Groovy / Maven

Use Google Secret Manager to Store MySQL Credentials

Learn how to use Google Secret Manager.

John Shingler
On this guide
In this section

Getting Started

In this guide, we will create a Micronaut application written in Groovy.

This guide demonstrates how to use Google Secret Manager to store the configuration for a Micronaut Data JDBC application.

Instead of storing the database URL, username, and password in plaintext or environment variables, use a secret manager. A secret manager provides a convenient way to store API keys, passwords, certificates, and other sensitive data while improving security.

What you will need

To complete this guide, you will need the following:

Costs

Warning
 This guide uses paid services; you may need to enable Billing in Google Cloud to complete some steps in this guide.

Google Cloud Platform

Signup for the Google Cloud Platform

Cloud SDK

Install the Cloud SDK CLI for your operating system.

Cloud SDK includes the gcloud command-line tool. Run the init command in your terminal:

gcloud init

Log in to your Google Cloud Platform:

gcloud auth login

Google Cloud Platform Project

Create a new project with a unique name (replace xxxxxx with alphanumeric characters of your choice):

gcloud projects create micronaut-guides-xxxxxx
Note
 In GCP, project ids are globally unique, so the id you used above is the one you should use in the rest of this guide.

Change your project:

gcloud config set project micronaut-guides-xxxxxx

If you forget the project id, you can list all projects:

gcloud projects list

Creating the Application

Download the complete solution of the guide.

This guide is a companion to either the above guide or the .

Dependencies

Update the Application to use Google’s Secret Manager

The micronaut-gcp subproject provides integration between Micronaut apps and the Google Cloud, including using Secret Manager as a distributed configuration source.

Add the following dependency to your build:

pom.xml
<dependency>
    <groupId>io.micronaut.gcp</groupId>
    <artifactId>micronaut-gcp-secret-manager</artifactId>
    <scope>compile</scope>
</dependency>
Note
 Native compile requires a supplemental library. See Micronaut GCP: Generating Native Executables for instructions on adding it to your build.

Micronaut Framework reads distributed configuration, such as secrets, at startup, but needs to be instructed to do so.

Distributed Configuration

Enable Distributed Configuration

Create a bootstrap.properties file in the resources directory to enable distributed configuration. Add the following:

src/main/resources/bootstrap.properties
micronaut.application.name=micronautguide 
micronaut.config-client.enabled=true
1 Set the application name in bootstrap.properties instead of application.properties so that it is available when reading configuration from distributed sources.

properties <2> Set micronaut.config-client.enabled=true which is used to read and resolve configuration from distributed sources.

Clean up Application Configuration

If application.properties sets micronaut.application.name, remove it. You moved it to bootstrap.properties.

src/main/resources/application.properties
micronaut.application.name=micronautguide

Disable Distributed Configuration for Test

You can disable distributed configuration in a test by annotating a test with:

@Property(name = "micronaut.config-client.enabled", value = StringUtils.FALSE)
@MicronautTest

Google’s Secret Manager

Move JDBC URL, username, and password from the application configuration

Create a file named datasource-info.yml in the project root directory, or elsewhere on your filesystem, to contain the JDBC connection information.

Tip

Do not add this file to source control, since it contains sensitive information.

Add the following:

datasource-info.yml
datasources:
  default:
    url: <JDBC_URL>
    username: <USER_NAME>
    password: <USER_PASSWORD>

Examples of datasource-info.yml

Docker MySQL configuration example for 
datasources:
  default:
    url: jdbc:mysql://localhost:3306/db
    username: root
    password: ''
Google Cloud MySQL configuration example for 
datasources:
  default:
    url: jdbc:mysql://34.xxx.xxx.65:3306/demo
    username: jdbcUser
    password: userSecretPassword

Clean up the application configuration

Remove the following from the application.properties.

src/main/resources/application.properties
- micronaut.application.name=micronautguide
- datasources.default.url=${JDBC_URL:`jdbc:mysql://localhost:3306/db`}
- datasources.default.username=${JDBC_USER:root}
- datasources.default.password=${JDBC_PASSWORD:}
datasources.default.dialect=MYSQL
datasources.default.driver-class-name=${JDBC_DRIVER:com.mysql.cj.jdbc.Driver}
flyway.datasources.default.enabled=true

Add Configurations to Google Secret Manager

Add the new datasource-info.yml configuration file to the secret manager.

gcloud secrets create application \
  --data-file=path/to/datasource-info.yml
Note

You might be prompted to enable the Google Secret Manager API:

API [secretmanager.googleapis.com] not enabled on project [<project-id>].

Would you like to enable and retry (this will take a few minutes)? (y/N)?

See the "Configuration file resolution" section of Google Cloud Secret Manager Support for the built-in and manually configured ways that configuration files can use names other than application.

Standalone Secret (Optional)

In many cases, you might need only a secret key and value in your application. This is helpful when something changes often or differs per environment.

With Google Secret Manager you can:

  1. Create a file that just contains the password, like above.

  2. Use the Google Cloud Console to add the secret.

  3. Add a secret directly on the command line, but this is discouraged because the plaintext will appear in your shell history.

For this example, let’s move the user’s password to its own secret, using option 3.

On Linux and Mac:

printf "<PASSWORD>" | gcloud secrets create jdbc_password --data-file=-

On Windows:

Write-Output "<PASSWORD>" | gcloud secrets create my-secret --data-file=-
Warning

All line breaks and leading and trailing whitespace are stripped from the secret at runtime.

Add the following to the bootstrap.properties

src/main/resources/bootstrap.properties
gcp.secret-manager.keys[0]=jdbc_password

This is needed because Google Secret Manager does not offer a hierarchical approach. Therefore, you need to tell the application which keys to read.

The secret jdbc_password will be mapped to the property sm.jdbc.password and can be used with @Property(name="sm.jdbc.password") within the application.

Update the datasource-info.yml file to:

datasource-info.yml
datasources:
  default:
    url: <JDBC_URL>
    username: <USER_NAME>
    password: ${sm.jdbc.password}

Finally, update the secret.

gcloud secrets versions add application \
  --data-file=path/to/datasource-info.yml

Fix Test Configurations

Distributed configuration has a higher precedence than application configuration found in application_<env>.properties. If you tested the application now, the data source configuration in Google Secret Manager would be used instead of the Testcontainers configuration in application_test.properties.

With Secret Manager:

Add application-test.properties to secret manager:

gcloud secrets create application_test \
  --data-file=src/test/resources/application-test.properties
Without Secret Manager:

Create a bootstrap-test.properties file or rename application_test.properties to bootstrap-test.properties and add:

src/test/resources/bootstrap_test.properties
micronaut.config-client.enabled=true

Running the Application

To run the application, use the ./mvnw mn:run command, which starts the application on port 8080.

Note

You might get this error message when running your application:
"Message: The Application Default Credentials are not available. They are available if running in Google Compute Engine. Otherwise, the environment variable GOOGLE_APPLICATION_CREDENTIALS must be defined pointing to a file defining the credentials. See https://developers.google.com/accounts/docs/application-default-credentials for more information."

If you are developing locally you can do:

gcloud auth application-default login

However, it is strongly recommended that you set up a service account. Follow the instructions in the link above and Micronaut GCP setup instructions for creating and configuring the service account.

You can test the application in a web browser or with cURL.

Run from a terminal window to create a Genre:

curl -X "POST" "http://localhost:8080/genres" \
     -H 'Content-Type: application/json; charset=utf-8' \
     -d $'{ "name": "music" }'

and run this to list the genres:

curl http://localhost:8080/genres/list

Cleaning Up

After you’ve finished this guide, you can clean up the resources you created on Google Cloud Platform so you won’t be billed for them in the future. The following sections describe how to delete or turn off these resources.

Deleting the project

The easiest way to eliminate billing is to delete the project you created for the tutorial.

Warning

Deleting a project has the following consequences:

  • If you used an existing project, you’ll also delete any other work you’ve done in the project.

  • You can’t reuse the project ID of a deleted project. If you created a custom project ID that you plan to use in the future, you should delete the resources inside the project instead. This ensures that URLs that use the project ID, such as an appspot.com URL, remain available.

  • If you are exploring multiple tutorials and quickstarts, reusing projects instead of deleting them prevents you from exceeding project quota limits.

Via the CLI

To delete the project using the Cloud SDK, run the following command, replacing YOUR_PROJECT_ID with the project ID:

gcloud projects delete YOUR_PROJECT_ID

Via the Cloud Platform Console

In the Cloud Platform Console, go to the Projects page.

In the project list, select the project you want to delete and click Delete project. After selecting the checkbox next to the project name, click Delete project

In the dialog, type the project ID, and then click Shut down to delete the project.

Deleting or turning off specific resources

You can individually delete or turn off some of the resources that you created during the tutorial.

Next Steps

Read more about Micronaut Data.

Read more about Micronaut GCP integration.

License

Note
 All guides are released with an Apache License 2.0 for the code and a Creative Commons Attribution 4.0 license for the writing and media (images).