Repository navigation
chore(kokoro): Fetch latest enabled secret instead of disabled latest version - #14730
sakthivelmanii wants to merge 4 commits into
Conversation
… version The latest alias in Secret Manager points to the most recently created version even if it is disabled or destroyed. This caused the populate-secrets.sh script to fail silently with FAILED_PRECONDITION when attempting to download version 38 of java-it-service-account, which was corrupted and disabled, leading to a missing credential file in the Kokoro environment. This commit changes the script to explicitly query and download the latest enabled version, making the CI robust against disabled or destroyed secrets.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the .kokoro/populate-secrets.sh script to dynamically retrieve the latest enabled version of a secret instead of using the hardcoded latest tag. However, a critical issue was identified where --format="value(name)" returns the fully qualified resource name, which will cause conflicts and command parsing errors when passed to gcloud secrets versions access alongside the --secret flag. It is recommended to use the basename() transform to extract only the version number.
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request updates .kokoro/populate-secrets.sh to dynamically retrieve the latest enabled version of each secret instead of using the static "latest" alias. The review feedback recommends appending || VERSION="" to the command substitution to prevent premature script exit under set -e and ensure the custom error message is displayed. Additionally, it suggests adding the --rm flag to both docker run commands to clean up containers after execution.
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request updates the .kokoro/populate-secrets.sh script to retrieve the latest enabled version of a secret instead of requesting the 'latest' version, adding error handling if no enabled version is found. The review feedback recommends double-quoting variable expansions (such as ${KOKORO_GFILE_DIR}, ${key}, and ${VERSION}) within the docker commands to prevent potential word-splitting and globbing issues in the shell script.
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request updates the .kokoro/populate-secrets.sh script to fetch the latest enabled version of a secret rather than using the latest alias, and improves Docker command execution by adding the --rm flag and quoting variables. Feedback was provided to explicitly handle failures when retrieving the secret payload to prevent silent failures or writing corrupted secret files.
| docker run --rm --entrypoint=gcloud \ | ||
| --volume="${KOKORO_GFILE_DIR}:${KOKORO_GFILE_DIR}" \ | ||
| gcr.io/google.com/cloudsdktool/cloud-sdk \ | ||
| secrets versions access "${VERSION}" \ | ||
| --project cloud-devrel-kokoro-resources \ | ||
| --secret "${key}" > \ | ||
| "${SECRET_LOCATION}/${key}" |
There was a problem hiding this comment.
If the docker run command to access the secret payload fails, the script currently does not exit explicitly (unless set -e is active). To prevent silent failures or continuing with empty/corrupted secret files, we should explicitly handle the failure of this command and exit with an error.
| docker run --rm --entrypoint=gcloud \ | |
| --volume="${KOKORO_GFILE_DIR}:${KOKORO_GFILE_DIR}" \ | |
| gcr.io/google.com/cloudsdktool/cloud-sdk \ | |
| secrets versions access "${VERSION}" \ | |
| --project cloud-devrel-kokoro-resources \ | |
| --secret "${key}" > \ | |
| "${SECRET_LOCATION}/${key}" | |
| docker run --rm --entrypoint=gcloud \ | |
| --volume="${KOKORO_GFILE_DIR}:${KOKORO_GFILE_DIR}" \ | |
| gcr.io/google.com/cloudsdktool/cloud-sdk \ | |
| secrets versions access "${VERSION}" \ | |
| --project cloud-devrel-kokoro-resources \ | |
| --secret "${key}" > \ | |
| "${SECRET_LOCATION}/${key}" || { msg "Error retrieving secret payload for ${key}"; exit 1; } |
Pull request was closed
No description provided.