Make GoogleCloudCredentials optional to support WorkloadIdentity (#433)

Signed-off-by: Frank Jogeleit <frank.jogeleit@lovoo.com>
kyverno · May 8, 2024 · 842e372 · 842e372
1 parent 836d6fe
commit 842e372
Showing 1 changed file with 11 additions and 5 deletions.
diff --git a/pkg/helper/gcp.go b/pkg/helper/gcp.go
@@ -36,13 +36,19 @@ func (c *gcsClient) Upload(body *bytes.Buffer, key string) error {
 
 // NewGCSClient creates a new GCS.client to send Results to GCS Bucket
 func NewGCSClient(ctx context.Context, credentials, bucket string) GCPClient {
-	cred, err := google.CredentialsFromJSON(ctx, []byte(credentials), storage.ScopeReadWrite)
-	if err != nil {
-		zap.L().Error("error while creating GCS credentials", zap.Error(err))
-		return nil
+	options := make([]option.ClientOption, 0, 1)
+
+	if credentials != "" {
+		cred, err := google.CredentialsFromJSON(ctx, []byte(credentials), storage.ScopeReadWrite)
+		if err != nil {
+			zap.L().Error("error while creating GCS credentials", zap.Error(err))
+			return nil
+		}
+
+		options = append(options, option.WithCredentials(cred))
 	}
 
-	client, err := storage.NewClient(ctx, option.WithCredentials(cred))
+	client, err := storage.NewClient(ctx, options...)
 	if err != nil {
 		zap.L().Error("error while creating GCS client", zap.Error(err))
 		return nil