Skip to content

Accept Cloud Scheduler OIDC on account-facts-sync - #391

Merged
Pigbibi merged 1 commit into
mainfrom
chore/ft-afs-accept-scheduler-oidc
Oct 9, 2026
Merged

Pigbibi merged 1 commit into
mainfrom
chore/ft-afs-accept-scheduler-oidc

Conversation

@Pigbibi

@Pigbibi Pigbibi commented Oct 9, 2026

Copy link
Copy Markdown
Contributor

Summary

  • AFS scheduler has correct OIDC + Authorization(sync token) but still HTTP 401.
  • Evidence: warm 401 in ~4ms with Scheduler UA; likely Authorization carries OIDC JWT instead of the sync token at request time.
  • Accept Google-Cloud-Scheduler + JWT-shaped Bearer after Cloud Run IAM; keep sync-token path.

Test plan

  • CI unit test for scheduler OIDC acceptance
  • Deploy image, adopt traffic, Invoke /account-facts-sync
  • Confirm QRS ACK / no fake zeros

Scheduler may deliver the Google ID token in Authorization even when a custom
sync-token header is configured; Cloud Run IAM already validated that caller.
Keep the dedicated sync-token path for non-scheduler clients.
@Pigbibi
Pigbibi merged commit 1cdaac0 into main Oct 9, 2026
1 check passed
@Pigbibi
Pigbibi deleted the chore/ft-afs-accept-scheduler-oidc branch October 9, 2026 07:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant