Cannot execute remote tasks when Identity Aware Proxy is on

[leandrogoe]

Currently there is no way to execute remote tasks when the identity aware proxy is on. The task will simply fail when trying to poll the status over the newly deployed app engine version.

As a workaround, I've monkey patched the code in order to be able to supply a service account key file and a client id:

class AppEngine::Exec

  # PATCH - Memoize authorizer that will be used when polling the status
  def authorizer
    authorizer ||= begin
      key_path = ENV['GAE_SERVICE_ACCOUNT_KEY_PATH']
      client_id = ENV['GAE_IAM_CLIENT_ID']

      if client && key_path
        puts "Using IAM authorizer with GAE_SERVICE_ACCOUNT_KEY_PATH: #{key_path} and GAE_IAM_CLIENT_ID: #{client_id}"
        Google::Auth::ServiceAccountCredentials.make_creds(
          json_key_io: File.open(key_path),
          target_audience: client_id
        )
      end
    end
  end

  def track_status temp_version, secret
    host = "#{temp_version}.#{@service}.#{@project}.appspot.com"
    ::Net::HTTP.start host do |http|
      outpos = errpos = 0
      delay = 0.0
      loop do
        sleep delay
        uri = URI("http://#{host}/#{secret}")
        uri.query = ::URI.encode_www_form outpos: outpos, errpos: errpos

        # BEGIN PATCH - Adding authorizer while polling the status
        req = Net::HTTP::Get.new(uri)
        authorizer&.apply!(req)
        response = http.request(req)
        # END PATCH - Adding authorizer while polling the status

        data = ::JSON.parse response.body
        data["outlines"].each { |line| puts "[STDOUT] #{line}" }
        data["errlines"].each { |line| puts "[STDERR] #{line}" }
        outpos = data["outpos"]
        errpos = data["errpos"]
        return data["status"] if data["status"]
        if data["time"] > @timeout_seconds

          # BEGIN PATCH - Adding authorizer while polling the status
          req = Net::HTTP::Post.new("/#{secret}/kill")
          authorizer&.apply!(req)
          http.request(req)
          # END PATCH - Adding authorizer while polling the status

          return "timeout"
        end
        if data["outlines"].empty? && data["errlines"].empty?
          delay += 0.1
          delay = 1.0 if delay > 1.0
        else
          delay = 0.0
        end
      end
    end
  end
end