Package io.github.flink.gcp.connector.base.auth

Class ServiceAccountKeys

java.lang.Object

io.github.flink.gcp.connector.base.auth.ServiceAccountKeys

@Internal
public final class ServiceAccountKeys
extends Object

Loads the service-account key file a connector is configured with.

Each connector keeps its own entry point, which decides the scopes its clients need and whether to wrap the result in a gax credentials provider. This class owns what they share: a null path leaves application-default credentials in effect, and a failure is reported without the path or the parser's exception (ADR-0174).

Method Summary

Modifier and Type	Method	Description
static com.google.auth.oauth2.GoogleCredentials	load(String serviceAccountKeyFile, Collection<String> scopes, String product)	Loads and scopes a service-account key file, or returns null to leave application-default credentials in effect.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

load

@Nullable
public static com.google.auth.oauth2.GoogleCredentials load(@Nullable
 String serviceAccountKeyFile,
 Collection<String> scopes,
 String product)
                                                     throws IOException

Loads and scopes a service-account key file, or returns null to leave application-default credentials in effect.

The path and parser failure are deliberately absent from the exception. A path can expose a mounted secret's name, and parser exceptions can echo credential material. The actionable distinction is whether the configured file could be loaded at all.

Parameters:

serviceAccountKeyFile - the configured key-file path, or null for ADC

scopes - the OAuth scopes the loaded credentials are restricted to

product - the product name the failure message carries, such as "Spanner"

Returns:

scoped service-account credentials, or null for ADC

Throws:

IOException - if the configured file cannot be read as a service-account key