Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix!: Change additional user default password #332

Merged
merged 7 commits into from
Aug 12, 2022
Merged

fix!: Change additional user default password #332

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
f2b8942
Change additional_users default password
carash Aug 4, 2022
dddd69b
Merge branch 'master' into mysql-fix-additional-user-password
g-awmalik Aug 9, 2022
aabc68d
Update unit test with sensitive values
carash Aug 11, 2022
ccf5cda
Add upgrade section to docs
carash Aug 11, 2022
4a8d759
Fix example sensitive output
carash Aug 11, 2022
e1aa62a
Update docs/upgrading_to_sql_db_12.0.0.md
g-awmalik Aug 11, 2022
9a5f1cb
Merge branch 'master' into mysql-fix-additional-user-password
g-awmalik Aug 11, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions docs/upgrading_to_sql_db_12.0.0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,3 +95,19 @@ module "pg" {
]
}
```

Prior to the 12.0.0 `mysql` module release, additional users were created using the `default_user`'s password. In order to keep the password unchanged for additional users for release 12.0.0 and up, `additional_user`'s passwords need to be set explicitly using the `default_user`'s generated password.

```diff
module "mysql" {
source = "GoogleCloudPlatform/sql-db/google//modules/mysql"
- version = "~> 11.0"
+ version = "~> 12.0"

project_id = var.project_id
additional_users = {
user = "admin"
+ password = module.mysql.generated_user_password
}
g-awmalik marked this conversation as resolved.
Show resolved Hide resolved
}
```
1 change: 1 addition & 0 deletions examples/mysql-private/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@ output "mysql_conn" {
}

output "mysql_user_pass" {
sensitive = true
value = module.safer-mysql-db.generated_user_password
description = "The password for the default user. If not set, a random one will be generated and available in the generated_user_password output variable."
}
Expand Down
1 change: 1 addition & 0 deletions examples/mysql-public/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@ output "mysql_conn" {
}

output "mysql_user_pass" {
sensitive = true
value = module.mysql-db.generated_user_password
description = "The password for the default user. If not set, a random one will be generated and available in the generated_user_password output variable."
}
Expand Down
2 changes: 1 addition & 1 deletion modules/mysql/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,7 +192,7 @@ resource "google_sql_user" "additional_users" {
for_each = local.users
project = var.project_id
name = each.value.name
password = lookup(each.value, "password", random_password.user-password.result)
password = lookup(each.value, "password", random_password.additional_passwords[each.key].result)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you add a section to the upgrade guide for existing users? I suspect users who already applied can set the value ofrandom_password.user-password.result to var. additional_users to prevent a diff.
https://github.com/terraform-google-modules/terraform-google-sql-db/blob/master/docs/upgrading_to_sql_db_12.0.0.md

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@carash - we'd like this to part of the upcoming release. Let us know if you can update this in the next 24h. Thank you!

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

will do, I'll update the PR today along with the updated tests

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suspect an upgrade guide to prevent a diff might require manipulating the tfstate file directly, is that fine?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@carash I was thinking since they have already applied it with random_password.user-password.result, they can retrieve output from generated_user_password and use that to construct var. additional_users like

+ data "google_secret_manager_secret_version" "password" {
+  secret_id = "pg-user-pass"
+  project   = var.project_id
+ }
...
additional_users = [
     {
       name     = "user1"
+       password = data.google_secret_manager_secret_version.password.secret_data
     }
   ]

similar to what did here https://github.com/terraform-google-modules/terraform-google-sql-db/blob/master/docs/upgrading_to_sql_db_11.0.0.md#switched-to-using-random_password-to-generate-default-passwords

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ah I see. that'll do it, thanks

host = lookup(each.value, "host", var.user_host)
instance = google_sql_database_instance.default.name
type = lookup(each.value, "type", "BUILT_IN")
Expand Down