mirror of
https://github.com/agent-substrate/substrate.git
synced 2026-11-10 10:13:50 +08:00
shrutiyam-glitch
616fd83431
### Description This PR introduces native, secure support for using Cloud SQL as the PostgreSQL store backend for `ate-api-server`. To ensure the highest level of security and ease of use in GCP environments, this integration leverages the Cloud SQL Auth Proxy sidecar with automatic IAM database authentication. This means transport security (TLS 1.3 tunnel) is handled automatically, and database sessions are authenticated using Workload Identity via short-lived OAuth tokens, completely eliminating the need for database passwords. ### Key Changes * **Cloud SQL Auth Proxy Sidecar:** Added `manifests/ate-install/cloudsql-proxy-patch.yaml` to patch the sidecar into the `ate-api-server` deployment when a Cloud SQL instance is configured. * **Automated Provisioning:** Extended `tools/setup-gcp` with a new `cloudsql` command. This handles the idempotent creation of the Cloud SQL instance, Google Service Accounts (GSA), IAM bindings, and Workload Identity bindings. * **Installation Script Updates:** Updated `hack/install-ate.sh` to parse new environment variables (e.g., `ATE_API_POSTGRES_CLOUDSQL_INSTANCE`, `ATE_API_POSTGRES_CLOUDSQL_GSA`) and correctly synthesize the passwordless DSN and ConfigMaps for the proxy. * **Security & Documentation:** * Added extensive documentation in `tools/setup-gcp/cloud-sql.md` covering provisioning, schema privileges, deployment, and database scaling. * Updated `docs/threat-model.md` to reflect the new Cloud SQL egress flows and Auth Proxy tunnel mechanics. * **Dependencies:** Vendored required Google API clients (`sqladmin/v1`, `servicenetworking/v1`, `iam/v1`) for the GCP setup tool. - [X] Tests pass - [X] Appropriate changes to documentation are included in the PR