-
Notifications
You must be signed in to change notification settings - Fork 327
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(kms): to honor kms credentials when present. #1272
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think it's fine to have a package-private getCredentialsProvider
and test that under different autoconfig scenarios -- GcpFirestoreAutoConfiguration
does this.. It can also be annotated with @VisibleForTesting
, although I have mixed feelings about the annotation generally.
… to test for core vs kms project-id and credentials.
Turns out KmsAutoConfiguration is also not taking core project id when missing kms specific project id as stated in documentation. |
TestConfiguration.class, GcpKmsAutoConfiguration.class).properties( | ||
"spring.cloud.gcp.kms.project-id=" + KMS_PROJECT_NAME, "spring.cloud.bootstrap.enabled=true", | ||
"spring.cloud.gcp.sql.enabled=false").web(WebApplicationType.NONE); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
original formatting with property per line was probably easier to read.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ah! thanks for catching this. My formatter messed up in a few places, reverting this.
"auth_uri": "https://accounts.google.com/o/oauth2/auth", | ||
"token_uri": "https://oauth2.googleapis.com/token", | ||
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs", | ||
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/one-time-test-account%40mzhu-test3.iam.gserviceaccount.com" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
can this be more fake? Very impressive fake key, btw.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Actually borrowed the idea from this fake-project-key.json. And you are right, I missed the last few lines, they can be fake too.
Kudos, SonarCloud Quality Gate passed! |
…#1272) fixes GoogleCloudPlatform#1271. Fix so `KmsAutoConfiguration` takes kms specific project id & credentials when present, otherwise fall back to core project id & credentials. Documentation is accurate, no change. Added tests for all 4 scenarios.
fixes #1271.
I find it hard to increase test coverage without exposing more getter methods from
KmsTemplate.class
orGcpKmsAutoConfiguration.class
. Any thoughts?