GCE metadata server credentials cannot sign storage blob

[neozwu]

With GAE java 8 standard runtime, GCE metadata server is used to retrieve credentials. However, unlike google.appengine.api.app_identity.sign_blob(), metadata sever is not able to sign GCS blob (discussion captured here and here). It seems the timeline for metadata server to enable signing is not clear. This currently blocks java storage client library to run on GAE java 8 standard (googleapis/google-cloud-java#2629). Auth lib should implement IAM signer to provide workaround (as python auth lib did: googleapis/google-auth-library-python#108)

[phimar]

Hi.
Can I do anything to push a fix for this issue? Like providing a PR?

[vchudnov-g]

@lesv , would you be able to address this or assign to someone who could?

[lesv]

I'll create an internal issue and cc all of you.

[lesv]

Done. Googler's should see an email.

[dtretyakov]

It will make configuration of our solution much easier without dealing with private json keys to produce signed urls for storage blobs.

[dtretyakov]

@lesv, it was addressed in #150