Repository navigation
feat(spanner): support --access_token_file in google-cloud-spanner-executor - #14976
Open
gyang-google wants to merge 5 commits into
Open
gyang-google wants to merge 5 commits into
gyang-google wants to merge 5 commits into
Conversation
…ecutor Add `--access_token_file` to `WorkerProxy` and a Java-8-compatible `AccessTokenFileCredentials` (`OAuth2Credentials` subclass) so externally rotated OAuth2 bearer token files are periodically re-read across Spanner client initialization, OpenTelemetry trace export, and Cloud Trace verification.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request introduces AccessTokenFileCredentials, a new credentials class that allows the Spanner executor to authenticate using a raw OAuth2 bearer token read from a local file. It updates WorkerProxy to support a new --access_token_file command-line flag, ensuring mutual exclusivity with the existing --service_key_file flag, and refactors credential resolution across CloudClientExecutor and WorkerProxy. The review feedback highlights a potential startup crash caused by eagerly calling credentials.refresh() during credential resolution, suggesting instead to rely on lazy loading supported by OAuth2Credentials to handle cases where the token file is temporarily missing or empty on startup.
Remove eager `credentials.refresh()` in `WorkerProxy.getCredentialsFromFlags()` so startup does not fail if an external sidecar provisions the access token file asynchronously. `OAuth2Credentials` lazily invokes `refreshAccessToken()` on the first `getRequestMetadata()` call.
sakthivelmanii
approved these changes
Nov 12, 2026
sakthivelmanii
added
the
kokoro:force-run
yoshi-kokoro
removed
the
kokoro:force-run
olavloite
added
the
kokoro:force-run
yoshi-kokoro
removed
the
kokoro:force-run
olavloite
approved these changes
Nov 12, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
--access_token_filesupport togoogle-cloud-spanner-executor(WorkerProxyandCloudClientExecutor) as an alternative to--service_key_filewhen an external host process provisions and periodically rotates short-lived OAuth2 bearer access tokens on disk.Changes
AccessTokenFileCredentials: Package-private Java-8-compatibleOAuth2Credentialssubclass that reads and trims a bearer token from disk and assigns a 15-minute synthetic expiration soOAuth2Credentialsperiodically refreshes the cached token as the underlying file is atomically rotated.WorkerProxy&CloudClientExecutor:--access_token_fileCLI option and enforces mutual exclusion with--service_key_file.WorkerProxy.getCredentialsFromFlags()acrossWorkerProxy.setupOpenTelemetrySdk(),CloudClientExecutor.initializeClient(), andCloudClientExecutor.getTraceServiceClient().AccessTokenFileCredentialsTest: Adds unit tests covering token reading/trimming, fresh-token caching, explicit refresh, automatic refresh across atomic file replacement, invalid/empty file handling, and CLI option validation.