fix(auth): allowlist agents-nonprod trust domains for agent identity#17155
Merged
Conversation
Allow `agents-nonprod` SPIFFE trust domains (`agents-nonprod.global.org-<id>.system.id.goog` and `agents-nonprod.global.proj-<id>.system.id.goog`) in addition to the production `agents` ones. This enables support for Agent Identity testing and validation in non-production environments (e.g., GKE autopush, staging), resolving pool format validation failures for non-prod agent pools. Bug: b/513574981
Contributor
There was a problem hiding this comment.
Code Review
This pull request updates the agent identity utilities to include support for non-production SPIFFE trust domain patterns. Specifically, it adds regex patterns for agents-nonprod global organizations and projects to the allowed trust domains. The changes also include import refactoring for better organization and an update to the test suite to validate these new patterns using a parameterized test case. There are no review comments to evaluate, and I have no feedback to provide.
macastelaz
approved these changes
May 15, 2026
This was referenced May 15, 2026
suztomo
added a commit
that referenced
this pull request
May 15, 2026
PR created by the Librarian CLI to initialize a release. Merging this PR will auto trigger a release. Librarian Version: v0.13.0 Language Image: us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/python-librarian-generator@sha256:234b9d1f2ddb057ed7ac6a38db0bf8163d839c65c6cf88ade52530cddebce59e <details><summary>google-auth: v2.53.0</summary> ## [v2.53.0](suztomo/google-cloud-python@google-auth-v2.52.0...google-auth-v2.53.0) (2026-05-15) ### Bug Fixes * allowlist agents-nonprod trust domains for agent identity (#17155) ([44c93d2](suztomo@44c93d2e)) * fail-fast on invalid or non-workload certificate configs in agent identity discovery (#17116) ([f27a546](suztomo@f27a5461)) </details> b/513591686
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Allow
agents-nonprodSPIFFE trust domains (agents-nonprod.global.org-<id>.system.id.googandagents-nonprod.global.proj-<id>.system.id.goog) in addition to the productionagentsones. This enables support for Agent Identity testing and validation in non-production environments (e.g., GKE autopush, staging), resolving pool format validation failures for non-prod agent pools.Bug: b/513574981