Struct Builder 

pub struct Builder { /* private fields */ }

A builder for external account Credentials instances.

Example

let project_id = project_id();
let workload_identity_pool_id = workload_identity_pool();
let provider_id = workload_identity_provider();
let provider_name = format!(
    "//iam.googleapis.com/projects/{project_id}/locations/global/workloadIdentityPools/{workload_identity_pool_id}/providers/{provider_id}"
);
let config = serde_json::json!({
    "type": "external_account",
    "audience": provider_name,
    "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
    "token_url": "https://sts.googleapis.com/v1beta/token",
    "credential_source": {
        "url": format!("http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource={provider_name}"),
        "headers": {
          "Metadata": "True"
        },
        "format": {
          "type": "json",
          "subject_token_field_name": "access_token"
        }
    }
});
let credentials = Builder::new(config)
    .with_quota_project_id("quota_project")
    .build();
});

Implementations

impl Builder

pub fn new(external_account_config: Value) -> Self

Creates a new builder using external_account_credentials JSON value.

pub fn with_quota_project_id<S: Into<String>>(self, quota_project_id: S) -> Self

Sets the quota project for this credentials.

In some services, you can use a service account in one project for authentication and authorization, and charge the usage to a different project. This requires that the service account has serviceusage.services.use permissions on the quota project.

pub fn with_scopes<I, S>(self, scopes: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Overrides the scopes for this credentials.

pub fn with_retry_policy<V: Into<RetryPolicyArg>>(self, v: V) -> Self

Configure the retry policy for fetching tokens.

The retry policy controls how to handle retries, and sets limits on the number of attempts or the total time spent retrying.

use gax::retry_policy::{AlwaysRetry, RetryPolicyExt};
let config = serde_json::json!({
    "type": "external_account",
    "audience": "audience",
    "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
    "token_url": "https://sts.googleapis.com/v1beta/token",
    "credential_source": { "file": "/path/to/your/oidc/token.jwt" }
});
let credentials = Builder::new(config)
    .with_retry_policy(AlwaysRetry.with_attempt_limit(3))
    .build();

pub fn with_backoff_policy<V: Into<BackoffPolicyArg>>(self, v: V) -> Self

Configure the retry backoff policy.

The backoff policy controls how long to wait in between retry attempts.

use gax::exponential_backoff::ExponentialBackoff;
let config = serde_json::json!({
    "type": "external_account",
    "audience": "audience",
    "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
    "token_url": "https://sts.googleapis.com/v1beta/token",
    "credential_source": { "file": "/path/to/your/oidc/token.jwt" }
});
let policy = ExponentialBackoff::default();
let credentials = Builder::new(config)
    .with_backoff_policy(policy)
    .build();

pub fn with_retry_throttler<V: Into<RetryThrottlerArg>>(self, v: V) -> Self

Configure the retry throttler.

Advanced applications may want to configure a retry throttler to Address Cascading Failures and when Handling Overload conditions. The authentication library throttles its retry loop, using a policy to control the throttling algorithm. Use this method to fine tune or customize the default retry throttler.

use gax::retry_throttler::AdaptiveThrottler;
let config = serde_json::json!({
    "type": "external_account",
    "audience": "audience",
    "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
    "token_url": "https://sts.googleapis.com/v1beta/token",
    "credential_source": { "file": "/path/to/your/oidc/token.jwt" }
});
let credentials = Builder::new(config)
    .with_retry_throttler(AdaptiveThrottler::default())
    .build();

pub fn build(self) -> Result<Credentials, Error>

Returns a Credentials instance with the configured settings.

Errors

Returns a BuilderError if the external_account_config provided to Builder::new cannot be successfully deserialized into the expected format for an external account configuration. This typically happens if the JSON value is malformed or missing required fields.

For more information, on the expected format, consult the relevant section in the external_account_credentials guide.

pub fn build_access_token_credentials( self, ) -> Result<AccessTokenCredentials, Error>

Returns an AccessTokenCredentials instance with the configured settings.

Errors

Returns a BuilderError if the external_account_config provided to Builder::new cannot be successfully deserialized into the expected format for an external account configuration. This typically happens if the JSON value is malformed or missing required fields.

For more information, on the expected format, consult the relevant section in the external_account_credentials guide.