Skip to content

Commit d839462

Browse files
dpeckettdpeckett
authored
[METAL-2274] Initial opensourcing of db-auth-gateway (#1)
* [METAL-2274] Initial commit of code
1 parent aaa8fb2 commit d839462

30 files changed

+3650
-3
lines changed

‎.dockerignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
/target

‎.github/workflows/build-and-test.yaml

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
name: Build and Test
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
branches:
9+
- main
10+
11+
jobs:
12+
lint:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout
16+
uses: actions/checkout@v2
17+
- name: Check Code Style
18+
uses: golangci/golangci-lint-action@v2
19+
with:
20+
version: v1.30.0
21+
22+
build:
23+
runs-on: ubuntu-latest
24+
needs: lint
25+
steps:
26+
- name: Checkout
27+
uses: actions/checkout@v2
28+
- name: Set up QEMU
29+
uses: docker/setup-qemu-action@v1
30+
- name: Set up Docker Buildx
31+
uses: docker/setup-buildx-action@v1
32+
- name: Build
33+
id: docker_build
34+
uses: docker/build-push-action@v2
35+
with:
36+
tags: kloeckner-i/db-auth-gateway:${{ github.sha }}
37+
outputs: type=docker,dest=/tmp/db-auth-gateway.tar
38+
- name: Upload docker image artifact
39+
uses: actions/upload-artifact@v2
40+
with:
41+
name: docker-image
42+
path: /tmp/db-auth-gateway.tar
43+
44+
test:
45+
runs-on: ubuntu-latest
46+
needs: build
47+
steps:
48+
- name: Checkout
49+
uses: actions/checkout@v2
50+
- name: Set up QEMU
51+
uses: docker/setup-qemu-action@v1
52+
- name: Set up Docker Buildx
53+
uses: docker/setup-buildx-action@v1
54+
- name: Download artifact
55+
uses: actions/download-artifact@v2
56+
with:
57+
name: docker-image
58+
path: /tmp
59+
- name: Load Docker image
60+
run: docker load --input /tmp/db-auth-gateway.tar
61+
- name: Start Google Cloud SQL Mock and Dependencies
62+
run: |
63+
docker network create db-auth-gateway-test
64+
docker run -d --network=db-auth-gateway-test --network-alias=postgres --name=postgres -e "POSTGRES_PASSWORD=mysecretpassword" postgres:13
65+
docker run -d --network=db-auth-gateway-test --name=cloudsql_mock -p 127.0.0.1:3307:3307 -p 127.0.0.1:8080:8080 kloeckner-i/db-auth-gateway:${{ github.sha }} mock --db-address=postgres:5432 --instance=my-project:my-region:my-database
66+
- name: Test
67+
env:
68+
MOCK_ADDRESS: 127.0.0.1
69+
run: |
70+
make test e2e
71+
- name: Upload Test Logs
72+
uses: actions/upload-artifact@v2
73+
if: failure()
74+
with:
75+
name: test-logs
76+
path: target/db-auth-gateway.log
77+
- name: Collect Docker Logs
78+
if: failure()
79+
uses: jwalton/gh-docker-logs@v1
80+
with:
81+
dest: './logs'
82+
- name: Tar Docker Logs
83+
if: failure()
84+
run: tar cvzf ./logs.tgz ./logs
85+
- name: Upload Docker Logs
86+
uses: actions/upload-artifact@v2
87+
if: failure()
88+
with:
89+
name: docker-logs
90+
path: ./logs.tgz

‎.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
/.idea
2+
/target

‎.golangci.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
linters-settings:
2+
gocognit:
3+
min-complexity: 50
4+
funlen:
5+
lines: 150
6+
statements: 50
7+
nestif:
8+
min-complexity: 10
9+
10+
issues:
11+
exclude-rules:
12+
- path: internal/pubkey/pubkey.go
13+
linters:
14+
- goimports

‎Dockerfile

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,20 @@
1-
FROM alpine:3.13
1+
FROM golang:1.15.0-alpine AS builder
22

3-
RUN echo 'hello world' > /etc/motd
3+
RUN apk add --update --no-cache make
4+
WORKDIR /build
5+
6+
COPY . /build/
7+
8+
RUN make
9+
10+
FROM alpine:3.12.0
11+
12+
COPY --from=builder /build/target/db-auth-gateway /usr/local/bin/db-auth-gateway
13+
COPY --from=builder /build/LICENSE /LICENSE
14+
15+
RUN addgroup -g 65532 -S gateway \
16+
&& adduser -u 65532 -S gateway -G gateway
17+
18+
USER 65532
19+
20+
ENTRYPOINT [ "/usr/local/bin/db-auth-gateway" ]

‎LICENSE

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -199,3 +199,26 @@
199199
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
200200
See the License for the specific language governing permissions and
201201
limitations under the License.
202+
203+
internal/util/connection.go:
204+
205+
Copyright (c) 2014 Juan Batiz-Benet
206+
Copyright (2) 2021 Kloeckner.I
207+
208+
Permission is hereby granted, free of charge, to any person obtaining a copy
209+
of this software and associated documentation files (the "Software"), to deal
210+
in the Software without restriction, including without limitation the rights
211+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
212+
copies of the Software, and to permit persons to whom the Software is
213+
furnished to do so, subject to the following conditions:
214+
215+
The above copyright notice and this permission notice shall be included in
216+
all copies or substantial portions of the Software.
217+
218+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
219+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
220+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
221+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
222+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
223+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
224+
THE SOFTWARE.

‎Makefile

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
BIN = target/db-auth-gateway
2+
SRC = $(shell find . -type f -name '*.go')
3+
4+
$(BIN): $(SRC)
5+
@mkdir -p target
6+
@go build -o $@ cmd/main.go
7+
8+
test: $(SRC)
9+
@go test ./...
10+
11+
e2e: $(SRC) $(BIN)
12+
@go test -tags=e2e ./test/...
13+
14+
start_mock: $(SRC)
15+
@-docker-compose down
16+
@docker-compose build
17+
@docker-compose up -d
18+
19+
lint: $(SRC)
20+
@go mod tidy
21+
@gofumpt -s -l -w $^
22+
@gci -w $^
23+
@golint ./...
24+
@golangci-lint run --timeout 5m0s --enable-all -D gochecknoglobals -D gomnd ./...
25+
26+
clean:
27+
@-rm -Rf target/*
28+
@go clean -testcache
29+
@-docker-compose down
30+
31+
.PHONY: test e2e start_mock lint clean

‎README.md

Lines changed: 125 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,126 @@
1+
<p align="center">
2+
<img src="mascot/banner.png" alt="db-auth-gateway" title="db-auth-gateway" />
3+
</p>
4+
15
# db-auth-gateway
2-
An authentication proxy for Google Cloud managed databases
6+
7+
An authentication proxy for Google Cloud managed databases. Based on the ideas
8+
of [cloudsql-proxy](https://github.com/GoogleCloudPlatform/cloudsql-proxy) but
9+
intended to be run as a standalone network accessible service rather than a
10+
sidecar.
11+
12+
We've been using `cloudsql-proxy` for several years now to power our
13+
[db-operator](https://github.com/kloeckner-i/db-operator) project. It has been
14+
for the most part reliable but key differences between how we deploy it and
15+
Google's reference architecture have led to production issues.
16+
17+
We developed `db-auth-gateway` to address these issues and add a variety of wish
18+
list features such as improved observability, and testing.
19+
20+
## Features
21+
22+
* Connection draining during shutdown to support zero downtime deployments and
23+
load balancing.
24+
* Prometheus metrics support for improved observability.
25+
* Full testsuite including realistic Google service mocks.
26+
* Simplified modern code base.
27+
28+
## Quickstart
29+
30+
Use `docker-compose` to start a local PostgreSQL instance, and Google API mock:
31+
32+
```shell script
33+
make start_mock
34+
```
35+
36+
Then you can then run `db-auth-gateway` locally with:
37+
38+
```shell script
39+
db-auth-gateway --api-endpoint=http://localhost:8080 --credential-file=DISABLED \
40+
--instance=my-project:my-region:my-database
41+
```
42+
43+
`db-auth-gateway` will listen on port 5432 (by default) for SQL connections.
44+
45+
```shell script
46+
PGPASSWORD=mysecretpassword psql -h localhost -p 5432 -d postgres postgres
47+
```
48+
49+
### Flags
50+
51+
`db-auth-gateway` has a variety of command line flags for configuring its behavior:
52+
53+
| Flag | Default | Description |
54+
|:---|:---:|:---|
55+
| --credential-file | | JSON file containing the Google Cloud credentials |
56+
| --instance | | Fully qualified database instance to connect to (project:region:name) |
57+
| --listen | :5432 | Address and port to listen on |
58+
| --remote-port | 3307 | Port to connect to the remote server on |
59+
| --max-connections | 0 | The maximum number of active connections. Defaults to 0 (unlimited) |
60+
| --min-refresh-interval | 1m | The minimum amount of time to wait between API calls |
61+
| --periodic-refresh-interval | 5m | Configuration is eagerly refreshed on a schedule. This is the nominal period between API calls. |
62+
| --api-endpoint | | If specified the URL to use for API calls |
63+
64+
## Development
65+
66+
### Prerequisites
67+
68+
* [Go 1.15+](https://golang.org/dl/)
69+
* GNU Make
70+
* [golangci-lint v1.30+](https://golangci-lint.run/usage/install/)
71+
* Additional Go tools:
72+
* [golint](https://github.com/golang/lint)
73+
* [gofumpt](https://github.com/mvdan/gofumpt)
74+
* [gofumports](https://github.com/mvdan/gofumpt)
75+
* [gci](https://github.com/daixiang0/gci)
76+
77+
### Build
78+
79+
To build `db-auth-gateway`, simply run make without any arguments.
80+
81+
The resulting binary will be written to: `./target/db-auth-gateway`.
82+
83+
```shell script
84+
make
85+
```
86+
87+
### Test
88+
89+
Before committing any code you should always lint and test your changes.
90+
91+
#### Code Linting
92+
93+
```shell script
94+
make lint
95+
```
96+
97+
#### Running the Tests
98+
99+
First start the Google API mock using `docker-compose`:
100+
101+
```shell script
102+
make start_mock
103+
```
104+
105+
Then run the tests:
106+
107+
```shell script
108+
make test
109+
```
110+
111+
### End to End Testing
112+
113+
You run the end to end tests with:
114+
115+
```shell script
116+
make e2e
117+
```
118+
119+
The tests will start a local instance of `db-auth-gateway` and verify it is able
120+
to connect to and query the Postgres database, and Google API mock.
121+
122+
## Acknowledgements
123+
124+
1. [The Go Gopher](https://blog.golang.org/gopher) by [Renee French](http://reneefrench.blogspot.com/), licensed under the [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/).
125+
1. https://github.com/GoogleCloudPlatform/cloudsql-proxy
126+
1. https://github.com/jbenet/go-context

0 commit comments

Comments
 (0)