mirrors/nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus synced 2026-08-20 14:16:19 +00:00
Code Issues Releases Wiki Activity

Simplify SQL credential store (#2955)

Browse Source 
The current SQL credential store was designed to support automatic
password rotation without any disruption to the applications. For that
goal, the credentials are stored with one level of indirection, and the
secret name of the actual credential data may change automatically.

The automatic password rotation feature has been dropped. In the
meantime, the need arises that we use sidecar SQL proxy to get around
the Enterprise Plus edition's post-maintenance reconnection failures
by the socket factory library. This is hampered by the indirection in
storage.

This PR removes the indirection. This change is transparent to the rest
of the code base. We will manually populate the secret manager with the
new secrets in all environments after submissiion of this PR.
This commit is contained in:
Weimin Yu
2026-02-12 20:01:08 +00:00
committed by GitHub
parent a787660b27
commit 140b19e919
2 changed files with 20 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/src/test/java/google/registry/privileges/secretmanager/SqlCredentialStoreTest.java
+11 -19
View File
@@ -16,7 +16,6 @@ package google.registry.privileges.secretmanager;
import static com.google.common.truth.Truth.assertThat;
import com.google.cloud.secretmanager.v1.SecretVersionName;
import google.registry.privileges.secretmanager.SqlUser.RobotId;
import google.registry.privileges.secretmanager.SqlUser.RobotUser;
import java.util.Optional;
@@ -32,17 +31,20 @@ public class SqlCredentialStoreTest {
@Test
void createSecret() {
credentialStore.createOrUpdateCredential(user, "password");
assertThat(client.secretExists("sql-cred-live-label-nomulus-db")).isTrue();
assertThat(
SecretVersionName.parse(
client.getSecretData("sql-cred-live-label-nomulus-db", Optional.empty()))
.getSecret())
.isEqualTo("sql-cred-data-nomulus-db");
assertThat(client.secretExists("sql-cred-data-nomulus-db")).isTrue();
assertThat(client.getSecretData("sql-cred-data-nomulus-db", Optional.empty()))
assertThat(client.secretExists("sql-password-for-nomulus-on-db")).isTrue();
assertThat(client.getSecretData("sql-password-for-nomulus-on-db", Optional.empty()))
.isEqualTo("nomulus password");
}
@Test
void updateSecret() {
credentialStore.createOrUpdateCredential(user, "password");
credentialStore.createOrUpdateCredential(user, "new-password");
assertThat(client.secretExists("sql-password-for-nomulus-on-db")).isTrue();
assertThat(client.getSecretData("sql-password-for-nomulus-on-db", Optional.empty()))
.isEqualTo("nomulus new-password");
}
@Test
void getCredential() {
credentialStore.createOrUpdateCredential(user, "password");
@@ -50,14 +52,4 @@ public class SqlCredentialStoreTest {
assertThat(credential.login()).isEqualTo("nomulus");
assertThat(credential.password()).isEqualTo("password");
}
@Test
void deleteCredential() {
credentialStore.createOrUpdateCredential(user, "password");
assertThat(client.secretExists("sql-cred-live-label-nomulus-db")).isTrue();
assertThat(client.secretExists("sql-cred-data-nomulus-db")).isTrue();
credentialStore.deleteCredential(user);
assertThat(client.secretExists("sql-cred-live-label-nomulus-db")).isFalse();
assertThat(client.secretExists("sql-cred-data-nomulus-db")).isFalse();
}
}