Repository navigation
feat(gcp): set up a connection with Terraform, and sign log pushes instead of a URL secret - #1499
JeremyFunk wants to merge 6 commits into
Confidence 8/10 · No issues found
🟢 Confidence 8/10 · likely safe to merge
Push auth agrees across the script, the module and the ingest, but no real Google apply or signed push was ever run.
quality 98/100 · 1 note · tests covered · risk medium · 2/3 new units observable
Google Cloud connections can now be set up with a Terraform module, and Pub/Sub pushes are OIDC-signed instead of carrying a URL secret; the ingest verifies the ID token, and a new check_access endpoint confirms read-only access without a report. The change is safe to merge.
setup_scriptsalso returns a secret-freeterraformmodule block- Ingest verifies signed Pub/Sub pushes against Google's JWKS in preference to the URL secret
- New
POST .../check_accessreads the scope as the read-only account and records it - Setup script creates and deletes the
maple-push-*service account
Before merge
- Infra · Check every environment has what this config now expects ·
deploy/terraform-google-maple/logs.tf - Infra · Check every environment has what this config now expects ·
deploy/terraform-google-maple/main.tf - Infra · Check every environment has what this config now expects ·
deploy/terraform-google-maple/outputs.tf - Infra · Check every environment has what this config now expects ·
deploy/terraform-google-maple/reader.tf - Infra · Check every environment has what this config now expects ·
deploy/terraform-google-maple/variables.tf - Infra · Check every environment has what this config now expects ·
deploy/terraform-google-maple/versions.tf - Manual · Push the
terraform-google-maple-v1.0.0tag after merge: the generated block pins?ref=to it - Manual · Run one real
terraform applyand one real signed push onmaple-development-projectbefore release
Findings
🔵 Note · F1 · The JWKS fetch has no Client span, so ingest→Google is absent from the service map
observability · MAP-01 · apps/ingest/src/gcp_push_auth.rs:268-272
fetch_keys sends its request through the raw HttpClient (a plain reqwest::Client outside --features hotpath), so a key fetch appears only as untraced time inside the gcp_logpush receiver span, and www.googleapis.com never shows as a peer of the ingest. A refused or slow fetch is then indistinguishable from a slow push until the retry. Add a client span around it, the way clickhouse_export_span covers the ClickHouse export (telemetry.rs:3088), with peer.service = www.googleapis.com and the outcome recorded on it.
Production impact
Telemetry this change adds and removes (1)
- ➕ span name
GcpPromQlService.checkAccess·packages/backend/src/services/integrations/GcpPromQlService.ts:622
What was checked
- Tenant scoping: the resolver keys on connector id and
OrgIdthroughout (main.rs:6318,GcpPromQlService.ts:631) - A
metrics: Nonereport cannot wipe read-only state (COALESCE,main.rs:7114) - Push account name, audience and roles agree across the script, module and ingest (
logs.tf:67,variables.tf:36), so old URL-secret subscriptions keep working
Observability coverage: 2 of 3 changes observable
| Change | Kind | Observable | Evidence |
|---|---|---|---|
| POST /v1/logpush/gcp/{connector_id} signed-push verification and connector resolution | inbound entrypoint | yes | Server span gcp_logpush with maple.gcp.push_auth and maple.gcp.connector_id (main.rs:4878, 4991); metrics::gcp_auth_failure() on refusal (main.rs:4952) |
| Google JWKS fetch for push tokens | outbound call | no | raw HttpClient get with no Client span (gcp_push_auth.rs:268); only the parent receiver span covers it |
| POST /v2/integrations/gcp/connectors/{id}/check_access | inbound entrypoint | yes | Effect.fn("GcpPromQlService.checkAccess") span annotated with orgId and maple.gcp.connector_id (GcpPromQlService.ts:622) |
741679f · Updated on every push. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one. Check ids refer to Maple's instrumentation audit.
Annotations
Check notice on line 272 in apps/ingest/src/gcp_push_auth.rs
maple-review-bot / Maple / review
observability · MAP-01: The JWKS fetch has no Client span, so ingest→Google is absent from the service map
`fetch_keys` sends its request through the raw `HttpClient` (a plain `reqwest::Client` outside `--features hotpath`), so a key fetch appears only as untraced time inside the `gcp_logpush` receiver span, and `www.googleapis.com` never shows as a peer of the ingest. A refused or slow fetch is then indistinguishable from a slow push until the retry. Add a client span around it, the way `clickhouse_export_span` covers the ClickHouse export (telemetry.rs:3088), with `peer.service = www.googleapis.com` and the outcome recorded on it.