Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enhancement for SSL-support in CloudSQLExecuteQueryOperator #38894

Merged
merged 1 commit into from
Apr 11, 2024

Conversation

moiseenkov
Copy link
Contributor

The PR provides enhancement for SSL support in CloudSQLExecuteQueryOperator.

  1. The previous implementation used to work with SSL certificates provided by users. If those files have excessive permissions, then psql raises an exception:
psql: error: connection to server at "10.40.112.2", port 5432 failed: private key file "client-key.pem" has group or world access; file must have permissions u=rw (0600) or less if owned by the current user, or permissions u=rw,g=r (0640) or less if owned by root

In order to fix this problem, the CloudSQLDatabaseHook copies those files into a /tmp/certs/ with minimal required permissions, and uses those copies instead.

  1. Added integration with Google Cloud Secret Manager, so users now can store their certificates as secrets and specify a secret id in the operator.
  2. Refactored system tests and removed the deprecated example DAG.

@potiuk potiuk merged commit 1757704 into apache:main Apr 11, 2024
41 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants