Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for GCP IAM AUTH #1361

Open
Jurka007 opened this issue Dec 19, 2024 · 0 comments
Open

Add support for GCP IAM AUTH #1361

Jurka007 opened this issue Dec 19, 2024 · 0 comments

Comments

@Jurka007
Copy link

Desired Behavior

Hei folks. I just came out from rabbit hole of running netbox in gcp cloud run and would like to ask you to add support for gcp iam auth to be able to connect netbox to cloud sql database without password using service account.
See https://cloud.google.com/sql/docs/postgres/iam-logins and https://cloud.google.com/sql/docs/postgres/connect-run for more info.

This is needed, tested, works:

  1. Install django_gcp_iam_auth https://github.com/rcleveng/django_gcp_iam_auth and google-auth pip install --upgrade google-auth django-gcp-iam-auth
  2. Update configuration.py DATABASE section to support new ENGINE type and option gpc_iam_auth:
DATABASE = {
    'ENGINE': environ.get('DB_ENGINE', 'django.db.backends.postgresql)'),
                                                    # The database backend to use
    'NAME': environ.get('DB_NAME', 'netbox'),       # Database name
    'USER': environ.get('DB_USER', ''),             # PostgreSQL username
    'PASSWORD': _read_secret('db_password', environ.get('DB_PASSWORD', '')),
                                                    # PostgreSQL password
    'HOST': environ.get('DB_HOST', 'localhost'),    # Database server
    'PORT': environ.get('DB_PORT', ''),             # Database port (leave blank for default)
    'OPTIONS': {
        'sslmode': environ.get('DB_SSLMODE', 'prefer'),
                                                    # Database connection SSLMODE
        'gcp_iam_auth': environ.get('DB_GCP_IAM_AUTH', 'false'),
    },                                              # Use gcp iam auth

    'CONN_MAX_AGE': _environ_get_and_map('DB_CONN_MAX_AGE', '300', _AS_INT),
                                                    # Max database connection age
    'DISABLE_SERVER_SIDE_CURSORS': _environ_get_and_map('DB_DISABLE_SERVER_SIDE_CURSORS', 'False', _AS_BOOL),
                                                    # Disable the use of server-side cursors transaction pooling
}
  1. Set the new env variables
DB_ENGINE = django_gcp_iam_auth.postgresql
DB_GCP_IAM_AUTH = true

Contrast to Current Behavior

Django by default uses username/password db authentication, if you don't change the engine, you'll be stuck with error asking for the service account password.

Required Changes

pip install --upgrade google-auth django-gcp-iam-auth

in configuration.py

DATABASE = {
    'ENGINE': environ.get('DB_ENGINE', 'django.db.backends.postgresql)'),
                                                    # The database backend to use
    'NAME': environ.get('DB_NAME', 'netbox'),       # Database name
    'USER': environ.get('DB_USER', ''),             # PostgreSQL username
    'PASSWORD': _read_secret('db_password', environ.get('DB_PASSWORD', '')),
                                                    # PostgreSQL password
    'HOST': environ.get('DB_HOST', 'localhost'),    # Database server
    'PORT': environ.get('DB_PORT', ''),             # Database port (leave blank for default)
    'OPTIONS': {
        'sslmode': environ.get('DB_SSLMODE', 'prefer'),
                                                    # Database connection SSLMODE
        'gcp_iam_auth': environ.get('DB_GCP_IAM_AUTH', 'false'),
    },                                              # Use gcp iam auth

    'CONN_MAX_AGE': _environ_get_and_map('DB_CONN_MAX_AGE', '300', _AS_INT),
                                                    # Max database connection age
    'DISABLE_SERVER_SIDE_CURSORS': _environ_get_and_map('DB_DISABLE_SERVER_SIDE_CURSORS', 'False', _AS_BOOL),
                                                    # Disable the use of server-side cursors transaction pooling
}

Discussion: Benefits and Drawbacks

No response

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant