mirror of
https://github.com/hanzoai/tasks.git
synced 2026-10-04 02:04:03 +00:00
Vladyslav SimonenkoandGitHub
9d4d05794e
## What changed? Add a `passwordCommand` config option for SQL datastores that executes an external command to fetch the database password instead of using a static `password` field. When configured, each new physical database connection re-executes the command to get a fresh credential via `RefreshingConnector`, enabling short-lived tokens (e.g. cloud IAM tokens) to be used as database passwords. Supported for MySQL, PostgreSQL (both pgx and pq drivers). ## Why? Cloud-managed databases (e.g. AWS RDS, GCP Cloud SQL) authenticate using short-lived IAM tokens rather than static passwords. There was no way to integrate an external credential source into Temporal's SQL config without forking the code. `passwordCommand` lets operators plug in any token-fetching tool (e.g. `aws rds generate-db-auth-token`) via config. This approach is vendor-agnostic: any command that writes a password to stdout works, with no SDK dependencies or provider-specific code in Temporal. ## How did you test it? - [X] built - [X] run locally and tested manually - [ ] covered by existing tests - [X] added new unit test(s) - [ ] added new functional test(s) Tested with GCP, setting up a Postgres database and using it for the server backend ## Potential risks - `passwordCommand` executes an arbitrary external command. Misconfiguration will cause connection failures - If the command is slow or hangs, connection pool growth will stall until the timeout (default 30s) fires. - Token expiry must be managed by the operator via `MaxConnLifetime`, there is no built-in mechanism to detect or handle expired credentials on existing connections. Richer integration (e.g. parsing expiry from the command output and automatically setting connection lifetime) is possible but intentionally omitted here as it would be vendor-specific. The good news, is that most cloud APIs return tokens with a known, fixed TTL (e.g. 15 minutes for AWS RDS, 1 hour for GCP Cloud SQL).
75 lines
1.8 KiB
Go
75 lines
1.8 KiB
Go
package sqlplugin
|
|
|
|
import (
|
|
"context"
|
|
"database/sql/driver"
|
|
"errors"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
type fakeConn struct{}
|
|
|
|
func (fakeConn) Prepare(string) (driver.Stmt, error) { return nil, nil }
|
|
func (fakeConn) Close() error { return nil }
|
|
func (fakeConn) Begin() (driver.Tx, error) { return nil, nil }
|
|
|
|
type fakeConnector struct{ dsn string }
|
|
|
|
func (c *fakeConnector) Connect(context.Context) (driver.Conn, error) { return fakeConn{}, nil }
|
|
func (c *fakeConnector) Driver() driver.Driver { return nil }
|
|
|
|
func TestRefreshingConnector_CallsBuildDSNOnEachConnect(t *testing.T) {
|
|
callCount := 0
|
|
c := NewRefreshingConnector(
|
|
func() (string, error) {
|
|
callCount++
|
|
return "dsn-" + string(rune('0'+callCount)), nil
|
|
},
|
|
func(dsn string) (driver.Connector, error) {
|
|
return &fakeConnector{dsn: dsn}, nil
|
|
},
|
|
nil,
|
|
)
|
|
|
|
for range 3 {
|
|
_, err := c.Connect(context.Background())
|
|
require.NoError(t, err)
|
|
}
|
|
require.Equal(t, 3, callCount)
|
|
}
|
|
|
|
func TestRefreshingConnector_PropagatesBuildDSNError(t *testing.T) {
|
|
expectedErr := errors.New("token expired")
|
|
c := NewRefreshingConnector(
|
|
func() (string, error) {
|
|
return "", expectedErr
|
|
},
|
|
func(dsn string) (driver.Connector, error) {
|
|
t.Fatal("NewConnector should not be called when BuildDSN fails")
|
|
return nil, nil
|
|
},
|
|
nil,
|
|
)
|
|
|
|
_, err := c.Connect(context.Background())
|
|
require.ErrorIs(t, err, expectedErr)
|
|
}
|
|
|
|
func TestRefreshingConnector_PropagatesNewConnectorError(t *testing.T) {
|
|
expectedErr := errors.New("bad dsn")
|
|
c := NewRefreshingConnector(
|
|
func() (string, error) {
|
|
return "some-dsn", nil
|
|
},
|
|
func(dsn string) (driver.Connector, error) {
|
|
return nil, expectedErr
|
|
},
|
|
nil,
|
|
)
|
|
|
|
_, err := c.Connect(context.Background())
|
|
require.ErrorIs(t, err, expectedErr)
|
|
}
|