-
Notifications
You must be signed in to change notification settings - Fork 1.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: Update config.go and framework_config.go to use transport.Creds for all cases #7875
Conversation
Hello! I am a robot who works on Magic Modules PRs. I've detected that you're a community contributor. @SarahFrench, a repository maintainer, has been assigned to assist you and help review your changes. ❓ First time contributing? Click here for more detailsYour assigned reviewer will help review your code by:
You can help make sure that review is quick by running local tests and ensuring they're passing in between each push you make to your PR's branch. Also, try to leave a comment with each push you make, as pushes generally don't generate emails. If your reviewer doesn't get back to you within a week after your most recent change, please feel free to leave a comment on the issue asking them to take a look! In the absence of a dedicated review dashboard most maintainers manage their pending reviews through email, and those will sometimes get lost in their inbox. |
@SarahFrench: I've been working w/ @andyrzhao internally, I'll grab this review! |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Cool- these interfaces ultimately call the same methods we used to, preserving more metadata throughout. I can't think of a reason that this wouldn't be backwards-compatible.
Would it be easy to add a test that failed before but succeeds now, or is configuring making mtls calls difficult?
@@ -601,7 +601,7 @@ func GetCredentials(ctx context.Context, data ProviderModel, initialCredentialsO | |||
return *creds | |||
} | |||
|
|||
creds, err := googleoauth.CredentialsFromJSON(ctx, []byte(contents), clientScopes...) | |||
creds, err := transport.Creds(ctx, option.WithCredentialsJSON([]byte(contents)), option.WithScopes(clientScopes...)) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Note: transport.Creds
ultimately calls out to CredentialsFromJSONWithParams
, so this is almost certainly compatible: https://github.com/googleapis/google-api-go-client/blob/cf0df64489c5086a57b9156d9648fe8342b22408/internal/creds.go#LL108C1-L108C1
@@ -625,14 +625,12 @@ func GetCredentials(ctx context.Context, data ProviderModel, initialCredentialsO | |||
|
|||
tflog.Info(ctx, "Authenticating using DefaultClient...") | |||
tflog.Info(ctx, fmt.Sprintf(" -- Scopes: %s", clientScopes)) | |||
defaultTS, err := googleoauth.DefaultTokenSource(context.Background(), clientScopes...) | |||
creds, err := transport.Creds(context.Background(), option.WithScopes(clientScopes...)) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Note: DefaultTokenSource
calls FindDefaultCredentials
and extracts the TokenSource from the credenetials (which we then use to reconstruct a credentials object...), Creds calls FindDefaultCredentials
and returns the credentials.
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are. Terraform GA: Diff ( 2 files changed, 402 insertions(+), 405 deletions(-)) |
Thanks for the review Riley! So in terms of test coverage, adding a unit test (such as verifying that the resulting tokenSource has an oauth2 http client configured if mTLS is enabled) does not seem appropriate since we would be testing the internal behavior of transport.Creds which is subject to change. An integration test that can verify the end-to-end behavior would be more suitable - it would involve a test user account configured with CAA policy making a test call to GCP APIs. I'm not familiar enough with Terraform to make a call on how easy it would be to set-up such a test. From CBA team perspective, we do have plans in the back log to add automated E2E test coverage for all OS's and client tools. I did manually verify the 2 code paths I touched with this PR (by using the application default credentials, as well as by specifying the GOOGLE_CREDENTIALS override), and both now works with CAA. |
Tests analyticsTotal tests: Errors occurred during REPLAYING mode. Please fix them to complete your PR |
Co-authored-by: Riley Karson <rileykarson@google.com>
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are. Terraform GA: Diff ( 2 files changed, 6 insertions(+), 10 deletions(-)) |
Tests analyticsTotal tests: Errors occurred during REPLAYING mode. Please fix them to complete your PR |
Co-authored-by: Riley Karson <rileykarson@google.com>
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are. Terraform GA: Diff ( 2 files changed, 6 insertions(+), 10 deletions(-)) |
Tests analyticsTotal tests: Action takenFound 7 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected testsTestAccComputeFirewallPolicyRule_multipleRules|TestAccAlloydbCluster_missingLocation|TestAccAlloydbBackup_missingLocation|TestAccApigeeKeystoresAliasesPkcs12_ApigeeKeystoresAliasesPkcs12Example|TestAccDataSourceGoogleFirebaseAndroidAppConfig|TestAccDataSourceAlloydbLocations_basic|TestAccApigeeKeystoresAliasesKeyCertFile_apigeeKeystoresAliasesKeyCertFileTestExample |
Tests passed during RECORDING mode: Tests failed during RECORDING mode: Please fix these to complete your PR |
…for all cases (GoogleCloudPlatform#7875) Co-authored-by: Riley Karson <rileykarson@google.com>
This PR fixes the issue in hashicorp/terraform-provider-google#14411 by ensuring we use transport.Creds for initializing the credentials/tokenSource in all applicable code-path. Using transport.Creds ensures that the underlying OAuth2 HTTPClient used for token exchange is properly configured for mTLS - the current version of the code in terraform bypasses this logic when calling the oauth2 google package APIs directly.
What is not included in this PR:
If this PR is for Terraform, I acknowledge that I have:
make test
andmake lint
in the generated providers to ensure it passes unit and linter tests.Release Note Template for Downstream PRs (will be copied)