↓Skip to main content

Bank of Anthos: Resolving Cross-Project Workload Identity Telemetry (PR #2423)

179 words·1 min· loading · loading · ·
Vijay Kumar Singh
Open Source kubernetes GKE Java Spring-Boot GCP Workload-Identity Observability
Vijay Kumar Singh
Author
Vijay Kumar Singh
Microsoft Certified: DP-900, AI-900, AI-102 & Google Cloud: Associate Cloud Engineer. Open to DevOps, SRE, Cloud, DevSecOps, AI, GenAI, MLOps, and AIOps roles
Table of Contents

Project Overview
#

Bank of Anthos is a Kubernetes-native microservices reference application developed by Google Cloud to demonstrate enterprise architecture patterns on GKE, Istio, and Cloud Observability.

The Problem Solved
#

Java microservices (balancereader, ledgerwriter, transactionhistory) ignored the GOOGLE_CLOUD_PROJECT environment variable, falling back solely to the local GCE Metadata Server. In multi-project Workload Identity deployments (GKE cluster in Project A, monitoring telemetry in Project B), this caused 403 Forbidden errors and silent metrics loss.

Technical Execution
#

  • Java & Spring Boot Refactoring: Refactored projectId() resolution logic across all 3 microservices to evaluate System.getenv("GOOGLE_CLOUD_PROJECT") first with safe fallbacks.
  • Spring Cloud GCP Alignment: Updated application.properties with spring.cloud.gcp.project-id=${GOOGLE_CLOUD_PROJECT:} to synchronize trace exporters with metric overrides.
  • Unit Testing: Authored JUnit 5 suites (e.g., BalanceReaderApplicationTest.java) ensuring 100% test branch coverage for configuration overrides.
  • Google Jib Containerization: Used Maven with Google Jib to build and push container images directly to Google Container Registry without local Docker daemons.
  • GKE Validation: Deployed custom images to a live GKE cluster, diagnosing and resolving node service-account pull permissions (storage.objectViewer, artifactregistry.reader).

Links & Pull Request
#

Reply by Email