release-1.8 Issue #6921: Unbreak compute engine url signing

README.md

@@ -175,8 +175,6 @@ This involves creating an external credential file and using it as `--secret-fil
 
 #### Option 3: Using GKE Workload Identity
 
-Keep in mind that [Workforce Identity Federation Users cannot generate signed URLs](https://cloud.google.com/iam/docs/federated-identity-supported-services#:~:text=workforce%20identity%20federation%20users%20cannot%20generate%20signed%20URLs.). This means, if you are using Workforce Identity Federation, you will not be able to run `velero backup logs`, `velero backup download`, `velero backup describe` and `velero restore describe`.
-
 This requires a GKE cluster with workload identity enabled.
 
 1. Create Velero Namespace

changelogs/unreleased/159-kaovilai

@@ -0,0 +1 @@
+Regression fix: Unbreak signed urls for compute engine

velero-plugin-for-gcp/object_store.go

@@ -301,8 +301,10 @@ func (o *ObjectStore) SignBytes(bytes []byte) ([]byte, error) {
 }
 
 func (o *ObjectStore) CreateSignedURL(bucket, key string, ttl time.Duration) (string, error) {
-	if o.fileCredType != serviceAccountKey {
-		return "", errors.New("cannot sign blob using non SA file credentials")
+	// googleAccessID is initialized from ServiceAccount key file and compute engine credentials.
+	// If using external_account credentials, googleAccessID will be empty and we cannot create signed URL.
+	if o.googleAccessID == "" {
+		return "", errors.New("GoogleAccessID is empty, perhaps using external_account credentials, cannot create signed URL")
 	}
 	options := storage.SignedURLOptions{
 		GoogleAccessID: o.googleAccessID,