{"action":"closed","issue":{"url":"https://api.github.com/repos/google/google-auth-library-java/issues/146","repository_url":"https://api.github.com/repos/google/google-auth-library-java","labels_url":"https://api.github.com/repos/google/google-auth-library-java/issues/146/labels{/name}","comments_url":"https://api.github.com/repos/google/google-auth-library-java/issues/146/comments","events_url":"https://api.github.com/repos/google/google-auth-library-java/issues/146/events","html_url":"https://github.com/google/google-auth-library-java/issues/146","id":287949628,"node_id":"MDU6SXNzdWUyODc5NDk2Mjg=","number":146,"title":"FR: Need a good way to inject secrets besides `gcloud` & `GOOGLE_APPLICATION_CREDENTIALS`","user":{"login":"lesv","id":1136014,"node_id":"MDQ6VXNlcjExMzYwMTQ=","avatar_url":"https://avatars2.githubusercontent.com/u/1136014?v=4","gravatar_id":"","url":"https://api.github.com/users/lesv","html_url":"https://github.com/lesv","followers_url":"https://api.github.com/users/lesv/followers","following_url":"https://api.github.com/users/lesv/following{/other_user}","gists_url":"https://api.github.com/users/lesv/gists{/gist_id}","starred_url":"https://api.github.com/users/lesv/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lesv/subscriptions","organizations_url":"https://api.github.com/users/lesv/orgs","repos_url":"https://api.github.com/users/lesv/repos","events_url":"https://api.github.com/users/lesv/events{/privacy}","received_events_url":"https://api.github.com/users/lesv/received_events","type":"User","site_admin":false},"labels":[{"id":949704295,"node_id":"MDU6TGFiZWw5NDk3MDQyOTU=","url":"https://api.github.com/repos/google/google-auth-library-java/labels/type:%20feature%20request","name":"type: feature request","color":"c5def5","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-01-11T22:41:09Z","updated_at":"2018-06-20T18:46:23Z","closed_at":"2018-06-20T18:46:23Z","author_association":"COLLABORATOR","body":"PR's #94 & #144 both want to find a way to improve ADC for non-google cloud providers.\r\n\r\nThe [ADC](https://developers.google.com/identity/protocols/application-default-credentials) algorithm is defined to:\r\n\r\n1. Look at environment variable GOOGLE_APPLICATION_CREDENTIALS\r\n2. Look for gcloud auth application-default login\r\n3. Get a service account from the GCP Metadata server (GAE & GCP are a bit different, but it's the same idea)\r\n\r\nWe should see if there is a way to safely and securely inject a secret like a service account JSON into a container running on another cloud platform. (item 3 above). \r\n\r\n@jonparrott said: environment variables [should not be used to hold secrets](https://diogomonica.com/2017/03/27/why-you-shouldnt-use-env-variables-for-secret-data/).\r\n\r\nThis is a very important item for us. We are trying get to the point where docker containers can run anywhere, on GCP, on a competing cloud provider, in their own datacenter, or locally in their laptop with just a change in the configuration.\r\n"}}
{"actor":{"display_login":"theacodes"}}