 should still use googleapis. Nevertheless, the option.WithCredentials will always use the token uri in the JSON even when it is correct. To get around this issue we use option.WithCredentialsJSON, which does not need the oauth2 token endpoint at all. We fallback to option.WithCredentials for authenticating via a service account attached to a VM, in which case there is no JSON to parse. Note that option.WithCredentialsJSON is deprecated in the GCP package because if credentials are accepted from an external source, there are potential vulnerabilities. See: https://docs.cloud.google.com/docs/authentication/client-libraries#external-credentials The installer is built to work under any circumstances as it serves a diverse set of needs. Clients built on top of the installer may accept external credentials, but it is up to those clients to validate the inputs.
Until CAPG has built in universe domain support, we can explicitly set the universe domain as an environment variable.
patrickdillon
force-pushed
the
gcp-creds-json
branch
from
be15709 to
40e300c
Compare
Contributor
|
@patrickdillon: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prior to this commit, using a GCP Service Account with a Key failed in scenarios where an alternate UNIVERSE_DOMAIN is needed. This updates the GCP auth to use
option.WithCredentialsJSON, determine the universe domain and set it. Usingoption.WithCredentialsJSONis necessary because it uses a different authentication flow utilizing a self-signed JWT rather than oauth2. See more details in the commit message.Summary by CodeRabbit