Feature: Google Artifact Registry Uplink support

[jonathonbattista]

Support for GCP Artifact Registry for Uplinks.

It's fairly simple. I have a POC working that refreshes the Access Token on calls to the Uplink if the env var string is GCP_ACCESS_TOKEN

We don't permit Service Account Keyfiles and using a short-lived token is the better option. The token is valid for 60m

It requires:

• installing the Google Cloud SDK in the Dockerfile
• updating the proxy logic to refresh the token
• setting up permission to access the repo roles/artifactregistry.reader

I am using the Helm Chart and Workload Identity (WID)

config.yaml

uplinks:
   npm-repo:
      url: https://us-npm.pkg.dev/project_id/npm-repo/
      auth:
        type: bearer
        token_env: GCP_ACCESS_TOKEN

packages/proxy/src/proxy.ts

if (_.isNil(tokenConf.token) === false && _.isString(tokenConf.token)) {
  token = tokenConf.token;
} else if (_.isNil(tokenConf.token_env) === false) {
  if (typeof tokenConf.token_env === 'string') {
    if (tokenConf.token_env === 'GCP_ACCESS_TOKEN') {
      try {
        token = execSync('gcloud auth print-access-token').toString().trim();
        this.logger.http('Successfully refreshed GCP Access Token');
      } catch (error) {
        this.logger.error('Failed to obtain GCP access token');
        this._throwErrorAuth(constants.ERROR_CODE.token_required);
      }
    } else {
      token = process.env[tokenConf.token_env];
    }
  } else if (typeof tokenConf.token_env === 'boolean' && tokenConf.token_env) {
    token = process.env.NPM_TOKEN;
  } else {
    this.logger.error(constants.ERROR_CODE.token_required);
    this._throwErrorAuth(constants.ERROR_CODE.token_required);
  }
} else {
  token = process.env.NPM_TOKEN;
}

[mbtools]

Cool. You might be able to implement this via a middleware plugin that sets GCP_ACCESS_TOKEN for requests that would be hitting the GCP registry (when the uplink is accessed).