From c005fbb3dc4f9ba83cfe3f205308682e4aa0345b Mon Sep 17 00:00:00 2001 From: Raghunandan Balachandran Date: Mon, 11 Aug 2025 17:39:12 +0200 Subject: [PATCH] reduce scopes to gke container api Signed-off-by: Raghunandan Balachandran --- .../src/auth/GoogleServiceAccountStrategy.test.ts | 2 +- .../kubernetes-backend/src/auth/GoogleServiceAccountStrategy.ts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/plugins/kubernetes-backend/src/auth/GoogleServiceAccountStrategy.test.ts b/plugins/kubernetes-backend/src/auth/GoogleServiceAccountStrategy.test.ts index dedebb9684..57181f61c6 100644 --- a/plugins/kubernetes-backend/src/auth/GoogleServiceAccountStrategy.test.ts +++ b/plugins/kubernetes-backend/src/auth/GoogleServiceAccountStrategy.test.ts @@ -100,7 +100,7 @@ describe('GoogleServiceAccountStrategy', () => { expect(MockedClusterManagerClient).toHaveBeenCalledWith({ credentials: serviceAccountKey, - scopes: ['https://www.googleapis.com/auth/cloud-platform'], + scopes: ['https://www.googleapis.com/auth/container.readonly'], }); expect(mockGetAccessToken).toHaveBeenCalled(); expect(credential).toEqual({ diff --git a/plugins/kubernetes-backend/src/auth/GoogleServiceAccountStrategy.ts b/plugins/kubernetes-backend/src/auth/GoogleServiceAccountStrategy.ts index 4dce97ea29..a6ffdc00e8 100644 --- a/plugins/kubernetes-backend/src/auth/GoogleServiceAccountStrategy.ts +++ b/plugins/kubernetes-backend/src/auth/GoogleServiceAccountStrategy.ts @@ -65,7 +65,7 @@ export class GoogleServiceAccountStrategy implements AuthenticationStrategy { client = new container.v1.ClusterManagerClient({ credentials: credentialsObject, - scopes: ['https://www.googleapis.com/auth/cloud-platform'], + scopes: ['https://www.googleapis.com/auth/container.readonly'], }); } catch (error) { throw new Error(