Ankusa.BlobStore.GCS.MetadataServer (ankusa v0.7.0)

Access tokens for Ankusa.BlobStore.GCS from the GCE/GKE metadata server: the best credential for a service running on Google Cloud, with no key to store or rotate (the node's service account, granted roles/storage.objectAdmin on the bucket).

{Ankusa.BlobStore.GCS,
 bucket: "ankusa-segments",
 token_provider: {Ankusa.BlobStore.GCS.MetadataServer, :token, []}}

The token comes from http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/<account>/token (the Metadata-Flavor: Google header is required; the address only answers inside Google Cloud). It is cached node-wide until a minute before it expires, so the adapter's per-request call is an ETS read, and refreshed on demand: a 401 makes the adapter call invalidate/1, and its retry fetches a new token.

Arguments (a keyword list, the one optional argument of token/1 and invalidate/1):

:service_account — default "default"
:endpoint — default the metadata server's token URL (override in tests)
:timeout_ms — default 5_000
:req_options — transport options, e.g. plug: for Req.Test

Summary

Functions

invalidate(opts \\ [])

Drop the cached token: the next token/1 fetches a new one.

token(opts \\ [])

{:ok, bearer_token}, or :error when the metadata server did not give one.

Functions

invalidate(opts \\ [])

@spec invalidate(keyword()) :: :ok

Drop the cached token: the next token/1 fetches a new one.

token(opts \\ [])

@spec token(keyword()) :: {:ok, String.t()} | :error

{:ok, bearer_token}, or :error when the metadata server did not give one.