Authenticate with remote GRPC via JWT

[RossCampbellDev]

We currently run bazel build and point it at a buildbarn storage backend (which is our remote cache), using TLS to authenticate with the remote service. We would like to move to using tokens for this (likely JWT, as this is what the buildbarn config supports) instead of TLS

is this possible? i made some attempts using bazel build --remote_header=... but not really sure if that's the right option, or how to use it to pass a token through

[moroten]

Please use the --credential_helper flag. That allows an external script to generate whatever headers you would like to pass to Buildbarn and other remote service, for example where you download your http_archives from.

More information is available at

• https://github.com/bazelbuild/proposals/blob/main/designs/2022-06-07-bazel-credential-helpers.md
• https://blog.engflow.com/2023/10/09/configuring-bazels-credential-helper/
• https://github.com/tweag/credential-helper