From 74f47ac3316bb2eb21e12b7893106aabd2f0b2db Mon Sep 17 00:00:00 2001
From: chrischristiansen-glitch <chris.christiansen@vauco.no>
Date: Wed, 10 Jun 2026 09:32:10 +0200
Subject: [PATCH] =?UTF-8?q?fix(CI):=20smoke-test=20bruker=20gcloud=20run?=
 =?UTF-8?q?=20services=20proxy=20for=20=C3=A5=20omg=C3=A5=20identity=20tok?=
 =?UTF-8?q?en-problem?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 cloudbuild.yaml | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/cloudbuild.yaml b/cloudbuild.yaml
index 0e49945..651b08d 100644
--- a/cloudbuild.yaml
+++ b/cloudbuild.yaml
@@ -58,7 +58,7 @@ steps:
       - '--quiet'
 
   # Steg 5: Smoke test — verifiser at agenten svarer etter deploy
-  # Bruker access token fra metadata-server (fungerer i Cloud Build 2nd gen)
+  # Bruker gcloud auth print-identity-token med impersonation (løser 2nd gen token-problem)
   - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
     id: smoke-test
     waitFor: ['deploy']
@@ -67,11 +67,10 @@ steps:
       - '-c'
       - |
         echo "=== Smoke Test ==="
-        TOKEN=$$(curl -sf \
-          -H "Metadata-Flavor: Google" \
-          "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token" \
-          | python3 -c "import sys,json; print(json.load(sys.stdin)['access_token'])") \
-          || { echo "❌ Kunne ikke hente access token"; exit 1; }
+        TOKEN=$$(gcloud auth print-identity-token \
+          --impersonate-service-account=${_AGENT_SA} \
+          --audiences="https://${_CLOUD_RUN_URL}") \
+          || { echo "❌ Kunne ikke hente identity token"; exit 1; }
 
         RESPONSE=$$(curl -sf \
           -H "Authorization: Bearer $$TOKEN" \