Add Cloud SQL MySQL support #7302
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
r0mant
added
database-access
Joerger
approved these changes
Jun 16, 2021
xacrimon
approved these changes
Jun 16, 2021
smallinsky
approved these changes
Jun 17, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adds support for connecting to MySQL Cloud SQL databases with database access.
MySQL in Cloud SQL does not support IAM authentication, so instead we're using GCP Cloud SQL Admin API to emulate one-time passwords: before each connect we reset the requested database user's password to a generated token and then connect with it. See linked ticket for more details on the used APIs, if interested.
This approach means that we have to serialize all connections to the same database/user to avoid races with clients updating the password - esp. keeping in mind HA scenario where there may be multiple database services proxying the same database instance.
The nice property about this approach though is that it can be used with regular database users as opposed to Postgres IAM auth where you have to connect with service accounts.
I've also refactored the way database service handles creating cloud clients a bit along the way, to make it a bit cleaner, ensure better separation of concerns and also to make it easier in future to introduce dynamically added/removed databases - previously it would only initialize all clients upon startup, now it initializes required clients on demand and caches them.
Closes #7146.