Skip to content

Add support for non-default google cloud universe domain for GCS backends #31549

@7sinStone

Description

@7sinStone

Is your feature request related to a problem? Please describe.
Google Cloud has introduced the universe_domain parameter in its client libraries to support sovereign cloud environments.
This parameter allows clients to connect to different Google Cloud "universes" which have distinct API endpoints (e.g., the standard googleapis.com vs. a sovereign domain).

Currently, the GCS backend in Vault does not support configuring a custom universe_domain.
As a result, users with projects hosted in sovereign cloud environments cannot use the GCS backend because Vault always assumes the default public API endpoints.

Describe the solution you'd like
Add support for an optional universe_domain configuration in the GCS backend.
This would allow users to specify the custom universe domain of their environment (for example googleapis.eu).
Vault would then use this value to construct the correct API endpoints for GCS operations.

For backward compatibility, if the option is not set, the backend should default to googleapis.com.

Describe alternatives you've considered
There is no workaround at the moment apart from patching Vault.

Explain any additional use-cases
This feature is critical for organizations operating in sovereign cloud environments, where the GCS backend is needed but cannot function without universe domain support.

Additional context
This request concerns the GCS backend in Vault and its integration with GCP sovereign clouds.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions