feat: added regional secret support for secret-manager #3365
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,83 @@ | ||
| /* | ||
| * Copyright 2025 Google LLC | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * https://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package com.google.cloud.spring.autoconfigure.secretmanager; | ||
|
|
||
| import com.google.api.gax.core.CredentialsProvider; | ||
| import com.google.cloud.secretmanager.v1.SecretManagerServiceClient; | ||
| import com.google.cloud.secretmanager.v1.SecretManagerServiceSettings; | ||
| import com.google.cloud.spring.core.UserAgentHeaderProvider; | ||
| import com.google.cloud.spring.secretmanager.SecretManagerServiceClientFactory; | ||
| import java.io.IOException; | ||
| import java.util.Map; | ||
| import java.util.concurrent.ConcurrentHashMap; | ||
| import org.springframework.stereotype.Component; | ||
| import org.springframework.util.ObjectUtils; | ||
|
|
||
| /** | ||
| * A default implementation of the {@link SecretManagerServiceClientFactory} interface. | ||
| * | ||
| * <p>This factory provides a caching layer for {@link SecretManagerServiceClient} instances. | ||
| * Clients are created using the provided {@link CredentialsProvider} and a {@link | ||
| * UserAgentHeaderProvider} that adds the Spring Cloud GCP agent header to the client. | ||
| * | ||
| */ | ||
| @Component | ||
| public class DefaultSecretManagerServiceClientFactory implements SecretManagerServiceClientFactory { | ||
|
|
||
| private final CredentialsProvider credentialsProvider; | ||
| private final Map<String, SecretManagerServiceClient> clientCache = new ConcurrentHashMap<>(); | ||
|
|
||
| public DefaultSecretManagerServiceClientFactory(CredentialsProvider credentialsProvider) { | ||
| this.credentialsProvider = credentialsProvider; | ||
| } | ||
|
|
||
| @Override | ||
| public SecretManagerServiceClient getClient(String location) { | ||
| if (ObjectUtils.isEmpty(location)) { | ||
| return getClient(); | ||
| } | ||
| return clientCache.computeIfAbsent(location, loc -> { | ||
| try { | ||
| String endpoint = String.format("secretmanager.%s.rep.googleapis.com:443", loc); | ||
| SecretManagerServiceSettings settings = SecretManagerServiceSettings.newBuilder() | ||
| .setCredentialsProvider(credentialsProvider) | ||
| .setHeaderProvider(new UserAgentHeaderProvider(SecretManagerConfigDataLoader.class)) | ||
| .setEndpoint(endpoint).build(); | ||
| return SecretManagerServiceClient.create(settings); | ||
| } catch (IOException e) { | ||
| throw new RuntimeException( | ||
| "Failed to create SecretManagerServiceClient for location: " + loc, e); | ||
| } | ||
| }); | ||
| } | ||
|
|
||
| @Override | ||
| public SecretManagerServiceClient getClient() { | ||
| return clientCache.computeIfAbsent("", loc -> { | ||
|
There was a problem hiding this comment. Can you just re-use |
||
| try { | ||
| SecretManagerServiceSettings settings = SecretManagerServiceSettings.newBuilder() | ||
| .setCredentialsProvider(credentialsProvider) | ||
| .setHeaderProvider(new UserAgentHeaderProvider(SecretManagerConfigDataLoader.class) | ||
| ).build(); | ||
|
|
||
| return SecretManagerServiceClient.create(settings); | ||
| } catch (IOException e) { | ||
| throw new RuntimeException("Failed to create SecretManagerServiceClient", e); | ||
| } | ||
| }); | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -19,18 +19,17 @@ | |
| import static com.google.cloud.spring.secretmanager.SecretManagerSyntaxUtils.getMatchedPrefixes; | ||
| import static com.google.cloud.spring.secretmanager.SecretManagerSyntaxUtils.warnIfUsingDeprecatedSyntax; | ||
|
|
||
| import autovalue.shaded.com.google.common.annotations.VisibleForTesting; | ||
| import com.google.api.gax.core.CredentialsProvider; | ||
| import com.google.cloud.spring.core.DefaultCredentialsProvider; | ||
| import com.google.cloud.spring.core.DefaultGcpProjectIdProvider; | ||
| import com.google.cloud.spring.core.GcpProjectIdProvider; | ||
| import com.google.cloud.spring.secretmanager.SecretManagerServiceClientFactory; | ||
| import com.google.cloud.spring.secretmanager.SecretManagerTemplate; | ||
| import java.io.IOException; | ||
| import java.util.Collections; | ||
| import java.util.List; | ||
| import java.util.Optional; | ||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
| import org.springframework.beans.factory.config.ConfigurableListableBeanFactory; | ||
|
|
@@ -44,42 +43,42 @@ | |
| public class SecretManagerConfigDataLocationResolver implements | ||
| ConfigDataLocationResolver<SecretManagerConfigDataResource> { | ||
|
|
||
| private static final Logger logger = | ||
| LoggerFactory.getLogger(SecretManagerConfigDataLocationResolver.class); | ||
|
|
||
| /** | ||
| * A static client factory to avoid creating another client after refreshing. | ||
| */ | ||
| private static SecretManagerServiceClientFactory secretManagerServiceClientFactory; | ||
|
|
||
| @Override | ||
| public boolean isResolvable( | ||
| ConfigDataLocationResolverContext context, ConfigDataLocation location) { | ||
| Optional<String> matchedPrefix = getMatchedPrefixes(location::hasPrefix); | ||
| warnIfUsingDeprecatedSyntax(logger, matchedPrefix.orElse("")); | ||
| return matchedPrefix.isPresent(); | ||
| } | ||
|
|
||
| @Override | ||
| public List<SecretManagerConfigDataResource> resolve( | ||
| ConfigDataLocationResolverContext context, ConfigDataLocation location) | ||
| throws ConfigDataLocationNotFoundException, ConfigDataResourceNotFoundException { | ||
| registerSecretManagerBeans(context); | ||
|
|
||
| return Collections.singletonList(new SecretManagerConfigDataResource(location)); | ||
| } | ||
|
|
||
| private static void registerSecretManagerBeans(ConfigDataLocationResolverContext context) { | ||
| // Register the Secret Manager properties. | ||
| registerBean(context, GcpSecretManagerProperties.class, getSecretManagerProperties(context)); | ||
| // Register the CredentialsProvider. | ||
| registerBean(context, CredentialsProvider.class, getCredentialsProvider(context)); | ||
| // Register the Secret Manager client factory. | ||
|
There was a problem hiding this comment. @abheda-crest Sorry this was missed in earlier reviews. I believe the root cause is here: This SecretManagerConfigDataLocationResolver is used regardless if secretmanager dependency is present. When not present, for example if you run the vision sample app, this code Note that secretmanager is optional dependency for autoconfig. You will need to guard this logic to only run when secretmanager is present. There was a problem hiding this comment. I have fixed the issue |
||
| registerAndPromoteBean( | ||
| context, | ||
| SecretManagerServiceClientFactory.class, | ||
| BootstrapRegistry.InstanceSupplier.from( | ||
| () -> createSecretManagerServiceClientFactory(context))); | ||
| registerAndPromoteBean( | ||
| context, | ||
| GcpProjectIdProvider.class, | ||
|
|
@@ -98,44 +97,43 @@ private static GcpSecretManagerProperties getSecretManagerProperties( | |
| .orElse(new GcpSecretManagerProperties()); | ||
| } | ||
|
|
||
| private static CredentialsProvider getCredentialsProvider( | ||
| ConfigDataLocationResolverContext context) { | ||
| try { | ||
| GcpSecretManagerProperties properties = | ||
| context.getBootstrapContext().get(GcpSecretManagerProperties.class); | ||
| return context.getBinder() | ||
| .bind(GcpSecretManagerProperties.PREFIX, CredentialsProvider.class) | ||
| .orElse(new DefaultCredentialsProvider(properties)); | ||
| } catch (IOException e) { | ||
| throw new RuntimeException( | ||
| "Failed to create the Secret Manager Client Factory for ConfigData loading.", e); | ||
| } | ||
| } | ||
|
|
||
| private static GcpProjectIdProvider createProjectIdProvider( | ||
| ConfigDataLocationResolverContext context) { | ||
| GcpSecretManagerProperties properties = context.getBootstrapContext() | ||
| .get(GcpSecretManagerProperties.class); | ||
| return properties.getProjectId() != null | ||
| ? properties::getProjectId | ||
| : new DefaultGcpProjectIdProvider(); | ||
| } | ||
|
|
||
| @VisibleForTesting | ||
| static synchronized SecretManagerServiceClientFactory createSecretManagerServiceClientFactory( | ||
| ConfigDataLocationResolverContext context) { | ||
| if (secretManagerServiceClientFactory != null) { | ||
| return secretManagerServiceClientFactory; | ||
| } | ||
| return new DefaultSecretManagerServiceClientFactory( | ||
| context.getBootstrapContext().get(CredentialsProvider.class)); | ||
| } | ||
|
|
||
| private static SecretManagerTemplate createSecretManagerTemplate( | ||
| ConfigDataLocationResolverContext context) { | ||
| SecretManagerServiceClientFactory client = context.getBootstrapContext() | ||
| .get(SecretManagerServiceClientFactory.class); | ||
| GcpProjectIdProvider projectIdProvider = context.getBootstrapContext() | ||
| .get(GcpProjectIdProvider.class); | ||
| GcpSecretManagerProperties properties = context.getBootstrapContext() | ||
|
|
@@ -153,7 +151,8 @@ private static SecretManagerTemplate createSecretManagerTemplate( | |
| */ | ||
| private static <T> void registerBean( | ||
| ConfigDataLocationResolverContext context, Class<T> type, T instance) { | ||
| context | ||
| .getBootstrapContext() | ||
| .registerIfAbsent(type, BootstrapRegistry.InstanceSupplier.of(instance)); | ||
| } | ||
|
|
||
|
|
@@ -162,7 +161,8 @@ private static <T> void registerBean( | |
| * application context. | ||
| */ | ||
| private static <T> void registerAndPromoteBean( | ||
| ConfigDataLocationResolverContext context, | ||
| Class<T> type, | ||
| BootstrapRegistry.InstanceSupplier<T> supplier) { | ||
| context.getBootstrapContext().registerIfAbsent(type, supplier); | ||
| context.getBootstrapContext().addCloseListener(event -> { | ||
|
|
@@ -176,7 +176,8 @@ private static <T> void registerAndPromoteBean( | |
| } | ||
|
|
||
| @VisibleForTesting | ||
| static void setSecretManagerServiceClientFactory( | ||
| SecretManagerServiceClientFactory clientFactory) { | ||
| secretManagerServiceClientFactory = clientFactory; | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.