Skip to content

Commit f010ee3

Browse files
doroolegdorooleg
authored
secrets have been fixed (#7409)
1 parent a08fe02 commit f010ee3

File tree

4 files changed

+65
-36
lines changed

4 files changed

+65
-36
lines changed

‎ydb/core/fq/libs/compute/ydb/synchronization_service/synchronization_service.cpp

+2
Original file line numberDiff line numberDiff line change
@@ -436,6 +436,7 @@ class TSynchronizeScopeActor : public NActors::TActorBootstrapped<TSynchronizeSc
436436

437437
request.Get()->Get()->YDBClient = Client;
438438
request.Get()->Get()->ComputeDatabase = ComputeDatabase;
439+
request.Get()->Get()->Scope = Scope;
439440

440441
Register(NFq::NPrivate::MakeCreateConnectionActor(
441442
SelfId(),
@@ -465,6 +466,7 @@ class TSynchronizeScopeActor : public NActors::TActorBootstrapped<TSynchronizeSc
465466

466467
request.Get()->Get()->YDBClient = Client;
467468
request.Get()->Get()->ComputeDatabase = ComputeDatabase;
469+
request.Get()->Get()->Scope = Scope;
468470

469471
auto it = Connections.find(binding.second.content().connection_id());
470472
if (it == Connections.end()) {

‎ydb/core/fq/libs/control_plane_proxy/actors/query_utils.cpp

+30-14
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,14 @@
1111
namespace NFq {
1212
namespace NPrivate {
1313

14+
namespace {
15+
16+
TString MakeSecretKeyName(const TString& prefix, const TString& folderId, const TString& name) {
17+
return TStringBuilder{} << prefix << "_" << folderId << "_" << name;
18+
}
19+
20+
}
21+
1422
TString MakeCreateExternalDataTableQuery(const FederatedQuery::BindingContent& content,
1523
const TString& connectionName,
1624
bool replaceIfExists) {
@@ -94,7 +102,8 @@ TString SignAccountId(const TString& id, const TSigner::TPtr& signer) {
94102

95103
TMaybe<TString> CreateSecretObjectQuery(const FederatedQuery::ConnectionSetting& setting,
96104
const TString& name,
97-
const TSigner::TPtr& signer) {
105+
const TSigner::TPtr& signer,
106+
const TString& folderId) {
98107
using namespace fmt::literals;
99108
TString secretObjects;
100109
auto serviceAccountId = ExtractServiceAccountId(setting);
@@ -103,7 +112,7 @@ TMaybe<TString> CreateSecretObjectQuery(const FederatedQuery::ConnectionSetting&
103112
R"(
104113
UPSERT OBJECT {sa_secret_name} (TYPE SECRET) WITH value={signature};
105114
)",
106-
"sa_secret_name"_a = EncloseAndEscapeString("k1" + name, '`'),
115+
"sa_secret_name"_a = EncloseAndEscapeString(MakeSecretKeyName("f1", folderId, name), '`'),
107116
"signature"_a = EncloseSecret(EncloseAndEscapeString(SignAccountId(serviceAccountId, signer), '"'))) : std::string{};
108117
}
109118

@@ -113,7 +122,7 @@ TMaybe<TString> CreateSecretObjectQuery(const FederatedQuery::ConnectionSetting&
113122
R"(
114123
UPSERT OBJECT {password_secret_name} (TYPE SECRET) WITH value={password};
115124
)",
116-
"password_secret_name"_a = EncloseAndEscapeString("k2" + name, '`'),
125+
"password_secret_name"_a = EncloseAndEscapeString(MakeSecretKeyName("f2", folderId, name), '`'),
117126
"password"_a = EncloseSecret(EncloseAndEscapeString(*password, '"')));
118127
}
119128

@@ -122,7 +131,8 @@ TMaybe<TString> CreateSecretObjectQuery(const FederatedQuery::ConnectionSetting&
122131

123132
TString CreateAuthParamsQuery(const FederatedQuery::ConnectionSetting& setting,
124133
const TString& name,
125-
const TSigner::TPtr& signer) {
134+
const TSigner::TPtr& signer,
135+
const TString& folderId) {
126136
using namespace fmt::literals;
127137
auto authMethod = GetYdbComputeAuthMethod(setting);
128138
switch (authMethod) {
@@ -139,7 +149,7 @@ TString CreateAuthParamsQuery(const FederatedQuery::ConnectionSetting& setting,
139149
)",
140150
"auth_method"_a = ToString(authMethod),
141151
"service_account_id"_a = EncloseAndEscapeString(ExtractServiceAccountId(setting), '"'),
142-
"sa_secret_name"_a = EncloseAndEscapeString(signer ? "k1" + name : TString{}, '"'));
152+
"sa_secret_name"_a = EncloseAndEscapeString(signer ? MakeSecretKeyName("f1", folderId, name) : TString{}, '"'));
143153
case EYdbComputeAuth::BASIC:
144154
return fmt::format(
145155
R"(,
@@ -149,7 +159,7 @@ TString CreateAuthParamsQuery(const FederatedQuery::ConnectionSetting& setting,
149159
)",
150160
"auth_method"_a = ToString(authMethod),
151161
"login"_a = EncloseAndEscapeString(GetLogin(setting).GetOrElse({}), '"'),
152-
"password_secret_name"_a = EncloseAndEscapeString("k2" + name, '"'));
162+
"password_secret_name"_a = EncloseAndEscapeString(MakeSecretKeyName("f2", folderId, name), '"'));
153163
case EYdbComputeAuth::MDB_BASIC:
154164
return fmt::format(
155165
R"(,
@@ -161,17 +171,18 @@ TString CreateAuthParamsQuery(const FederatedQuery::ConnectionSetting& setting,
161171
)",
162172
"auth_method"_a = ToString(authMethod),
163173
"service_account_id"_a = EncloseAndEscapeString(ExtractServiceAccountId(setting), '"'),
164-
"sa_secret_name"_a = EncloseAndEscapeString(signer ? "k1" + name : TString{}, '"'),
174+
"sa_secret_name"_a = EncloseAndEscapeString(signer ? MakeSecretKeyName("f1", folderId, name) : TString{}, '"'),
165175
"login"_a = EncloseAndEscapeString(GetLogin(setting).GetOrElse({}), '"'),
166-
"password_secret_name"_a = EncloseAndEscapeString("k2" + name, '"'));
176+
"password_secret_name"_a = EncloseAndEscapeString(MakeSecretKeyName("f2", folderId, name), '"'));
167177
}
168178
}
169179

170180
TString MakeCreateExternalDataSourceQuery(
171181
const FederatedQuery::ConnectionContent& connectionContent,
172182
const TSigner::TPtr& signer,
173183
const NConfig::TCommonConfig& common,
174-
bool replaceIfExists) {
184+
bool replaceIfExists,
185+
const TString& folderId) {
175186
using namespace fmt::literals;
176187

177188
TString properties;
@@ -278,20 +289,25 @@ TString MakeCreateExternalDataSourceQuery(
278289
"auth_params"_a =
279290
CreateAuthParamsQuery(connectionContent.setting(),
280291
connectionContent.name(),
281-
signer));
292+
signer,
293+
folderId));
282294
}
283295

284-
TMaybe<TString> DropSecretObjectQuery(const TString& name) {
296+
TMaybe<TString> DropSecretObjectQuery(const TString& name, const TString& folderId) {
285297
using namespace fmt::literals;
286298
return fmt::format(
287299
R"(
288300
DROP OBJECT {secret_name1} (TYPE SECRET);
289301
DROP OBJECT {secret_name2} (TYPE SECRET);
290302
DROP OBJECT {secret_name3} (TYPE SECRET); -- for backward compatibility
303+
DROP OBJECT {secret_name4} (TYPE SECRET); -- for backward compatibility
304+
DROP OBJECT {secret_name5} (TYPE SECRET); -- for backward compatibility
291305
)",
292-
"secret_name1"_a = EncloseAndEscapeString("k1" + name, '`'),
293-
"secret_name2"_a = EncloseAndEscapeString("k2" + name, '`'),
294-
"secret_name3"_a = EncloseAndEscapeString(name, '`'));
306+
"secret_name1"_a = EncloseAndEscapeString(MakeSecretKeyName("f1", folderId, name), '`'),
307+
"secret_name2"_a = EncloseAndEscapeString(MakeSecretKeyName("f2", folderId, name), '`'),
308+
"secret_name3"_a = EncloseAndEscapeString(TStringBuilder{} << "k1" << name, '`'),
309+
"secret_name4"_a = EncloseAndEscapeString(TStringBuilder{} << "k2" << name, '`'),
310+
"secret_name5"_a = EncloseAndEscapeString(name, '`'));
295311
}
296312

297313
TString MakeDeleteExternalDataTableQuery(const TString& tableName) {

‎ydb/core/fq/libs/control_plane_proxy/actors/query_utils.h

+5-3
Original file line numberDiff line numberDiff line change
@@ -10,15 +10,17 @@ namespace NPrivate {
1010

1111
TMaybe<TString> CreateSecretObjectQuery(const FederatedQuery::ConnectionSetting& setting,
1212
const TString& name,
13-
const TSigner::TPtr& signer);
13+
const TSigner::TPtr& signer,
14+
const TString& folderId);
1415

15-
TMaybe<TString> DropSecretObjectQuery(const TString& name);
16+
TMaybe<TString> DropSecretObjectQuery(const TString& name, const TString& folderId);
1617

1718
TString MakeCreateExternalDataSourceQuery(
1819
const FederatedQuery::ConnectionContent& connectionContent,
1920
const TSigner::TPtr& signer,
2021
const NConfig::TCommonConfig& common,
21-
bool replaceIfExists);
22+
bool replaceIfExists,
23+
const TString& folderId);
2224

2325
TString MakeDeleteExternalDataSourceQuery(const TString& sourceName);
2426

‎ydb/core/fq/libs/control_plane_proxy/actors/ydb_schema_query_actor.cpp

+28-19
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
#include <ydb/core/fq/libs/control_plane_proxy/events/events.h>
1010
#include <ydb/core/fq/libs/control_plane_storage/control_plane_storage.h>
1111
#include <ydb/public/api/protos/draft/fq.pb.h>
12+
#include <ydb/public/lib/fq/scope.h>
1213
#include <ydb/public/sdk/cpp/client/ydb_table/table.h>
1314

1415
namespace NFq::NPrivate {
@@ -418,7 +419,7 @@ class TGenerateRecoverySQLIfExternalDataSourceAlreadyExistsActor :
418419

419420
event->IsExactNameMatch = true;
420421

421-
TBase::Send(NFq::ControlPlaneStorageServiceActorId(), event);
422+
TBase::Send(::NFq::ControlPlaneStorageServiceActorId(), event);
422423
}
423424

424425
STRICT_STFUNC(StateFunc, cFunc(NActors::TEvents::TSystem::Wakeup, TBase::HandleTimeout);
@@ -493,7 +494,7 @@ class TGenerateRecoverySQLIfExternalDataTableAlreadyExistsActor :
493494

494495
event->IsExactNameMatch = true;
495496

496-
TBase::Send(NFq::ControlPlaneStorageServiceActorId(), event);
497+
TBase::Send(::NFq::ControlPlaneStorageServiceActorId(), event);
497498
}
498499

499500
STRICT_STFUNC(StateFunc, cFunc(NActors::TEvents::TSystem::Wakeup, TBase::HandleTimeout);
@@ -543,7 +544,7 @@ IActor* MakeCreateConnectionActor(
543544
TCounters& counters,
544545
TPermissions permissions,
545546
const TCommonConfig& commonConfig,
546-
const NFq::TComputeConfig& computeConfig,
547+
const ::NFq::TComputeConfig& computeConfig,
547548
TSigner::TPtr signer,
548549
bool withoutRollback,
549550
TMaybe<TString> connectionId) {
@@ -557,10 +558,13 @@ IActor* MakeCreateConnectionActor(
557558
computeConfig](const TEvControlPlaneProxy::TEvCreateConnectionRequest::TPtr& req)
558559
-> std::vector<TSchemaQueryTask> {
559560
auto& connectionContent = req->Get()->Request.content();
561+
const auto& scope = req->Get()->Scope;
562+
const TString folderId = NYdb::NFq::TScope{scope}.ParseFolder();
560563

561564
auto createSecretStatement = CreateSecretObjectQuery(connectionContent.setting(),
562565
connectionContent.name(),
563-
signer);
566+
signer,
567+
folderId);
564568

565569
std::vector<TSchemaQueryTask> statements;
566570
if (createSecretStatement) {
@@ -603,7 +607,7 @@ IActor* MakeCreateConnectionActor(
603607
statements.push_back(TSchemaQueryTask{
604608
.SQL = MakeCreateExternalDataSourceQuery(
605609
connectionContent, signer, commonConfig,
606-
computeConfig.IsReplaceIfExistsSyntaxSupported()),
610+
computeConfig.IsReplaceIfExistsSyntaxSupported(), folderId),
607611
.ScheduleErrorRecoverySQLGeneration =
608612
withoutRollback
609613
? NoRecoverySQLGeneration()
@@ -647,7 +651,7 @@ IActor* MakeModifyConnectionActor(
647651
TDuration requestTimeout,
648652
TCounters& counters,
649653
const TCommonConfig& commonConfig,
650-
const NFq::TComputeConfig& computeConfig,
654+
const ::NFq::TComputeConfig& computeConfig,
651655
TSigner::TPtr signer) {
652656
auto queryFactoryMethod =
653657
[signer = std::move(signer),
@@ -659,21 +663,24 @@ IActor* MakeModifyConnectionActor(
659663
auto& oldConnectionContent = (*request->Get()->OldConnectionContent);
660664
auto& oldBindings = request->Get()->OldBindingContents;
661665
auto& newConnectionContent = request->Get()->Request.content();
666+
const auto& scope = request->Get()->Scope;
667+
const TString folderId = NYdb::NFq::TScope{scope}.ParseFolder();
662668

663669
auto dropOldSecret =
664-
DropSecretObjectQuery(oldConnectionContent.name());
670+
DropSecretObjectQuery(oldConnectionContent.name(), folderId);
665671
auto createNewSecret =
666672
CreateSecretObjectQuery(newConnectionContent.setting(),
667673
newConnectionContent.name(),
668-
signer);
674+
signer,
675+
folderId);
669676

670677
bool replaceSupported = computeConfig.IsReplaceIfExistsSyntaxSupported();
671678
if (replaceSupported &&
672679
oldConnectionContent.name() == newConnectionContent.name()) {
673680
// CREATE OR REPLACE
674681
auto createSecretStatement =
675682
CreateSecretObjectQuery(newConnectionContent.setting(),
676-
newConnectionContent.name(), signer);
683+
newConnectionContent.name(), signer, folderId);
677684

678685
std::vector<TSchemaQueryTask> statements;
679686
if (createSecretStatement) {
@@ -683,7 +690,7 @@ IActor* MakeModifyConnectionActor(
683690

684691
statements.push_back(TSchemaQueryTask{
685692
.SQL = MakeCreateExternalDataSourceQuery(
686-
newConnectionContent, signer, commonConfig, replaceSupported)});
693+
newConnectionContent, signer, commonConfig, replaceSupported, folderId)});
687694
return statements;
688695
}
689696

@@ -712,26 +719,26 @@ IActor* MakeModifyConnectionActor(
712719
statements.push_back(TSchemaQueryTask{
713720
.SQL = TString{MakeDeleteExternalDataSourceQuery(oldConnectionContent.name())},
714721
.RollbackSQL = TString{MakeCreateExternalDataSourceQuery(
715-
oldConnectionContent, signer, commonConfig, false)},
722+
oldConnectionContent, signer, commonConfig, false, folderId)},
716723
.ShouldSkipStepOnError = IsPathDoesNotExistIssue});
717724

718725
if (dropOldSecret) {
719726
statements.push_back(TSchemaQueryTask{
720727
.SQL = *dropOldSecret,
721728
.RollbackSQL = CreateSecretObjectQuery(oldConnectionContent.setting(),
722729
oldConnectionContent.name(),
723-
signer),
730+
signer, folderId),
724731
.ShouldSkipStepOnError = IsPathDoesNotExistIssue});
725732
}
726733
if (createNewSecret) {
727734
statements.push_back(TSchemaQueryTask{.SQL = *createNewSecret,
728735
.RollbackSQL = DropSecretObjectQuery(
729-
newConnectionContent.name())});
736+
newConnectionContent.name(), folderId)});
730737
}
731738

732739
statements.push_back(
733740
TSchemaQueryTask{.SQL = TString{MakeCreateExternalDataSourceQuery(
734-
newConnectionContent, signer, commonConfig, false)},
741+
newConnectionContent, signer, commonConfig, false, folderId)},
735742
.RollbackSQL = TString{MakeDeleteExternalDataSourceQuery(
736743
newConnectionContent.name())}});
737744

@@ -787,23 +794,25 @@ IActor* MakeDeleteConnectionActor(
787794
const TEvControlPlaneProxy::TEvDeleteConnectionRequest::TPtr& request)
788795
-> std::vector<TSchemaQueryTask> {
789796
auto& connectionContent = *request->Get()->ConnectionContent;
797+
const auto& scope = request->Get()->Scope;
798+
const TString folderId = NYdb::NFq::TScope{scope}.ParseFolder();
790799

791800
auto dropSecret =
792-
DropSecretObjectQuery(connectionContent.name());
801+
DropSecretObjectQuery(connectionContent.name(), folderId);
793802

794803
std::vector statements = {
795804
TSchemaQueryTask{.SQL = TString{MakeDeleteExternalDataSourceQuery(
796805
connectionContent.name())},
797806
.RollbackSQL = MakeCreateExternalDataSourceQuery(
798-
connectionContent, signer, commonConfig, false),
807+
connectionContent, signer, commonConfig, false, folderId),
799808
.ShouldSkipStepOnError = IsPathDoesNotExistIssue}};
800809
if (dropSecret) {
801810
statements.push_back(
802811
TSchemaQueryTask{.SQL = *dropSecret,
803812
.RollbackSQL =
804813
CreateSecretObjectQuery(connectionContent.setting(),
805814
connectionContent.name(),
806-
signer),
815+
signer, folderId),
807816
.ShouldSkipStepOnError = IsPathDoesNotExistIssue});
808817
}
809818
return statements;
@@ -832,7 +841,7 @@ IActor* MakeCreateBindingActor(const TActorId& proxyActorId,
832841
TDuration requestTimeout,
833842
TCounters& counters,
834843
TPermissions permissions,
835-
const NFq::TComputeConfig& computeConfig,bool withoutRollback,
844+
const ::NFq::TComputeConfig& computeConfig,bool withoutRollback,
836845
TMaybe<TString> bindingId) {
837846
auto queryFactoryMethod =
838847
[requestTimeout, &counters, permissions, withoutRollback, computeConfig](
@@ -916,7 +925,7 @@ IActor* MakeModifyBindingActor(const TActorId& proxyActorId,
916925
TEvControlPlaneProxy::TEvModifyBindingRequest::TPtr request,
917926
TDuration requestTimeout,
918927
TCounters& counters,
919-
const NFq::TComputeConfig& computeConfig) {
928+
const ::NFq::TComputeConfig& computeConfig) {
920929
auto queryFactoryMethod =
921930
[computeConfig](const TEvControlPlaneProxy::TEvModifyBindingRequest::TPtr& request)
922931
-> std::vector<TSchemaQueryTask> {

0 commit comments

Comments
 (0)