Documentation
¶
Index ¶
- Constants
- func DatabaseUsername(principal string) (string, error)
- type Client
- func (c *Client) GenerateEphemeralCert(ctx context.Context, project string, instance string, publicKeyPem string, ...) (*generate_ephemeral_cert_response.Response, error)
- func (c *Client) GetConnectSettings(ctx context.Context, project string, instance string, ...) (*connect_settings.ConnectSettings, error)
- type UsernameResolver
Constants ¶
const ( Domain = "sqladmin.googleapis.com" // LoginScope is the OAuth scope a token needs to log into a database as its IAM principal. LoginScope = "https://www.googleapis.com/auth/sqlservice.login" AdminScope = "https://www.googleapis.com/auth/sqlservice.admin" )
const ( DefaultTokenInfoUrl = "https://oauth2.googleapis.com/tokeninfo" //nolint:gosec // G101: a public endpoint, not a credential DefaultServiceAccountUrl = "https://iam.googleapis.com/v1/projects/-/serviceAccounts/" //nolint:gosec // G101: a public endpoint, not a credential )
Variables ¶
This section is empty.
Functions ¶
func DatabaseUsername ¶
DatabaseUsername returns the Postgres role Cloud SQL creates for an IAM principal, given as an IAM member (`serviceAccount:x`, `user:x`, `group:x`) or a bare email. A service account's role drops the `.gserviceaccount.com` suffix; every name is lowercase.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client calls the two Cloud SQL Admin API methods a connection needs. Authentication is the caller's: pass an authenticating http.Client through cloud_sql_config.WithFetchOptions.
func NewClient ¶
func NewClient(options ...cloud_sql_config.Option) *Client
func (*Client) GenerateEphemeralCert ¶
func (c *Client) GenerateEphemeralCert( ctx context.Context, project string, instance string, publicKeyPem string, accessToken string, options ...fetch_config.Option, ) (*generate_ephemeral_cert_response.Response, error)
GenerateEphemeralCert has the instance's CA sign publicKeyPem for a client certificate. When accessToken is set, the certificate carries it, and the database accepts it in place of a password for the token's principal.
func (*Client) GetConnectSettings ¶
func (c *Client) GetConnectSettings(ctx context.Context, project string, instance string, options ...fetch_config.Option) (*connect_settings.ConnectSettings, error)
GetConnectSettings returns the instance's server CA, addresses and DNS name.
type UsernameResolver ¶ added in v1.70.0
UsernameResolver works out the database username of the principal a token source speaks for. A user's token names its email; a service account's names only its unique ID, which the IAM API turns into the email.
func NewUsernameResolver ¶ added in v1.70.0
func NewUsernameResolver() *UsernameResolver
func (*UsernameResolver) Resolve ¶ added in v1.70.0
func (r *UsernameResolver) Resolve(ctx context.Context, tokenSource token_source.TokenSource) (string, error)
Source Files
Directories