Skip to content

Commit 192c071

Browse files
moabucoderabbitai[bot]
moabu
and
coderabbitai[bot]
authored
feat(jans-pycloudlib): add support for connecting to cloudsql via cloud auth proxy (#12788)
* feat: add support for connecting to cloudsql via cloud auth proxy Signed-off-by: moabu <47318409+moabu@users.noreply.github.com> * fix: added context manager support Signed-off-by: moabu <47318409+moabu@users.noreply.github.com> * fix: refactor for cleanup Signed-off-by: moabu <47318409+moabu@users.noreply.github.com> * fix: the getconn closure to fetch the password fresh on each connection, supporting runtime password rotation Signed-off-by: moabu <47318409+moabu@users.noreply.github.com> * chore: update dockerfile jans source version Signed-off-by: moabu <47318409+moabu@users.noreply.github.com> * chore: install cloud sql python Signed-off-by: moabu <47318409+moabu@users.noreply.github.com> * docs: fix get manager example Signed-off-by: moabu <47318409+moabu@users.noreply.github.com> * chore: update jans source version Signed-off-by: moabu <47318409+moabu@users.noreply.github.com> * style: cosmetic touch Signed-off-by: moabu <47318409+moabu@users.noreply.github.com> * fix: add defensive check for cloudsql driver Signed-off-by: moabu <47318409+moabu@users.noreply.github.com> * fix: improve error logging when closing database connections Signed-off-by: moabu <47318409+moabu@users.noreply.github.com> * fix(docker-jans-auth-server): implemented Cloud SQL JDBC Socket Factory support for Java services Signed-off-by: moabu <47318409+moabu@users.noreply.github.com> * fix(docker): implemented Cloud SQL JDBC Socket Factory support for Java services Signed-off-by: moabu <47318409+moabu@users.noreply.github.com> * chore(docker): update source version Signed-off-by: moabu <47318409+moabu@users.noreply.github.com> * fix(docker): build with jar deps Signed-off-by: moabu <47318409+moabu@users.noreply.github.com> * chore(docker): update jans source version Signed-off-by: moabu <47318409+moabu@users.noreply.github.com> * chore(docker): fix maven build Signed-off-by: moabu <47318409+moabu@users.noreply.github.com> * ci: add clean up Signed-off-by: moabu <47318409+moabu@users.noreply.github.com> * ci: add clean up Signed-off-by: moabu <47318409+moabu@users.noreply.github.com> * ci: clean up cloud sql jar build Signed-off-by: moabu <47318409+moabu@users.noreply.github.com> * ci: apply suggestions from code review Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Signed-off-by: Mohammad Abudayyeh <47318409+moabu@users.noreply.github.com> * ci: add timeouts Signed-off-by: moabu <47318409+moabu@users.noreply.github.com> --------- Signed-off-by: moabu <47318409+moabu@users.noreply.github.com> Signed-off-by: Mohammad Abudayyeh <47318409+moabu@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
1 parent 470badd commit 192c071

File tree

36 files changed

+1190
-72
lines changed

36 files changed

+1190
-72
lines changed

‎.github/workflows/build-cloudsql-socket-factory.yml‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
name: Build and Publish Cloud SQL Socket Factory
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- "automation/cloudsql-socket-factory/**"
9+
pull_request:
10+
branches:
11+
- main
12+
paths:
13+
- "automation/cloudsql-socket-factory/**"
14+
workflow_dispatch:
15+
inputs:
16+
version:
17+
description: 'Cloud SQL Socket Factory version to build (e.g., 1.27.0)'
18+
required: false
19+
default: ''
20+
schedule:
21+
- cron: "0 0 * * 0"
22+
23+
permissions:
24+
contents: read
25+
packages: write
26+
id-token: write
27+
28+
env:
29+
REGISTRY: ghcr.io
30+
IMAGE_NAME: ${{ github.repository }}/cloudsql-socket-factory
31+
32+
jobs:
33+
build:
34+
runs-on: ubuntu-latest
35+
timeout-minutes: 60
36+
outputs:
37+
digest: ${{ steps.build.outputs.digest }}
38+
version: ${{ steps.version.outputs.version }}
39+
steps:
40+
- name: Harden Runner
41+
uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
42+
with:
43+
egress-policy: audit
44+
45+
- name: Install Cosign
46+
uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
47+
48+
- name: Checkout
49+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
50+
51+
- name: Get version
52+
id: version
53+
run: |
54+
if [ -n "${{ github.event.inputs.version }}" ]; then
55+
VERSION="${{ github.event.inputs.version }}"
56+
else
57+
VERSION=$(cat automation/cloudsql-socket-factory/version.txt | tr -d '\n')
58+
fi
59+
if [ -z "$VERSION" ]; then
60+
echo "::error::Failed to determine version"
61+
exit 1
62+
fi
63+
echo "version=${VERSION}" >> $GITHUB_OUTPUT
64+
echo "Building Cloud SQL Socket Factory version: ${VERSION}"
65+
66+
- name: Set up QEMU
67+
uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
68+
with:
69+
image: tonistiigi/binfmt:qemu-v8.1.5
70+
platforms: all
71+
72+
- name: Set up Docker Buildx
73+
id: buildx
74+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
75+
76+
- name: Login to GHCR
77+
if: github.event_name != 'pull_request'
78+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
79+
with:
80+
registry: ${{ env.REGISTRY }}
81+
username: ${{ github.repository_owner }}
82+
password: ${{ secrets.GITHUB_TOKEN }}
83+
84+
- name: Extract metadata
85+
id: meta
86+
uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
87+
with:
88+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
89+
tags: |
90+
type=raw,value=${{ steps.version.outputs.version }}
91+
type=raw,value=latest
92+
93+
- name: Build and push
94+
id: build
95+
uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
96+
with:
97+
builder: ${{ steps.buildx.outputs.name }}
98+
context: automation/cloudsql-socket-factory
99+
file: automation/cloudsql-socket-factory/Dockerfile
100+
build-args: |
101+
CLOUDSQL_SOCKET_FACTORY_VERSION=${{ steps.version.outputs.version }}
102+
platforms: linux/amd64,linux/arm64
103+
push: ${{ github.event_name != 'pull_request' }}
104+
tags: ${{ steps.meta.outputs.tags }}
105+
labels: ${{ steps.meta.outputs.labels }}
106+
sbom: true
107+
provenance: true
108+
cache-from: type=gha,scope=cloudsql-socket-factory
109+
cache-to: type=gha,mode=max,scope=cloudsql-socket-factory
110+
111+
- name: Sign the image with GitHub OIDC Token
112+
if: github.event_name != 'pull_request'
113+
env:
114+
DIGEST: ${{ steps.build.outputs.digest }}
115+
TAGS: ${{ steps.meta.outputs.tags }}
116+
run: |
117+
images=""
118+
for tag in ${TAGS}; do
119+
images+="${tag}@${DIGEST} "
120+
done
121+
if [[ -n $images ]]; then
122+
cosign sign --yes -a author=JanssenProject ${images}
123+
fi
124+
125+
- name: Image digest
126+
run: echo ${{ steps.build.outputs.digest }}

‎.github/workflows/build-docker-image.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ jobs:
4646
packages: write
4747
id-token: write
4848
runs-on: ubuntu-latest
49+
timeout-minutes: 60
4950
strategy:
5051
max-parallel: 8
5152
matrix:
@@ -188,6 +189,26 @@ jobs:
188189
sudo python3 ./automation/auto_update_build_date.py
189190
#END UPDATE BUILD DATES INSIDE THE DOCKERFILE BEFORE BUILDING THE DEV IMAGES TRIGGERED BY JENKINS
190191

192+
- name: Free disk space
193+
if: steps.build_docker_image.outputs.build && steps.prep.outputs.build
194+
run: |
195+
echo "=== Disk space before cleanup ==="
196+
df -h
197+
echo "=== Removing pre-installed tools ==="
198+
sudo rm -rf /usr/share/dotnet || true
199+
sudo rm -rf /opt/ghc || true
200+
sudo rm -rf /usr/local/lib/android || true
201+
sudo rm -rf /opt/hostedtoolcache/CodeQL || true
202+
sudo rm -rf /usr/local/share/boost || true
203+
sudo rm -rf /usr/share/swift || true
204+
echo "=== Cleaning Docker ==="
205+
docker system prune -af --volumes || true
206+
echo "=== Cleaning apt cache ==="
207+
sudo apt-get clean || true
208+
sudo rm -rf /var/lib/apt/lists/* || true
209+
echo "=== Disk space after cleanup ==="
210+
df -h
211+
191212
- name: Set up QEMU
192213
if: steps.build_docker_image.outputs.build && steps.prep.outputs.build
193214
uses: docker/setup-qemu-action@737ba1e397ec2caff0d098f75e1136f9a926dc0a # master
@@ -229,6 +250,13 @@ jobs:
229250
platforms: linux/amd64, linux/arm64
230251
push: ${{ github.event_name != 'pull_request' }}
231252
tags: ${{ steps.prep.outputs.tags }}
253+
cache-from: type=gha,scope=${{ matrix.docker-images }}
254+
cache-to: type=gha,mode=max,scope=${{ matrix.docker-images }}
255+
256+
- name: Prune BuildKit cache
257+
if: always()
258+
run: docker buildx prune -af --keep-storage 2GB || true
259+
232260
- name: Image digest
233261
if: steps.build_docker_image.outputs.build && steps.prep.outputs.build
234262
run: echo ${{ steps.docker_build.outputs.digest }}

‎automation/cloudsql-socket-factory/Dockerfile‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
FROM maven:3.9-eclipse-temurin-17 AS builder
2+
3+
ARG CLOUDSQL_SOCKET_FACTORY_VERSION=1.27.0
4+
5+
RUN apt-get update && apt-get install -y --no-install-recommends git \
6+
&& rm -rf /var/lib/apt/lists/* \
7+
&& git clone --depth 1 --branch v${CLOUDSQL_SOCKET_FACTORY_VERSION} \
8+
https://github.com/GoogleCloudPlatform/cloud-sql-jdbc-socket-factory.git /build
9+
10+
WORKDIR /build
11+
12+
RUN mvn -P jar-with-dependencies clean package -DskipTests -q \
13+
&& mkdir -p /cloudsql \
14+
&& cp jdbc/mysql-j-8/target/mysql-socket-factory-connector-j-8-*-jar-with-dependencies.jar /cloudsql/ \
15+
&& cp jdbc/postgres/target/postgres-socket-factory-*-jar-with-dependencies.jar /cloudsql/
16+
17+
FROM scratch
18+
19+
LABEL org.opencontainers.image.title="Cloud SQL JDBC Socket Factory" \
20+
org.opencontainers.image.description="Pre-built Cloud SQL JDBC Socket Factory fat JARs for MySQL and PostgreSQL" \
21+
org.opencontainers.image.source="https://github.com/JanssenProject/jans" \
22+
org.opencontainers.image.vendor="Janssen Project"
23+
24+
COPY --from=builder /cloudsql/ /cloudsql/

‎automation/cloudsql-socket-factory/version.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
1.27.0

‎docker-jans-all-in-one/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ RUN apk update \
5959
# Assets sync
6060
# ===========
6161

62-
ENV JANS_SOURCE_VERSION=4cf1bf2085bbdeab678e51ab3aff34d4c48be96b
62+
ENV JANS_SOURCE_VERSION=9489a963cde645364b18127548244925f6c7fb43
6363

6464
# note that as we're pulling from a monorepo (with multiple project in it)
6565
# we are using partial-clone and sparse-checkout to get the assets

‎docker-jans-auth-server/Dockerfile‎

Lines changed: 31 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
# =================================
2+
# Cloud SQL JDBC Socket Factory
3+
# =================================
4+
# Pre-built fat JARs from GHCR for Cloud SQL connectivity
5+
FROM ghcr.io/janssenproject/jans/cloudsql-socket-factory:1.27.0 AS cloudsql-libs
6+
7+
# =================================
8+
# Main Image
9+
# =================================
110
FROM bellsoft/liberica-openjdk-alpine:17.0.17@sha256:0e8ae43555ad8e2d69431c2078df256c01b625a8a3010e76b5a6baff0d165d2c
211

312
# ===============
@@ -65,16 +74,31 @@ RUN mkdir -p ${JETTY_BASE}/jans-auth/webapps \
6574
# ===========
6675

6776
RUN mkdir -p /usr/share/java \
68-
${JETTY_BASE}/jans-auth/_libs
77+
${JETTY_BASE}/jans-auth/_libs \
78+
${JETTY_BASE}/jans-auth/custom/libs
6979

7080
ARG TWILIO_VERSION=7.17.0
7181
ARG JSMPP_VERSION=2.3.7
7282

73-
RUN wget -q https://repo1.maven.org/maven2/com/twilio/sdk/twilio/${TWILIO_VERSION}/twilio-${TWILIO_VERSION}.jar -P ${JETTY_BASE}/jans-auth/_libs/ \
74-
&& wget -q https://repo1.maven.org/maven2/org/jsmpp/jsmpp/${JSMPP_VERSION}/jsmpp-${JSMPP_VERSION}.jar -P ${JETTY_BASE}/jans-auth/_libs/ \
75-
&& for custom_lib in casa-config jans-fido2-client jans-fido2-model agama-inbound jans-lock-service jans-lock-model jans-lock-cedarling cedarling-java; \
83+
# Copy Cloud SQL Socket Factory fat JARs from builder (includes all dependencies)
84+
COPY --from=cloudsql-libs /cloudsql/*.jar ${JETTY_BASE}/jans-auth/custom/libs/
85+
86+
# Download other custom libs directly to custom/libs (always available)
87+
# Using set -e to ensure any failed wget aborts the build
88+
RUN set -e \
89+
&& wget -q https://repo1.maven.org/maven2/com/twilio/sdk/twilio/${TWILIO_VERSION}/twilio-${TWILIO_VERSION}.jar -P ${JETTY_BASE}/jans-auth/custom/libs/ \
90+
&& wget -q https://repo1.maven.org/maven2/org/jsmpp/jsmpp/${JSMPP_VERSION}/jsmpp-${JSMPP_VERSION}.jar -P ${JETTY_BASE}/jans-auth/custom/libs/ \
91+
&& for custom_lib in casa-config jans-fido2-client jans-fido2-model agama-inbound cedarling-java; \
92+
do \
93+
wget -nv "https://jenkins.jans.io/maven/io/jans/${custom_lib}/${CN_VERSION}/${custom_lib}-${CN_VERSION}.jar" -P "${JETTY_BASE}/jans-auth/custom/libs" || exit 1; \
94+
done
95+
96+
# Download jans-lock JARs to _libs (conditionally copied via Python script when lock is enabled)
97+
# Using set -e to ensure any failed wget aborts the build
98+
RUN set -e \
99+
&& for lock_lib in jans-lock-service jans-lock-model jans-lock-cedarling; \
76100
do \
77-
wget -nv "https://jenkins.jans.io/maven/io/jans/${custom_lib}/${CN_VERSION}/${custom_lib}-${CN_VERSION}.jar" -P "${JETTY_BASE}/jans-auth/_libs"; \
101+
wget -nv "https://jenkins.jans.io/maven/io/jans/${lock_lib}/${CN_VERSION}/${lock_lib}-${CN_VERSION}.jar" -P "${JETTY_BASE}/jans-auth/_libs" || exit 1; \
78102
done
79103

80104
# ===========
@@ -287,6 +311,8 @@ RUN chmod -R g=u ${JETTY_BASE}/jans-auth/custom \
287311
&& chown -R 1000:0 ${JETTY_BASE}/jans-auth/resources \
288312
&& chown -R 1000:0 /opt/jans/python/libs \
289313
&& chown -R 1000:0 ${JETTY_BASE}/common/libs \
314+
&& chown -R 1000:0 ${JETTY_BASE}/jans-auth/custom/libs \
315+
&& chmod -R g=u ${JETTY_BASE}/jans-auth/custom/libs \
290316
&& chown -R 1000:0 /usr/share/java \
291317
&& chown -R 1000:0 /opt/prometheus \
292318
&& chown 1000:0 ${JETTY_BASE}/jans-auth/webapps/jans-auth.xml \

‎docker-jans-auth-server/scripts/bootstrap.py‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -176,11 +176,19 @@ def configure_logging():
176176
def copy_builtin_libs():
177177
lock_enabled = as_boolean(os.environ.get("CN_LOCK_ENABLED", "false"))
178178

179-
for src in Path("/opt/jans/jetty/jans-auth/_libs").glob("*.jar"):
180-
# skip jans-lock-service and jans-lock-model
181-
if lock_enabled is False and src.name.startswith("jans-lock"):
182-
continue
179+
if not lock_enabled:
180+
return
181+
182+
libs_path = Path("/opt/jans/jetty/jans-auth/_libs")
183+
lock_jars = list(libs_path.glob("jans-lock*.jar"))
184+
185+
if not lock_jars:
186+
logger.warning(
187+
f"CN_LOCK_ENABLED is true but no jans-lock*.jar files were found in {libs_path}"
188+
)
189+
return
183190

191+
for src in lock_jars:
184192
dst = f"/opt/jans/jetty/jans-auth/custom/libs/{src.name}"
185193
shutil.copyfile(src, dst)
186194

‎docker-jans-auth-server/templates/jans-mysql.properties‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
db.schema.name=%(rdbm_schema)s
22

3-
connection.uri=jdbc:mysql://%(rdbm_host)s:%(rdbm_port)s/%(rdbm_db)s?enabledTLSProtocols=TLSv1.2
3+
connection.uri=%(rdbm_connection_uri)s
44

55
connection.driver-property.serverTimezone=%(server_time_zone)s
66
# Prefix connection.driver-property.key=value will be coverterd to key=value JDBC driver properties

‎docker-jans-auth-server/templates/jans-pgsql.properties‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
db.schema.name=%(rdbm_schema)s
22

3-
connection.uri=jdbc:postgresql://%(rdbm_host)s:%(rdbm_port)s/%(rdbm_db)s
3+
connection.uri=%(rdbm_connection_uri)s
44

55
# Prefix connection.driver-property.key=value will be coverterd to key=value JDBC driver properties
66
#connection.driver-property.driverProperty=driverPropertyValu

‎docker-jans-casa/Dockerfile‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
# =================================
2+
# Cloud SQL JDBC Socket Factory
3+
# =================================
4+
# Pre-built fat JARs from GHCR for Cloud SQL connectivity
5+
FROM ghcr.io/janssenproject/jans/cloudsql-socket-factory:1.27.0 AS cloudsql-libs
6+
7+
# =================================
8+
# Main Image
9+
# =================================
110
FROM bellsoft/liberica-openjre-alpine:17.0.17@sha256:3c9aff2ed178621764dedb95f56e8c881bdd092eec9033d0cad165907836ec22
211

312
# ===============
@@ -206,6 +215,14 @@ LABEL org.opencontainers.image.url="ghcr.io/janssenproject/jans/casa" \
206215
org.opencontainers.image.title="Janssen Casa" \
207216
org.opencontainers.image.description="Self-service portal for people to manage their account security preferences in the Janssen, like 2FA"
208217

218+
# ===========
219+
# Custom libs
220+
# ===========
221+
222+
# Copy Cloud SQL Socket Factory fat JARs from builder (includes all dependencies)
223+
RUN mkdir -p ${JETTY_BASE}/jans-casa/custom/libs
224+
COPY --from=cloudsql-libs /cloudsql/*.jar ${JETTY_BASE}/jans-casa/custom/libs/
225+
209226
RUN mkdir -p /opt/jans/python/libs \
210227
${JETTY_BASE}/jans-casa/static \
211228
${JETTY_BASE}/jans-casa/plugins \
@@ -238,6 +255,8 @@ RUN chmod -R g=u ${JETTY_BASE}/jans-casa/static \
238255
&& chmod -R g=u /etc/jans \
239256
&& chmod 664 /opt/java/lib/security/cacerts \
240257
&& chown -R 1000:0 ${JETTY_BASE}/common/libs \
258+
&& chown -R 1000:0 ${JETTY_BASE}/jans-casa/custom/libs \
259+
&& chmod -R g=u ${JETTY_BASE}/jans-casa/custom/libs \
241260
&& chown -R 1000:0 /usr/share/java \
242261
&& chown -R 1000:0 /opt/prometheus \
243262
&& chown 1000:0 ${JETTY_BASE}/jans-casa/webapps/jans-casa.xml \

0 commit comments

Comments
 (0)