Skip to content

Use updated google auth method#3186

Merged
tylerpotts merged 1 commit intomainfrom
fix_gcp_deprecation
Nov 17, 2025
Merged

Use updated google auth method#3186
tylerpotts merged 1 commit intomainfrom
fix_gcp_deprecation

Conversation

@tylerpotts
Copy link
Contributor

@tylerpotts tylerpotts commented Nov 14, 2025

What does this implement/fix?

Put a x in the boxes that apply

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds a feature)
  • Breaking change (fix or feature that would cause existing features not to work as expected)
  • Documentation Update
  • Code style update (formatting, renaming)
  • Refactoring (no functional changes, no API changes)
  • Build related changes
  • Other (please describe):

Testing

  • Did you test the pull request locally?
  • Did you add new tests?

Any other comments?

The Google auth library was throwing this warning:

warnings.warn(_GENERIC_LOAD_METHOD_WARNING.format(method_name), DeprecationWarning)
DeprecationWarning: The load_credentials_from_file method is deprecated because of a potential security risk.

This method does not validate the credential configuration. The security
risk occurs when a credential configuration is accepted from a source that
is not under your control and used without validation on your side.

If you know that you will be loading credential configurations of a
specific type, it is recommended to use a credential-type-specific
load method.
This will ensure that an unexpected credential type with potential for
malicious intent is not loaded unintentionally. You might still have to do
validation for certain credential types. Please follow the recommendations
for that method. For example, if you want to load only service accounts,
you can create the service account credentials explicitly:


from google.oauth2 import service_account
creds = service_account.Credentials.from_service_account_file(filename)


If you are loading your credential configuration from an untrusted source and have
not mitigated the risks (e.g. by validating the configuration yourself), make
these changes as soon as possible to prevent security risks to your environment.

Regardless of the method used, it is always your responsibility to validate
configurations received from external sources.

Refer to https://cloud.google.com/docs/authentication/external/externally-sourced-credentials
for more details

This was causing tests to fail with the following:

FAILED tests_deployment/test_conda_store_roles_loaded.py::test_conda_store_roles_loaded_from_keycloak[admin!namespace=analyst,developer!namespace=nebari-git-changed_scopes0] - DeprecationWarning: The load_credentials_from_file method is deprecated because of a potential security risk.

This PR updates to the new authentication method

@tylerpotts tylerpotts requested a review from a team as a code owner November 14, 2025 23:00
@tylerpotts tylerpotts requested review from dcmcand and viniciusdc and removed request for a team November 14, 2025 23:00
Copy link
Contributor

@viniciusdc viniciusdc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @tylerpotts I saw that yesterday as well.

@tylerpotts tylerpotts merged commit 7c9bcc7 into main Nov 17, 2025
24 of 27 checks passed
@tylerpotts tylerpotts deleted the fix_gcp_deprecation branch November 17, 2025 16:51
@github-project-automation github-project-automation bot moved this from New 🚦 to Done 💪🏾 in 🪴 Nebari Project Management Nov 17, 2025
@viniciusdc viniciusdc added this to the 2026.02.1 milestone Jan 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done 💪🏾

Development

Successfully merging this pull request may close these issues.

2 participants