From 89ac6284288bfc8429dc9b25c55bcfbc140acd7b Mon Sep 17 00:00:00 2001 From: adityawalvekar Date: Thu, 9 Apr 2026 16:34:50 +0530 Subject: [PATCH] Review comments - Add info in error messages --- internal/credential/rotate.go | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/internal/credential/rotate.go b/internal/credential/rotate.go index f8115fa..2311834 100644 --- a/internal/credential/rotate.go +++ b/internal/credential/rotate.go @@ -90,12 +90,12 @@ func (c *Config) RotateServiceAccountKey( clientOptions := []option.ClientOption{option.WithTokenSource(creds.TokenSource)} clientOptions = append(clientOptions, opts...) - iamClient, err := admin.NewIamClient(ctx, clientOptions...) + currentIAMClient, err := admin.NewIamClient(ctx, clientOptions...) if err != nil { return status.Errorf(codes.Internal, "error creating IAM client: %v", err) } - createServiceAccountKeyRes, err := iamClient.CreateServiceAccountKey(ctx, &adminpb.CreateServiceAccountKeyRequest{ + createServiceAccountKeyRes, err := currentIAMClient.CreateServiceAccountKey(ctx, &adminpb.CreateServiceAccountKeyRequest{ Name: fmt.Sprintf("projects/%s/serviceAccounts/%s", c.ProjectId, c.ClientEmail), PrivateKeyType: adminpb.ServiceAccountPrivateKeyType_TYPE_GOOGLE_CREDENTIALS_FILE, KeyAlgorithm: adminpb.ServiceAccountKeyAlgorithm_KEY_ALG_RSA_2048, @@ -129,33 +129,33 @@ func (c *Config) RotateServiceAccountKey( err = newConfig.ValidateServiceAccountKey(ctx, permissions, validateCredsCallback, clientOptions...) if err != nil { // Roll back the new key if validation fails. - rollbackErr := iamClient.DeleteServiceAccountKey(ctx, &adminpb.DeleteServiceAccountKeyRequest{ + rollbackErr := currentIAMClient.DeleteServiceAccountKey(ctx, &adminpb.DeleteServiceAccountKeyRequest{ Name: fmt.Sprintf("projects/%s/serviceAccounts/%s/keys/%s", newConfig.ProjectId, newConfig.ClientEmail, newConfig.PrivateKeyId), }) if rollbackErr != nil { - return status.Errorf(codes.PermissionDenied, "error validating rotated service account key: %v; error rolling back newly created service account key: %v", err, rollbackErr) + return status.Errorf(codes.PermissionDenied, "error validating rotated service account key: %v; error rolling back newly created service account key: %v; service account may have multiple active keys", err, rollbackErr) } return status.Errorf(codes.PermissionDenied, "error validating rotated service account key: %v; successfully rolled back newly created service account key", err) } - newClient, err := admin.NewIamClient(ctx, clientOptions...) + newIAMClient, err := admin.NewIamClient(ctx, clientOptions...) if err != nil { return status.Errorf(codes.Internal, "error creating IAM client with rotated service account key: %v", err) } - err = newClient.DeleteServiceAccountKey(ctx, &adminpb.DeleteServiceAccountKeyRequest{ + err = newIAMClient.DeleteServiceAccountKey(ctx, &adminpb.DeleteServiceAccountKeyRequest{ Name: fmt.Sprintf("projects/%s/serviceAccounts/%s/keys/%s", c.ProjectId, c.ClientEmail, c.PrivateKeyId), }) // If deletion of the old key fails, attempt to delete the new key to avoid leaving a dangling key, then return an error. if err != nil { // delete the new key using old client since the new client may not have permissions that the old client has. - rollbackErr := iamClient.DeleteServiceAccountKey(ctx, &adminpb.DeleteServiceAccountKeyRequest{ + rollbackErr := currentIAMClient.DeleteServiceAccountKey(ctx, &adminpb.DeleteServiceAccountKeyRequest{ Name: fmt.Sprintf("projects/%s/serviceAccounts/%s/keys/%s", newConfig.ProjectId, newConfig.ClientEmail, newConfig.PrivateKeyId), }) // If rollback also fails, return an error indicating both the failure to delete the old key and the failure to roll back the new key. if rollbackErr != nil { - return status.Errorf(codes.Internal, "error deleting service account key: %v; error rolling back newly created service account key: %v", err, rollbackErr) + return status.Errorf(codes.Internal, "error deleting service account key: %v; error rolling back newly created service account key: %v; service account may have multiple active keys", err, rollbackErr) } return status.Errorf(codes.Internal, "error deleting service account key: %v; successfully rolled back newly created service account key", err)