Connecting to a GCS bucket with service account impersonation

[lrntct]

Hi!

I am trying to connect to an Icechunk store on a GCS bucket using an impersonated service account:

output_storage = icechunk.gcs_storage(bucket=bucket_name, prefix=data_prefix, from_env=True)
icechunk_repo = icechunk.Repository.open(output_storage)
icechunk_session = icechunk_repo.readonly_session("main")

and it fails:

failed to create object store: ICError {
 kind: Other("Generic GCS error: Unable to decode service account file: unknown variant `impersonated_service_account`, expected `service_account` or `authorized_user` at line 12 column 40"), context: SpanTrace [
{ target: "icechunk::storage::object_store", name: "get_client", file: "icechunk/src/storage/object_store.rs", line: 137 },
{ target: "icechunk::storage::object_store", name: "fetch_config", file: "icechunk/src/storage/object_store.rs", line: 295 },
{ target: "icechunk::repository", name: "fetch_config", file: "icechunk/src/repository.rs", line: 385 },
{ target: "icechunk::repository", name: "open", file: "icechunk/src/repository.rs", line: 250 }] }`

Is there a way to make this work?
It could be really useful, since Google recommends using SA impersonation for local developement.

I have a similar issue with obstore, I don't know if they are related.

[paraseba]

Thanks for adding the issue @lrntct . I think we will need support in the dependency project object_store, both for Icechunk and obstore.

[lrntct]

Thanks for your answer. I'm working on an app that needs access to Icechunk and signing URLs. AFAIK, I need a service account to sign a URL, but cannot impersonate one when accessing the Icechunk store. That's a bit of a pickle.

[paraseba]

Also remember Icechunk uses MANY files to represent a single snapshot. If you plan to give signed url access to an Icechunk repo, it could become tricky.

I'm curious about what you are trying to do.

[lrntct]

@paraseba I'm reading the Icechunk repo with xarray, then pack the values I need into a single file (for the time being, a tared zarr). Then, I give access to the single file through a signed URL.