All Apps and Add-ons

Use GCE service account

Explorer

I am running Splunk on top of GCE instances, and I'd like to use GCE service account for the pubsub subscription instead of providing a JSON file. Is that possible? What would be the effort to implement this?

0 Karma
1 Solution

Explorer

After asking, I decided to take a look and implement myself. If anyone needs a similar solution, you need to change 2 files: bin/splunk_ta_gcp/common/credentials.py and bin/splunk_ta_gcp/legacy/common.py.
The diff of the changes (git format) is available below. Too bad Splunk doesn't have an open source repo for this add-on.

diff --git a/bin/splunk_ta_gcp/common/credentials.py b/bin/splunk_ta_gcp/common/credentials.py
index 3bacb9f..c763fb8 100644
--- a/bin/splunk_ta_gcp/common/credentials.py
+++ b/bin/splunk_ta_gcp/common/credentials.py
@@ -1,6 +1,6 @@
 import json
 from google.oauth2 import service_account
-
+import google.auth

 class CredentialFactory(object):
     def __init__(self, config):
@@ -11,4 +11,9 @@ def load(self, profile, scopes):
         content = self._config.load(collection, stanza=profile, virtual=True)
         key = content['google_credentials']
         info = json.loads(key)
+
+        if not bool(info): # bool(dict) evaluates to False if empty
+            credentials, _ = google.auth.default()
+            return credentials
+
         return service_account.Credentials.from_service_account_info(info, scopes=scopes)
diff --git a/bin/splunk_ta_gcp/legacy/common.py b/bin/splunk_ta_gcp/legacy/common.py
index 2d7b601..f23f301 100755
--- a/bin/splunk_ta_gcp/legacy/common.py
+++ b/bin/splunk_ta_gcp/legacy/common.py
@@ -192,16 +192,19 @@ def create_google_client(config):
     }
     """

-    if config.get("google_credentials"):
+    scopes = config.get("scopes")
+
+    if config.get("google_credentials") and bool(config["google_credentials"]):
         credentials = service_account.Credentials.from_service_account_info(
             config["google_credentials"]
         )
+        if scopes:
+            credentials = credentials.with_scopes(scopes)
     else:
-        credentials, project = google.auth.default()
-
-    scopes = config.get("scopes")
-    if scopes:
-        credentials = credentials.with_scopes(scopes)
+        if scopes:
+            credentials, project = google.auth.default(scopes=scopes)
+        else:
+            credentials, project = google.auth.default()

     http = sr.build_http_connection(config, timeout=config.get("pulling_interval", 30))
     http = AuthorizedHttp(credentials, http=http)

View solution in original post

0 Karma

Explorer

After asking, I decided to take a look and implement myself. If anyone needs a similar solution, you need to change 2 files: bin/splunk_ta_gcp/common/credentials.py and bin/splunk_ta_gcp/legacy/common.py.
The diff of the changes (git format) is available below. Too bad Splunk doesn't have an open source repo for this add-on.

diff --git a/bin/splunk_ta_gcp/common/credentials.py b/bin/splunk_ta_gcp/common/credentials.py
index 3bacb9f..c763fb8 100644
--- a/bin/splunk_ta_gcp/common/credentials.py
+++ b/bin/splunk_ta_gcp/common/credentials.py
@@ -1,6 +1,6 @@
 import json
 from google.oauth2 import service_account
-
+import google.auth

 class CredentialFactory(object):
     def __init__(self, config):
@@ -11,4 +11,9 @@ def load(self, profile, scopes):
         content = self._config.load(collection, stanza=profile, virtual=True)
         key = content['google_credentials']
         info = json.loads(key)
+
+        if not bool(info): # bool(dict) evaluates to False if empty
+            credentials, _ = google.auth.default()
+            return credentials
+
         return service_account.Credentials.from_service_account_info(info, scopes=scopes)
diff --git a/bin/splunk_ta_gcp/legacy/common.py b/bin/splunk_ta_gcp/legacy/common.py
index 2d7b601..f23f301 100755
--- a/bin/splunk_ta_gcp/legacy/common.py
+++ b/bin/splunk_ta_gcp/legacy/common.py
@@ -192,16 +192,19 @@ def create_google_client(config):
     }
     """

-    if config.get("google_credentials"):
+    scopes = config.get("scopes")
+
+    if config.get("google_credentials") and bool(config["google_credentials"]):
         credentials = service_account.Credentials.from_service_account_info(
             config["google_credentials"]
         )
+        if scopes:
+            credentials = credentials.with_scopes(scopes)
     else:
-        credentials, project = google.auth.default()
-
-    scopes = config.get("scopes")
-    if scopes:
-        credentials = credentials.with_scopes(scopes)
+        if scopes:
+            credentials, project = google.auth.default(scopes=scopes)
+        else:
+            credentials, project = google.auth.default()

     http = sr.build_http_connection(config, timeout=config.get("pulling_interval", 30))
     http = AuthorizedHttp(credentials, http=http)

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@tyron_ If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!