GCP GCE Authentication

[ronlhayes]

I am looking for a way to authenticate to GCP using GCE. HCP has an example for IAM but not for GCE. Spent much time looking but nothing aside from using the CLI. Finally tried ChatGPT for a solution and got the code below but appears it is not valid (or uses an older version?). Any help greatly appreciated!

using VaultSharp;
using VaultSharp.V1.AuthMethods;
using VaultSharp.V1.AuthMethods.Gcp;
using System;
using System.Threading.Tasks;

class Program
{
static async Task Main(string[] args)
{
string vaultAddress = "http://your-vault-address:8200";
string role = "my-role";

    // Initialize Vault client settings.
    var vaultSettings = new VaultClientSettings(vaultAddress);
    var vaultClient = new VaultClient(vaultSettings);

    try
    {
        // Authenticate with GCP GCE method.
        var gcpGceAuthMethodInfo = new GcpGceAuthMethodInfo(role);
        var authResponse = await vaultClient.V1.Auth.GcpGce.AuthenticateAsync(gcpGceAuthMethodInfo);

        // Extract token from the authentication response.
        var vaultToken = authResponse.AuthClientToken;

        // Use the token to interact with Vault.
        // For example, you can read secrets:
        var secretResponse = await vaultClient.V1.Secrets.KeyValue.V1.ReadSecretAsync("my-secret-path");
        Console.WriteLine(secretResponse.Data["my-secret-key"]);
    }
    catch (Exception ex)
    {
        Console.WriteLine($"Error: {ex.Message}");
    }
}

}

[rajanadar]

hey @ronlhayes

Here is the snippet.

       // The gceJWT is the identity metadata token.
       // See this: https://cloud.google.com/compute/docs/instances/verifying-instance-identity#request_signature

        // Authenticate with GCP GCE method.
        var gcpGceAuthMethodInfo = new GcpGceAuthMethodInfo(role, gceJwt);

        var vaultSettings = new VaultClientSettings(vaultAddress, gcpGceAuthMethodInfo);
        var vaultClient = new VaultClient(vaultSettings);

        // Use the token to interact with Vault.
        // For example, you can read secrets:
        var secretResponse = await vaultClient.V1.Secrets.KeyValue.V1.ReadSecretAsync("my-secret-path");
        Console.WriteLine(secretResponse.Data["my-secret-key"]);