Does BAML support Workload Identity Federation for Vertex?

[richard-oscaridp]

As title, does the BAML vertex-ai provider support a credential configuration file in the "credentials" option for Workload Identity Federation? This is a much nicer way to authenticate from a client as there are no keys to manage/keep secure.

The Vertex Python libraries support this via the GOOGLE_APPLICATION_CREDENTIALS env variable, same as you would use for a service account key, however BAML returns an error when I point to the JSON via the "credentials" option.

---ERROR (Unspecified error code: 2)---
    Failed to create request builder: Error {
        context: "Failed to build request",
        source: Error {
            context: "Failed to parse credentials as JSON file: \"clientLibraryConfig-aws-provider.json\"",
            source: Json(
                "failed to deserialize ApplicationCredentials",
                Error("missing field `private_key`", line: 13, column: 1),
            ),
        },
    }

[hellovai]

This is quite interesting. we do support gcloud auth but i don't think we support that yet. This should be i think easy to add in. @sxlijin or @aaronvg may be able to kick off a background agent here.

[sxlijin]

This is beyond the scope of a background agent but should be very doable now that GCP has shipped Rust libraries!

Moving into #2560