feat(secretmanager): Add Cloud SQL managed-rotation samples - #10348
suvidha-malaviya wants to merge 3 commits into
Conversation
Not part of the automated test suite; dropping it from the sample directory.
product-auto-label
Bot
added
samples
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces new Java samples and integration tests for Google Cloud Secret Manager, specifically focusing on creating secrets with type restrictions and managing regional secrets with Cloud SQL managed rotation. The feedback suggests improving code maintainability by using standard protobuf utility classes (Timestamps and Durations) to build timestamp and duration objects, and enhancing test reliability by adding a backoff sleep when retrying on AbortedException during IAM policy updates.
| Timestamp nextRotationTime = | ||
| Timestamp.newBuilder() | ||
| .setSeconds(nextRotationInstant.getEpochSecond()) | ||
| .setNanos(nextRotationInstant.getNano()) | ||
| .build(); | ||
| Duration rotationPeriod = Duration.newBuilder().setSeconds(rotationPeriodSeconds).build(); |
There was a problem hiding this comment.
Instead of manually building the Timestamp and Duration objects, you can use the standard utility classes com.google.protobuf.util.Timestamps and com.google.protobuf.util.Durations to make the code cleaner and more maintainable.
Timestamp nextRotationTime =
com.google.protobuf.util.Timestamps.fromMillis(nextRotationInstant.toEpochMilli());
Duration rotationPeriod =
com.google.protobuf.util.Durations.fromSeconds(rotationPeriodSeconds);| try { | ||
| projectsClient.setIamPolicy(resource, policyBuilder.build()); | ||
| return; | ||
| } catch (AbortedException e) { | ||
| if (attempt >= 5) { | ||
| throw e; | ||
| } | ||
| } |
There was a problem hiding this comment.
When retrying on AbortedException (which indicates concurrent modification of the IAM policy), retrying immediately in a tight loop can cause high CPU usage and increased contention. Adding a short backoff sleep (e.g., exponential backoff or a simple incremental sleep) between retry attempts is a best practice to reduce contention and improve test reliability.
try {
projectsClient.setIamPolicy(resource, policyBuilder.build());
return;
} catch (AbortedException e) {
if (attempt >= 5) {
throw e;
}
try {
Thread.sleep(100 * (attempt + 1));
} catch (InterruptedException ie) {
Thread.currentThread().interrupt();
throw new IOException("Interrupted during retry backoff", ie);
}
}| try { | ||
| projectsClient.setIamPolicy(resource, policyBuilder.build()); | ||
| return; | ||
| } catch (AbortedException e) { | ||
| if (attempt >= 5) { | ||
| throw e; | ||
| } | ||
| } |
There was a problem hiding this comment.
When retrying on AbortedException (which indicates concurrent modification of the IAM policy), retrying immediately in a tight loop can cause high CPU usage and increased contention. Adding a short backoff sleep (e.g., exponential backoff or a simple incremental sleep) between retry attempts is a best practice to reduce contention and improve test reliability.
try {
projectsClient.setIamPolicy(resource, policyBuilder.build());
return;
} catch (AbortedException e) {
if (attempt >= 5) {
throw e;
}
try {
Thread.sleep(100 * (attempt + 1));
} catch (InterruptedException ie) {
Thread.currentThread().interrupt();
throw new IOException("Interrupted during retry backoff", ie);
}
}…latform#10348 - UpdateRegionalSecretWithManagedRotationSchedule.java: build the Timestamp/Duration via com.google.protobuf.util.Timestamps/Durations instead of manual builders. - SnippetsIT.java: add backoff between AbortedException retries in grantCloudSqlRole and revokeCloudSqlRole to reduce contention.
- UpdateRegionalSecretWithManagedRotationSchedule.java: build the Timestamp/Duration via com.google.protobuf.util.Timestamps/Durations instead of manual builders. - SnippetsIT.java: add backoff between AbortedException retries in grantCloudSqlRole and revokeCloudSqlRole to reduce contention.
22c4ce4 to
8370800
Compare
suvidha-malaviya
changed the title
1 participant
Description
Adds samples for Secret Manager's Cloud SQL managed-rotation feature (regional secrets only — this feature isn't available for global secrets):
Also added two global scenario with secret-type:
Sample List (global & regional):
CreateSecretWithType.java(secret-type restriction is global-only — no regional counterpart)GetSecretType.java/GetRegionalSecretType.javaCreateRegionalSecretWithCloudSqlCredentials.javaEnableRegionalSecretManagedRotation.javaRotateRegionalSecret.javaUpdateRegionalSecretWithManagedRotationSchedule.javaAdded required tests for all of the above in
SnippetsIT.java(regional and global).Also bumps
google-cloud-secretmanager/proto-google-cloud-secretmanager-v1from 2.66.0 → 2.98.0 (and thegoogle-cloud-bomimport from 26.62.0 → 26.89.0) — minimum version with Cloud SQL managed-rotation support.Checklist
Testing
mvn clean verifyrequiredmvn -P lint checkstyle:checkrequiredmvn -P lint clean compile pmd:cpd-check spotbugs:checkadvisory onlyCompliance & Style
pom.xmlparent set to latestshared-configurationsqladmin.googleapis.com)-
CLOUD_SQL_INSTANCE/CLOUD_SQL_USER— a pre-provisioned, long-lived Cloud SQL instance + DB user for managed-rotation tests to point at- The identity running these tests additionally needs
resourcemanager.projects.getIamPolicy/setIamPolicyon the test project (e.g.roles/resourcemanager.projectIamAdmin)Post-Approval Actions