Merged
Conversation
…logs
This commit addresses an issue where your user_id was not being logged consistently across environments.
The primary cause identified was the Cloud Run service's inability to fetch Google's public JWT keys due to a restrictive VPC egress setting (`PRIVATE_RANGES_ONLY`). This prevented the fallback JWT decoding mechanism (used when IAP headers are not the primary source) from successfully validating tokens and extracting user_id.
Changes:
- Modified `infra/feed-api/main.tf` to set the Cloud Run service's `template.vpc_access.egress` to `ALL_TRAFFIC`. This allows the service to connect to external Google APIs required for fetching JWT public keys.
- Enhanced error logging in `api/src/middleware/request_context.py`:
- Added specific error logs in `resolve_google_public_keys` for failures during fetching or processing of Google's public keys.
- Upgraded a warning to an error in `decode_jwt` for JWT decoding exceptions and added a log for when public keys are unavailable.
These changes ensure that if JWT-based authentication is used (either as primary or fallback), it can function correctly. Further investigation may be needed to confirm if IAP headers from the load balancer are being correctly propagated to the Cloud Run service, as this is the preferred method for obtaining user identity.
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary:
This pull request refactors logging across the codebase to improve maintainability and introduces infrastructure changes to enhance Google Cloud resource configurations. The most significant changes include replacing the custom
Loggerutility with a standardizedget_loggerfunction, improving error handling and logging messages, and updating Terraform configurations for better role management and traffic egress settings.Logging Refactor:
Loggerutility with theget_loggerfunction across multiple files (feeds_api_impl.py,validation_report_impl.py,load_dataset_on_create.py,populate_db.py,populate_db_test_data.py). This simplifies the logging setup and ensures consistency. [1] [2] [3] [4] [5]Loggerclass fromlogging_utils.py, as it is no longer in use.Improved Error Handling and Logging:
GoogleCloudLogFilterto prevent recursive logging calls and added debug-level messages inglobal_logging_setupfor better visibility during initialization. [1] [2] [3] [4]request_context.pyto uselogging.errorinstead ofprintorlogging.warning, ensuring proper log level usage. [1] [2]Infrastructure Updates:
main.tffor Cloud Logging, Cloud Trace, Cloud Monitoring, and Serverless VPC Access. This ensures the service account has the necessary permissions.PRIVATE_RANGES_ONLYtoALL_TRAFFICinmain.tf, allowing broader traffic routing.main.tfto dynamically assign roles based on the environment.Expected behavior:
Proper roles are added to the GCP environments, and the logs are sent to GCP.
Testing tips:
Provide tips, procedures and sample files on how to test the feature.
Testers are invited to follow the tips AND to try anything they deem relevant outside the bounds of the testing tips.
Please make sure these boxes are checked before submitting your pull request - thanks!
./scripts/api-tests.shto make sure you didn't break anything