log in using GOOGLE_*_CREDENTIALS if present for CloudSQL import #1136
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Stephen Compall <stephen.compall@digitalasset.com>
stephencompall-DA
force-pushed
the
s11/explicit-login-for-gcp-pub-rep-slots-script
branch
from
1c00f2c to
f84b283
Compare
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR enhances the CloudSQL import process by leveraging GOOGLE_*_CREDENTIALS for authentication and adds additional logging for better traceability of service account usage.
- Introduces logic to use GOOGLE_APPLICATION_CREDENTIALS or GOOGLE_CREDENTIALS if present
- Adds logging for authentication steps and displays the current gcloud login
- Enhances logging around temporary bucket creation, SQL upload, CloudSQL import, and cleanup
| gcloud auth activate-service-account --key-file="$GOOGLE_APPLICATION_CREDENTIALS" | ||
| elif [ -n "$GOOGLE_CREDENTIALS" ]; then | ||
| echo "Using GOOGLE_CREDENTIALS for authentication" | ||
| echo "$GOOGLE_CREDENTIALS" | gcloud auth activate-service-account --key-file=- |
There was a problem hiding this comment.
Using echo to pipe GOOGLE_CREDENTIALS may risk exposing sensitive information to stdout or logs. Consider securely passing the credentials (e.g., through a temporary file with appropriate permissions) to reduce potential security exposure.
Suggested change
| echo "$GOOGLE_CREDENTIALS" | gcloud auth activate-service-account --key-file=- | |
| TEMP_CREDENTIALS_FILE="$(mktemp)" | |
| echo "$GOOGLE_CREDENTIALS" > "$TEMP_CREDENTIALS_FILE" | |
| chmod 600 "$TEMP_CREDENTIALS_FILE" | |
| gcloud auth activate-service-account --key-file="$TEMP_CREDENTIALS_FILE" | |
| rm -f "$TEMP_CREDENTIALS_FILE" |
Merged
8 tasks
stephencompall-DA
deleted the
s11/explicit-login-for-gcp-pub-rep-slots-script
branch
stephencompall-DA
added a commit
that referenced
this pull request
Jun 16, 2025
Backport of #1136 Signed-off-by: Stephen Compall <stephen.compall@digitalasset.com>
stephencompall-DA
added a commit
that referenced
this pull request
Jun 17, 2025
Signed-off-by: Stephen Compall <stephen.compall@digitalasset.com>
stephencompall-DA
added a commit
that referenced
this pull request
Jun 18, 2025
* split off script * support create/delete, invoke script from pulumi * incorporate #1136 gcloud login/logging changes * set -u and better quoting --------- Signed-off-by: Stephen Compall <stephen.compall@digitalasset.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Also adds more logging so we can be sure what service account we're dealing with.
From an idea by @isegall-da as to how to avoid getting stuck with the default infra node pool SA and its scopes problems for
-pub-replicate-slotson devnet/generally via pulumi operator.Pull Request Checklist
Cluster Testing
/cluster_teston this PR to request it, and ping someone with access to the DA-internal system to approve it./hdm_teston this PR to request it, and ping someone with access to the DA-internal system to approve it.PR Guidelines
Fixes #n, and mention issues worked on using#nMerge Guidelines