zydronium/google-nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus.git synced 2025-05-30 01:10:14 +02:00
Code Issues Projects Releases Packages Wiki Activity

Validate SQL credentials in Secret Manager (#907)

Browse source 
* Validate SQL credentials in Secret Manager

Load SQL credentials from the SecretManager and compare them with the
ones currently in use in Nomulus server, beam pipeline, and the registry
tool. Normal operations are not affected by failures related to the
SecretManager, be it IOException, insufficient permission , or wrong or
missing credential.

The appengine and compute engine default service accounts must be
granted the permission to access the secret data. In the short term, we
will grant the secretmanager.secretAccessor role to these accounts. In
the long term, with the proposed privilege service, access will be granted
on per-secret basis.
This commit is contained in:
Weimin Yu 2020-12-16 10:57:03 -05:00 • committed by GitHub
parent d7aab524e5
commit 495d7176d8
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
7 changed files with 94 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

10
java_common.gradle
View file

@ -74,10 +74,12 @@ test {
useJUnitPlatform()
}
// Sets up integration test with a registry environment. The target environment is
// passed by the 'test.gcp_integration.env' property. Test runner must have been
// authorized to access the corresponding GCP project, e.g., by running 'gcloud auth'
// or placing a credential file at a well known place.
// Sets up integration test with a registry environment. The target environment
// is passed by the 'test.gcp_integration.env' property. Test runner must have
// been authorized to access the corresponding GCP project, e.g., by running
// 'gcloud auth application-default login' or by downloading a credential file
// and assign the path to it to the GOOGLE_APPLICATION_CREDENTIALS environment
// variable.
//
// A typical use case is to run tests from desktop that accesses Cloud resources. See
// core/src/test/java/google/registry/beam/initsql/BeamJpaModuleTest.java for an example.