CredentialsRetriever — Documentation by YARD 0.9.37 (original) (raw)

Class: Mongo::Crypt::KMS::GCP::CredentialsRetrieverPrivate

Inherits:

Object

Defined in:

lib/mongo/crypt/kms/gcp/credentials_retriever.rb

Overview

This class is part of a private API. You should avoid using this class if possible, as it may be removed or be changed in the future.

This class retrieves GPC credentials using Google Compute Engine metadata host. This should be used when the driver is used on the Google Compute Engine instance.

Constant Summarycollapse

METADATA_HOST_ENV =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

'GCE_METADATA_HOST'

DEFAULT_HOST =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

'metadata.google.internal'

Class Method Summarycollapse

Class Method Details

.fetch_access_token(timeout_holder = nil) ⇒ String

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Fetch GCP access token.

40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 # File 'lib/mongo/crypt/kms/gcp/credentials_retriever.rb', line 40 def self.fetch_access_token(timeout_holder = nil) host = ENV.fetch(METADATA_HOST_ENV) { DEFAULT_HOST } uri = URI("http://#{host}/computeMetadata/v1/instance/service-accounts/default/token") req = Net::HTTP::Get.new(uri) req['Metadata-Flavor'] = 'Google' resp = fetch_response(uri, req, timeout_holder) if resp.code != '200' raise KMS::CredentialsNotFound, "GCE metadata host responded with code #{resp.code}" end parsed_resp = JSON.parse(resp.body) parsed_resp.fetch('access_token') rescue JSON::ParserError, KeyError => e raise KMS::CredentialsNotFound, "GCE metadata response is invalid: '#{resp.body}'; #{e.class}: #{e.message}" rescue ::Timeout::Error, IOError, SystemCallError, SocketError => e raise KMS::CredentialsNotFound, "Could not receive GCP metadata response; #{e.class}: #{e.message}" end