fix google-auth bug

Jenkinsfile

@@ -52,7 +52,7 @@ SUPPORTED_STAGES = [
 ]
 
 // Supported VM Images
-SLAVE_IMAGE = 'gcr.io/endpoints-jenkins/debian-9:0.11'
+SLAVE_IMAGE = 'gcr.io/endpoints-jenkins/debian-9:0.12'
 
 // Release Qualification end to end tests.
 // If RAPTURE_REPO build parameter is set only those test will run.

jenkins/slaves/Makefile

@@ -1,5 +1,5 @@
 PROJECT = endpoints-jenkins
-VERSION = 0.11
+VERSION = 0.12
 TOOLS_BUCKET = endpoints-tools
 
 # Note: The build directory is the root of the istio/test-infra repository, not ./

script/linux-install-software

@@ -101,7 +101,7 @@ ${SUDO} apt-get clean
 retry install_packages || error_exit 'Cannot install required packages.'
 retry ${SUDO} pip install --upgrade python-gflags || error_exit 'Cannot install gflags.'
 retry ${SUDO} pip install --upgrade certifi || error_exit 'Cannot install certifi.'
-retry ${SUDO} pip install --upgrade google-auth google-auth-httplib2 google-api-python-client || error_exit 'Cannot install google-auth.'
+retry ${SUDO} pip install --upgrade requests google-auth google-auth-httplib2 google-api-python-client || error_exit 'Cannot install google-auth.'
 retry ${SUDO} pip install --upgrade urllib3 || error_exit 'Cannot install urllib3.'
 retry ${SUDO} pip install --upgrade prettytable Mako pyaml dateutils || error_exit 'Cannot install prettytable Mako pyaml dateutils.'
 

start_esp/BUILD

@@ -53,7 +53,10 @@ pex_binary(
     reqs = [
         "certifi",
         "mako>=1.0.4",
-        "google-auth>=1.6.3",
+        "google-auth",
+        "google-auth-httplib2",
+        "google-api-python-client",
+        "requests",
         "pyasn1>=0.1.9",
         "pyasn1-modules>=0.0.8",
         "urllib3>=1.16",

start_esp/fetch_service_config.py

@@ -29,7 +29,8 @@
 import json
 import logging
 import urllib3
-from google.oauth2.service_account import Credentials
+import google.oauth2.service_account
+from google.auth.transport.requests import Request
 
 # Service management service
 SERVICE_MGMT_ROLLOUTS_URL_TEMPLATE = (
@@ -144,12 +145,17 @@ def fetch_metadata_attributes(metadata):
 def make_access_token(secret_token_json):
     """Construct an access token from service account token."""
     logging.info("Constructing an access token with scope " + _GOOGLE_API_SCOPE)
-    credentials = Credentials.from_service_account_info(
+    cred = google.oauth2.service_account.Credentials.from_service_account_file(
         secret_token_json,
         scopes=[_GOOGLE_API_SCOPE])
-    logging.info("Service account email: " + credentials.service_account_email)
-    token = credentials.get_access_token().access_token
-    return token
+    logging.info("Service account email: " + cred.service_account_email)
+    body = {
+        'assertion': cred._make_authorization_grant_assertion(),
+        'grant_type': google.oauth2._client._JWT_GRANT_TYPE,
+    }
+    token_response = google.oauth2._client._token_endpoint_request(
+        google.auth.transport.requests.Request(), cred._token_uri, body)
+    return  token_response["access_token"] if "access_token" in token_response else ""
 
 def fetch_access_token(metadata):
     """Fetch access token from metadata URL."""