From 550d1461b3bc668649f029e6801c88dad6a4949f Mon Sep 17 00:00:00 2001 From: Robby Cochran Date: Thu, 17 Sep 2026 11:02:39 -0700 Subject: [PATCH] fix(acs-ci): enable gsutil metadata credentials --- tasks/acs-ci-nightly/openshell/README.md | 4 +++- tasks/acs-ci-nightly/workflow/harness.yaml | 3 +++ tasks/acs-ci-nightly/workflow/preflight.yaml | 3 +++ 3 files changed, 9 insertions(+), 1 deletion(-) diff --git a/tasks/acs-ci-nightly/openshell/README.md b/tasks/acs-ci-nightly/openshell/README.md index c165fd6..367249e 100644 --- a/tasks/acs-ci-nightly/openshell/README.md +++ b/tasks/acs-ci-nightly/openshell/README.md @@ -12,7 +12,9 @@ and attaches those instances; it does not provision or manage their credentials. The built-in Google Cloud profile supplies the gateway-managed metadata path -that gsutil uses. The task policy binds that provider instance only to the +that gsutil uses. The workflow's Boto configuration enables gsutil's +`[GoogleCompute]` metadata credential lookup without placing a credential in +the sandbox. The task policy binds that provider instance only to the read-only `test-platform-results-public` endpoints. The task also points Google Cloud CLI tools at OpenShell's combined CA bundle so `gsutil` verifies the sandbox proxy certificate without disabling TLS. diff --git a/tasks/acs-ci-nightly/workflow/harness.yaml b/tasks/acs-ci-nightly/workflow/harness.yaml index 39c83ae..9160c0f 100644 --- a/tasks/acs-ci-nightly/workflow/harness.yaml +++ b/tasks/acs-ci-nightly/workflow/harness.yaml @@ -37,6 +37,9 @@ payloads: - content: | [Boto] ca_certificates_file = /etc/openshell-tls/ca-bundle.pem + + [GoogleCompute] + service_account = default destination: /tmp/openshell-boto.cfg agent: diff --git a/tasks/acs-ci-nightly/workflow/preflight.yaml b/tasks/acs-ci-nightly/workflow/preflight.yaml index a0b47cd..e0975ac 100644 --- a/tasks/acs-ci-nightly/workflow/preflight.yaml +++ b/tasks/acs-ci-nightly/workflow/preflight.yaml @@ -19,6 +19,9 @@ payloads: - content: | [Boto] ca_certificates_file = /etc/openshell-tls/ca-bundle.pem + + [GoogleCompute] + service_account = default destination: /tmp/openshell-boto.cfg agent: