feat(sandbox): add GCE metadata emulator for Google Cloud (#1763)

* feat(core): add shared GCP constants module

Single source of truth for GCP naming: env var aliases, provider config
keys, token search order, and Vertex-specific env vars. Consumed by
openshell-server, openshell-providers, and openshell-sandbox.

- Add google_cloud.rs with metadata emulator host and loopback address
- Define PROJECT_ID, REGION, and SERVICE_ACCOUNT_EMAIL env var aliases
- Add provider config key constants for gcp provider implementations
- Define TOKEN_ENV_KEYS search order (SA token takes priority over ADC)
- Add Vertex-specific env vars for Goose and Claude Code SDK integration
- Add STATIC_CONFIG_KEYS as union of all alias arrays for env resolution
- Export module via openshell-core lib.rs

Signed-off-by: Robert Sturla <rsturla@redhat.com>

* feat(providers): add google-cloud and vertex provider plugins

Add GoogleCloudProvider and VertexProvider implementing inject_env to
project GCP config (project ID, region, SA email, metadata host) into
sandbox environment variables. Replace the inline Vertex AI env
injection in the server with the registry-based inject_env dispatch.

Also adds the google-cloud.yaml provider profile with SA JWT and ADC
OAuth2 credential refresh flows.

Signed-off-by: Robert Sturla <rsturla@redhat.com>

* feat(sandbox): add GCE metadata emulator for GCP

Add a loopback HTTP server on 127.0.0.1:8174 inside the sandbox
network namespace that emulates the GCE instance metadata API.
GCP client SDKs discover it via GCE_METADATA_HOST and obtain
credential placeholders that the proxy resolves to real tokens
at egress.

Add metadata_server module with MetadataHandler trait and
netns-aware TCP binding via std::thread (not spawn_blocking)
to avoid tokio pool namespace contamination
Add google_cloud_metadata module implementing the GCE metadata
API subset (token, project-id, email, scopes, service-accounts)
Add child_env_resolved() and gcp_token_response() to
ProviderCredentialState for GCP-aware credential projection
Wire metadata server into sandbox lifecycle before SSH handler
Collapse multi-line HTTP response format string into single line

Signed-off-by: Robert Sturla <rsturla@redhat.com>

* docs(sandbox): add GCP credentials documentation

Document the google-cloud provider setup for ADC and service account
flows, injected environment variables, metadata emulator behavior, and
network policy configuration for GCP APIs.

Signed-off-by: Robert Sturla <rsturla@redhat.com>

* feat(cli): support --from-gcloud-adc for google-cloud providers

Widen --from-gcloud-adc to accept google-cloud providers. The ADC
credential key is derived from the provider profile rather than
hardcoded per type, so future GCP provider types get ADC support by
declaring the right refresh metadata in their profile YAML.

Add ProviderTypeProfile::adc_credential() to find the ADC-compatible
credential from a profile's refresh metadata. Remove unused
VERTEX_AI_ADC_TOKEN_KEY and GCP_ADC_TOKEN_KEY constants.

Signed-off-by: Robert Sturla <rsturla@redhat.com>

---------

Signed-off-by: Robert Sturla <rsturla@redhat.com>

Author: p5

architecture/sandbox.md

@@ -76,8 +76,10 @@ live under a dedicated directory. Children also enter a private mount namespace
 where that socket directory is hidden before privilege drop.
 
 Credential placeholders in proxied HTTP requests can be resolved by the proxy
-when policy allows the target endpoint. Secrets must not be logged in OCSF or
-plain tracing output.
+when policy allows the target endpoint. For GCP providers, a loopback metadata
+server inside the network namespace serves placeholders to SDKs that bypass the
+proxy (e.g. Go's `cloud.google.com/go/compute/metadata`). Secrets must not be
+logged in OCSF or plain tracing output.
 
 Provider profiles can also declare dynamic token grants. For matching HTTP
 endpoints, the supervisor obtains a SPIFFE JWT-SVID from the local Workload API,

crates/openshell-cli/src/main.rs

@@ -740,7 +740,7 @@ enum ProviderCommands {
 
         /// Configure credentials from gcloud Application Default Credentials
         /// (`~/.config/gcloud/application_default_credentials.json`).
-        /// Only valid for google-vertex-ai providers.
+        /// Valid for providers whose profile declares an ADC-compatible credential.
         #[arg(long, group = "cred_source", conflicts_with_all = ["from_existing", "credentials", "runtime_credentials"])]
         from_gcloud_adc: bool,
 

crates/openshell-cli/src/run.rs

@@ -4347,7 +4347,7 @@ fn read_gcloud_adc() -> Result<(String, String, String)> {
     Ok((client_id, client_secret, refresh_token))
 }
 
-async fn rollback_provider_create_after_vertex_adc_failure(
+async fn rollback_provider_create_after_gcloud_adc_failure(
     client: &mut crate::tls::GrpcClient,
     provider_name: &str,
     stage: &str,
@@ -4360,7 +4360,7 @@ async fn rollback_provider_create_after_vertex_adc_failure(
         .await
     {
         Ok(_) => Err(miette!(
-            "failed to {stage} Vertex AI credentials from gcloud ADC for provider '{provider_name}': {source}. \
+            "failed to {stage} credentials from gcloud ADC for provider '{provider_name}': {source}. \
              The provider was rolled back successfully."
         )),
         Err(cleanup_err) => {
@@ -4374,7 +4374,7 @@ async fn rollback_provider_create_after_vertex_adc_failure(
                 provider_name
             );
             Err(miette!(
-                "failed to {stage} Vertex AI credentials from gcloud ADC for provider '{provider_name}': {source}. \
+                "failed to {stage} credentials from gcloud ADC for provider '{provider_name}': {source}. \
                  Cleanup also failed, so the provider may still exist. \
                  Run 'openshell provider delete {provider_name}' to remove it manually."
             ))
@@ -4483,6 +4483,9 @@ async fn discover_existing_provider_data(
 /// Canonical provider type string for Google Vertex AI.
 const VERTEX_AI_PROVIDER_TYPE: &str = "google-vertex-ai";
 
+/// Canonical provider type string for Google Cloud (GCP APIs).
+const GOOGLE_CLOUD_PROVIDER_TYPE: &str = "google-cloud";
+
 fn missing_credentials_error(provider_type: &str) -> miette::Report {
     if provider_type == VERTEX_AI_PROVIDER_TYPE {
         return miette::miette!(
@@ -4493,6 +4496,14 @@ fn missing_credentials_error(provider_type: &str) -> miette::Report {
         );
     }
 
+    if provider_type == GOOGLE_CLOUD_PROVIDER_TYPE {
+        return miette::miette!(
+            "no credentials resolved for provider type '{provider_type}'. \
+             Set GCP_ADC_ACCESS_TOKEN or GCP_SA_ACCESS_TOKEN; \
+             or use --from-gcloud-adc / --from-existing with those env vars set."
+        );
+    }
+
     miette::miette!(
         "no credentials resolved for provider type '{provider_type}'. \
          Use --credential KEY[=VALUE], --runtime-credentials for runtime-resolved profile credentials, \
@@ -4583,11 +4594,34 @@ pub async fn provider_create_with_options(
         }
     };
 
-    if from_gcloud_adc && provider_type != VERTEX_AI_PROVIDER_TYPE {
-        return Err(miette::miette!(
-            "--from-gcloud-adc is only valid for google-vertex-ai providers"
-        ));
-    }
+    let adc_credential_key = if from_gcloud_adc {
+        let profile =
+            openshell_providers::get_default_profile(&provider_type).ok_or_else(|| {
+                miette::miette!(
+                    "--from-gcloud-adc requires a built-in provider profile, \
+                 but '{provider_type}' has none"
+                )
+            })?;
+        let adc_cred = profile.adc_credential().ok_or_else(|| {
+            miette::miette!(
+                "--from-gcloud-adc is not supported for '{provider_type}' providers \
+                 (no ADC-compatible credential in the provider profile)"
+            )
+        })?;
+        Some(
+            adc_cred
+                .env_vars
+                .first()
+                .ok_or_else(|| {
+                    miette::miette!(
+                        "ADC credential in '{provider_type}' profile has no env_vars declared"
+                    )
+                })?
+                .clone(),
+        )
+    } else {
+        None
+    };
 
     let mut credential_map = parse_credential_pairs(credentials)?;
     let mut config_map = parse_key_value_pairs(config, "--config")?;
@@ -4636,10 +4670,12 @@ pub async fn provider_create_with_options(
     }
 
     // Validate and read the ADC file BEFORE creating the provider so that
-    // a bad/missing ADC does not leave an orphan provider behind.
-    let gcloud_adc_material = if from_gcloud_adc {
+    // a bad/missing ADC does not leave an orphan provider behind. Bundle the
+    // credential key with the material so they stay coupled.
+    let gcloud_adc_bootstrap = if from_gcloud_adc {
         let (client_id, client_secret, refresh_token) = read_gcloud_adc()?;
-        Some((client_id, client_secret, refresh_token))
+        let key = adc_credential_key.expect("set when from_gcloud_adc is true");
+        Some((key, client_id, client_secret, refresh_token))
     } else {
         None
     };
@@ -4669,7 +4705,9 @@ pub async fn provider_create_with_options(
         .ok_or_else(|| miette::miette!("provider missing from response"))?;
     let provider_name = provider.object_name().to_string();
 
-    if let Some((client_id, client_secret, refresh_token)) = gcloud_adc_material {
+    if let Some((adc_credential_key, client_id, client_secret, refresh_token)) =
+        gcloud_adc_bootstrap
+    {
         let mut material = HashMap::new();
         material.insert("client_id".to_string(), client_id);
         material.insert("client_secret".to_string(), client_secret);
@@ -4678,7 +4716,7 @@ pub async fn provider_create_with_options(
         if let Err(configure_err) = client
             .configure_provider_refresh(ConfigureProviderRefreshRequest {
                 provider: provider_name.clone(),
-                credential_key: openshell_core::inference::VERTEX_AI_ADC_TOKEN_KEY.to_string(),
+                credential_key: adc_credential_key.clone(),
                 strategy: ProviderCredentialRefreshStrategy::Oauth2RefreshToken as i32,
                 material,
                 secret_material_keys: vec![
@@ -4689,7 +4727,7 @@ pub async fn provider_create_with_options(
             })
             .await
         {
-            return rollback_provider_create_after_vertex_adc_failure(
+            return rollback_provider_create_after_gcloud_adc_failure(
                 &mut client,
                 &provider_name,
                 "configure",
@@ -4701,11 +4739,11 @@ pub async fn provider_create_with_options(
         if let Err(rotate_err) = client
             .rotate_provider_credential(RotateProviderCredentialRequest {
                 provider: provider_name.clone(),
-                credential_key: openshell_core::inference::VERTEX_AI_ADC_TOKEN_KEY.to_string(),
+                credential_key: adc_credential_key,
             })
             .await
         {
-            return rollback_provider_create_after_vertex_adc_failure(
+            return rollback_provider_create_after_gcloud_adc_failure(
                 &mut client,
                 &provider_name,
                 "mint the initial access token for",
@@ -4715,9 +4753,7 @@ pub async fn provider_create_with_options(
         }
 
         println!("{} Created provider {}", "✓".green().bold(), provider_name);
-        println!(
-            "Configured Vertex AI credentials from gcloud ADC and minted the initial access token"
-        );
+        println!("Configured GCP credentials from gcloud ADC and minted the initial access token");
         return Ok(());
     }
 

crates/openshell-cli/tests/provider_commands_integration.rs

@@ -2329,8 +2329,7 @@ async fn provider_create_from_gcloud_adc_rejects_wrong_provider_type_before_cred
     .expect_err("wrong provider type should fail before generic credential validation");
 
     assert!(
-        err.to_string()
-            .contains("--from-gcloud-adc is only valid for google-vertex-ai providers"),
+        err.to_string().contains("--from-gcloud-adc"),
         "unexpected error: {err}"
     );
     assert!(ts.state.providers.lock().await.is_empty());

crates/openshell-core/src/google_cloud.rs

@@ -0,0 +1,111 @@
+// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//! Shared GCP constants for the metadata emulator, provider env injection,
+//! and credential resolution.
+//!
+//! This module is the single source of truth for GCP naming: env var aliases,
+//! provider config keys, token search order, and Vertex-specific env vars.
+//! `openshell-server`, `openshell-providers`, and `openshell-sandbox`
+//! import from here.
+
+// ── Metadata emulator ───────────────────────────────────────────────────────
+
+/// Hostname served by the GCE metadata emulator via proxy interception.
+pub const METADATA_HOST: &str = "gcp.metadata.openshell.internal";
+
+/// Loopback address for the GCE metadata server inside sandbox namespaces.
+/// Go's metadata client dials this directly (bypasses `HTTP_PROXY`).
+pub const METADATA_LOOPBACK_ADDR: &str = "127.0.0.1:8174";
+
+// ── Env var alias arrays ────────────────────────────────────────────────────
+
+/// Env vars that carry the GCP project ID inside sandboxes.
+pub const PROJECT_ID_ENV_VARS: &[&str] = &["GCP_PROJECT_ID", "GOOGLE_CLOUD_PROJECT"];
+
+/// Env vars that carry the GCP region/location inside sandboxes.
+pub const REGION_ENV_VARS: &[&str] = &["CLOUD_ML_REGION", "GCP_LOCATION"];
+
+/// Env vars that carry the GCP service account email inside sandboxes.
+pub const SERVICE_ACCOUNT_EMAIL_ENV_VARS: &[&str] = &["GCP_SERVICE_ACCOUNT_EMAIL"];
+
+// ── Provider config keys ────────────────────────────────────────────────────
+
+/// Config key for project ID in `gcp` providers.
+pub const GCP_PROJECT_ID_CONFIG_KEY: &str = "project_id";
+
+/// Config key for region in `gcp` providers.
+pub const GCP_REGION_CONFIG_KEY: &str = "region";
+
+/// Config key for service account email in `gcp` providers.
+pub const GCP_SERVICE_ACCOUNT_EMAIL_CONFIG_KEY: &str = "service_account_email";
+
+// ── Token search order ──────────────────────────────────────────────────────
+
+/// GCP token env vars searched in priority order by the metadata emulator.
+/// SA token wins over ADC if both are configured, matching GCP's own
+/// credential precedence.
+pub const TOKEN_ENV_KEYS: &[&str] = &["GCP_SA_ACCESS_TOKEN", "GCP_ADC_ACCESS_TOKEN"];
+
+// ── Vertex-specific env vars ────────────────────────────────────────────────
+
+/// Env var injected to signal Vertex AI usage to Goose.
+pub const GOOSE_PROVIDER_ENV_VAR: &str = "GOOSE_PROVIDER";
+
+/// Env var for Anthropic Vertex project ID (consumed by Claude Code SDK).
+pub const ANTHROPIC_VERTEX_PROJECT_ID_ENV_VAR: &str = "ANTHROPIC_VERTEX_PROJECT_ID";
+
+/// Env var for Vertex location (consumed by Claude Code SDK).
+pub const VERTEX_LOCATION_ENV_VAR: &str = "VERTEX_LOCATION";
+
+/// Non-secret GCP/Vertex config vars that must be resolved to real values
+/// in the child environment. Everything else stays as placeholders for
+/// proxy-time resolution.
+///
+/// This list MUST be the union of all alias arrays above plus all
+/// Vertex-specific env vars. If you add an alias to `PROJECT_ID_ENV_VARS`,
+/// `REGION_ENV_VARS`, or a Vertex constant, add it here too.
+pub const STATIC_CONFIG_KEYS: &[&str] = &[
+    // project_id aliases
+    "GCP_PROJECT_ID",
+    "GOOGLE_CLOUD_PROJECT",
+    // region aliases
+    "CLOUD_ML_REGION",
+    "GCP_LOCATION",
+    // service account email
+    "GCP_SERVICE_ACCOUNT_EMAIL",
+    // Vertex-specific non-secret config
+    GOOSE_PROVIDER_ENV_VAR,
+    ANTHROPIC_VERTEX_PROJECT_ID_ENV_VAR,
+    VERTEX_LOCATION_ENV_VAR,
+];
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::HashSet;
+
+    #[test]
+    fn static_config_keys_matches_alias_arrays_and_vertex_vars() {
+        let expected: HashSet<&str> = PROJECT_ID_ENV_VARS
+            .iter()
+            .chain(REGION_ENV_VARS)
+            .chain(SERVICE_ACCOUNT_EMAIL_ENV_VARS)
+            .copied()
+            .chain([
+                GOOSE_PROVIDER_ENV_VAR,
+                ANTHROPIC_VERTEX_PROJECT_ID_ENV_VAR,
+                VERTEX_LOCATION_ENV_VAR,
+            ])
+            .collect();
+        let actual: HashSet<&str> = STATIC_CONFIG_KEYS.iter().copied().collect();
+        assert_eq!(
+            expected,
+            actual,
+            "STATIC_CONFIG_KEYS must be the union of all alias arrays + Vertex vars. \
+             Missing: {:?}, Extra: {:?}",
+            expected.difference(&actual).collect::<Vec<_>>(),
+            actual.difference(&expected).collect::<Vec<_>>(),
+        );
+    }
+}

crates/openshell-core/src/inference.rs

@@ -102,12 +102,6 @@ pub const VERTEX_AI_CREDENTIAL_KEY_NAMES: &[&str] = &[
     "VERTEX_AI_TOKEN",
 ];
 
-/// The credential key used for tokens minted from gcloud Application Default Credentials.
-///
-/// This is the key written by the gateway's `OAuth2` refresh worker when using the
-/// `--from-gcloud-adc` CLI flow. It must match `VERTEX_AI_CREDENTIAL_KEY_NAMES[2]`.
-pub const VERTEX_AI_ADC_TOKEN_KEY: &str = "GOOGLE_VERTEX_AI_TOKEN";
-
 /// GCP project ID config key for Vertex AI providers.
 pub const VERTEX_AI_PROJECT_ID_KEY: &str = "VERTEX_AI_PROJECT_ID";
 

crates/openshell-core/src/lib.rs

@@ -17,6 +17,7 @@ pub mod driver_mounts;
 pub mod driver_utils;
 pub mod error;
 pub mod forward;
+pub mod google_cloud;
 pub mod gpu;
 pub mod grpc_client;
 pub mod image;