components-contrib icon indicating copy to clipboard operation
components-contrib copied to clipboard

Attempt to validate azure/gcp credentials for pubsub and firestore components

Open addjuarez opened this issue 3 years ago • 1 comments

Description

Attempted to add credential checks in the init() methods of azure service bus and gcp pubsub/firestore components.

For GCP Pubsub and Azure Service bus it currently involves adding an optional metadata field "initialTopic". The user would add a topic or possibly topics that we could make get/create calls on during init and could validate if the credentials were correctly configured and have sufficient permissions. We could also simplify the approach and do only a getTopic() call on a random string to see if we have permissions to read from the service.

For firestore we do a query on a dummy string. The entry should not exist and we should get a ErrNoSuchEntity if configured correctly. Any other errors would result in failure.

Issue reference

#1752 One of multiple PRs for this issue

Checklist

Please make sure you've completed the relevant tasks for this PR, out of the following list:

  • [x] Code compiles correctly
  • [ ] Created/updated tests
  • [ ] Extended the documentation / Created issue in the https://github.com/dapr/docs/ repo: dapr/docs#[issue number]

addjuarez avatar Aug 04 '22 23:08 addjuarez

I support credentials validation but not like this. Making dummy calls carry hidden costs for managed services and increased load. Imagine scaling pods from 1 to 200 that cause a big charge and worse, throttling on the service level.

Further more this can create havoc with developers/operators trying to figure out why their services show empty calls in monitoring.

yaron2 avatar Aug 04 '22 23:08 yaron2