fix(storage): add env var to allow disabling bound token (#13236)

rockspore · web-flow · commit cdaf6a6da006 · 2025-10-30T14:00:33.000-04:00
Inspired by #13153. The token issuing side is still behind so hopefully it's not too late to add this knob out of extra caution. Users will be able to use it to turn off this flow if anything goes wrong. @tritone Sorry for not doing this sooner. Would you mind taking a look?
diff --git a/storage/grpc_client.go b/storage/grpc_client.go
@@ -23,6 +23,7 @@ import (
 	"io"
 	"log"
 	"os"
+	"strconv"
 	"sync"
 
 	"cloud.google.com/go/iam/apiv1/iampb"
@@ -101,8 +102,10 @@ func defaultGRPCOptions() []option.ClientOption {
 		defaults = append(defaults,
 			internaloption.AllowNonDefaultServiceAccount(true),
 			internaloption.EnableDirectPath(true),
-			internaloption.EnableDirectPathXds(),
-			internaloption.AllowHardBoundTokens("ALTS"))
+			internaloption.EnableDirectPathXds())
+		if disableBoundToken, _ := strconv.ParseBool(os.Getenv("STORAGE_DISABLE_DIRECTPATH_BOUND_TOKEN")); !disableBoundToken {
+			defaults = append(defaults, internaloption.AllowHardBoundTokens("ALTS"))
+		}
 	}
 
 	return defaults
