Skip to content

CDRIVER-4435 Add support for GCP service accounts in GCP KMS #1140

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 29 commits into from
Nov 3, 2022

Conversation

galon1
Copy link
Contributor

@galon1 galon1 commented Nov 2, 2022

Summary:

  1. upgrade libmongocrypt dependency to 1.6.0
  2. If the KMS provider is set up with an empty gcp: {}, create a gcp_service_account_token by sending a HTTP request to the GCP metadata server. Most of these changes are modeled after how azure tokens were added.
  3. Testing file for service-gcp.c which uses a mock GCP server to test the code handles different HTTP responses. This test uses the fake_azure.py mock server.
  4. Integration test for GCP. Adds a new task group in .evergreen/config.yml to spin up a remote GCE instance using the scripts in drivers-evergreen-tools (link to github). Here is a patch build with the new GCP KMS tasks.

Notes:

the files listed below were copied from this PR since they will be added late, but are needed for integration testing.

  1. build/evergreen_config_generator/taskgroups.py
  2. build/evergreen_config_lib/taskgroups.py

Most recent patch build with the new tasks can be found here: https://spruce.mongodb.com/version/6363fa95d1fe076083e2114f/tasks?sorts=STATUS%3AASC%3BBASE_STATUS%3ADESC

@galon1 galon1 requested a review from kevinAlbs November 2, 2022 14:19
Copy link
Contributor

@vector-of-bool vector-of-bool left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some changes requested, some about consolidating with Azure KMS work.

@galon1 galon1 requested a review from vector-of-bool November 2, 2022 20:54
Copy link
Contributor

@vector-of-bool vector-of-bool left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, pending one comment.

Copy link
Collaborator

@kevinAlbs kevinAlbs left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nicely done. Before merging this PR, please run an Evergreen patch build with the two new tasks. The two new tasks are not run by default.
That can be done with:

evergreen patch --project=mongo-c-driver --description="Test GCP $(git log --oneline HEAD~1..HEAD)" \
    --yes --finalize \
    -v testgcpkms-variant -t testgcpkms-task \
    -v testgcpkms-variant -t testgcpkms-fail-task

@galon1 galon1 merged commit 41e66d4 into mongodb:master Nov 3, 2022
@galon1 galon1 deleted the CDRIVER-4435 branch November 3, 2022 20:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants