Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

R2DBC: Allow external credentials to be provided to Cloud SQL #775

Merged
merged 12 commits into from
Feb 9, 2022

Conversation

mpeddada1
Copy link
Contributor

@mpeddada1 mpeddada1 commented Dec 8, 2021

For #205
Follow-up to #772

This PR sets the credentials system properties for credentials provided through spring.cloud.gcp.credentials and spring.cloud.gcp.sql.credentials. It moves all the credentials related logic from CloudSqlEnvironmentPostProcessor into a helper class that can be shared between the EnvironmentPostProcessors for JDBC and R2DBC support.

@sonarqubecloud
Copy link

sonarqubecloud bot commented Dec 8, 2021

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 2 Code Smells

95.3% 95.3% Coverage
0.0% 0.0% Duplication

@mpeddada1 mpeddada1 changed the title Autoconfiguration for R2DBC: Allow external credentials to be provided to Cloud SQL R2DBC: Allow external credentials to be provided to Cloud SQL Jan 24, 2022
@mpeddada1 mpeddada1 marked this pull request as ready for review January 24, 2022 23:51
Copy link
Contributor

@elefeint elefeint left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if it makes sense to file an issue in socket factory to accept credentials in a less environment-dependent way. Or do you think they had technical constraints that led to the environment property being the only way to inject the key?

System.setProperty(CredentialFactory.CREDENTIAL_FACTORY_PROPERTY,
SqlCredentialFactory.class.getName());
} catch (IOException ioe) {
logger.info("Error reading Cloud SQL credentials file.", ioe);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this failure should propagate back to the user. If the user provided custom credentials and they did not work, the application is not really expected to work. Unless falling back to default credentials is acceptable (it might be in some cases? but it's hard to assume).

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Modified this throw an IllegalArgumentException if a user provides an invalid credentials file.

@@ -86,7 +80,7 @@ public void postProcessEnvironment(
.getPropertySources()
.addFirst(new MapPropertySource("CLOUD_SQL_DATA_SOURCE_URL", primaryMap));

setCredentials(sqlProperties, propertiesRetriever.getGcpProperties());
CredentialsPropertiesSetter.setCredentials(sqlProperties, propertiesRetriever.getGcpProperties(), LOGGER);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No need to pass the logger; define a static logger in the CredentialsPropertiesSetter if it's needed. Per-class loggers are useful because end users can control logging verbosity per package/class if needed.

@mpeddada1
Copy link
Contributor Author

I wonder if it makes sense to file an issue in socket factory to accept credentials in a less environment-dependent way. Or do you think they had technical constraints that led to the environment property being the only way to inject the key?

That is a good point. I think this idea was initially considered but was later dropped in favor of environment variables because the Postgres driver didn't allow arbitrary properties to be passed to the socket factory through the JDBC url. GoogleCloudPlatform/cloud-sql-jdbc-socket-factory#41. This discussion happened a while ago so the status may have changed.

Copy link
Contributor

@elefeint elefeint left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Only minor things left!

@mpeddada1 mpeddada1 requested a review from elefeint February 4, 2022 00:41
@sonarqubecloud
Copy link

sonarqubecloud bot commented Feb 8, 2022

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

94.4% 94.4% Coverage
0.0% 0.0% Duplication

@mpeddada1 mpeddada1 merged commit 72e6814 into main Feb 9, 2022
@mpeddada1 mpeddada1 deleted the credentials-r2dbc branch February 9, 2022 15:48
kateryna216 added a commit to kateryna216/spring-cloud-gcp that referenced this pull request Oct 20, 2022
…CloudPlatform#775)

R2DBC support for Cloud SQL: Set credentials system properties for credentials provided through spring.cloud.gcp.credentials and spring.cloud.gcp.sql.credentials.
* Refactor credentials code into helper class that will be shared between the EnvironmentPostProcessors of JDBC and R2DBC.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants