Skip to content

fix(auth): allowlist agents-nonprod trust domains for agent identity #17155

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nbayati merged 2 commits into from
May 15, 2026
+15 −10
Merged

fix(auth): allowlist agents-nonprod trust domains for agent identity #17155

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a7d4687
fix(auth): allowlist agents-nonprod trust domains for agent identity
nbayati May 15, 2026
54626d8
fix lint issue
nbayati May 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions packages/google-auth/google/auth/_agent_identity_utils.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,7 @@
import time
from urllib.parse import quote, urlparse

from google.auth import environment_vars
from google.auth import exceptions

from google.auth import environment_vars, exceptions

_LOGGER = logging.getLogger(__name__)

Expand All @@ -37,6 +35,8 @@
_AGENT_IDENTITY_SPIFFE_TRUST_DOMAIN_PATTERNS = [
r"^agents\.global\.org-\d+\.system\.id\.goog$",
r"^agents\.global\.proj-\d+\.system\.id\.goog$",
r"^agents-nonprod\.global\.org-\d+\.system\.id\.goog$",
r"^agents-nonprod\.global\.proj-\d+\.system\.id\.goog$",
]

_WELL_KNOWN_CERT_PATH = "/var/run/secrets/workload-spiffe-credentials/certificates.pem"
Expand Down
19 changes: 12 additions & 7 deletions packages/google-auth/tests/test_agent_identity_utils.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,9 +21,7 @@
from cryptography import x509
import pytest

from google.auth import _agent_identity_utils
from google.auth import environment_vars
from google.auth import exceptions
from google.auth import _agent_identity_utils, environment_vars, exceptions

# A mock PEM-encoded certificate without an Agent Identity SPIFFE ID.
NON_AGENT_IDENTITY_CERT_BYTES = (
Expand Down Expand Up @@ -60,15 +58,22 @@ def test__is_agent_identity_certificate_invalid(self):
cert = _agent_identity_utils.parse_certificate(NON_AGENT_IDENTITY_CERT_BYTES)
assert not _agent_identity_utils._is_agent_identity_certificate(cert)

def test__is_agent_identity_certificate_valid_spiffe(self):
@pytest.mark.parametrize(
"spiffe_id",
[
"spiffe://agents.global.proj-12345.system.id.goog/workload",
"spiffe://agents.global.org-12345.system.id.goog/workload",
"spiffe://agents-nonprod.global.proj-12345.system.id.goog/workload",
"spiffe://agents-nonprod.global.org-12345.system.id.goog/workload",
],
)
def test__is_agent_identity_certificate_valid_spiffe(self, spiffe_id):
mock_cert = mock.MagicMock()
mock_ext = mock.MagicMock()
mock_san_value = mock.MagicMock()
mock_cert.extensions.get_extension_for_oid.return_value = mock_ext
mock_ext.value = mock_san_value
mock_san_value.get_values_for_type.return_value = [
"spiffe://agents.global.proj-12345.system.id.goog/workload"
]
mock_san_value.get_values_for_type.return_value = [spiffe_id]
assert _agent_identity_utils._is_agent_identity_certificate(mock_cert)

def test__is_agent_identity_certificate_non_matching_spiffe(self):
Expand Down
Loading