[Java] Support dynamic secret provider registration via SecretRegistrar - #39940
Open
shunping wants to merge 1 commit into
Open
[Java] Support dynamic secret provider registration via SecretRegistrar#39940shunping wants to merge 1 commit into
shunping wants to merge 1 commit into
Conversation
shunping
changed the title
shunping
force-pushed
the
secret-manager-4
branch
2 times, most recently
from
September 1, 2026 02:33
23d91d2 to
2f5bde7
Compare
Follow the FileSystems registration pattern by introducing SecretRegistrar SPI and auto-service discovery in Secret.java. This eliminates hardcoded secret provider logic in Secret.java and allows modular extension for new secret managers.
shunping
force-pushed
the
secret-manager-4
branch
from
September 1, 2026 16:05
2f5bde7 to
47e95fd
Compare
shunping
changed the title
shunping
marked this pull request as ready for review
September 1, 2026 16:13
Collaborator
Author
|
r: @Abacn |
Contributor
|
Stopping reviewer notifications for this pull request: review requested by someone other than the bot, ceding control. If you'd like to restart, comment |
Abacn
reviewed
Sep 1, 2026
|
|
||
| /** {@link AutoService} registrar for the {@link GcpSecret}. */ | ||
| @AutoService(SecretRegistrar.class) | ||
| public class GcpSecretRegistrar implements SecretRegistrar { |
Contributor
There was a problem hiding this comment.
Unlike current on-request logic, autoService is loaded in JVM. Shall we move Gcp... classes into extensions/gcp-core module?
Then users not using GCP services or Dataflow runners won't see the service get loaded.
Collaborator
Author
There was a problem hiding this comment.
Yes. I am preparing a follow-up PR for this, because there are a bunch of gbek tests that need to be relocated as well.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Previously,
Secret.javahad hardcoded switch statements and factory calls for specific secret managers (such as Google Cloud Secret Manager and HSM-generated secrets). Supporting a new secret manager required directly modifying Secret.java.This PR refactors Secret to follow Apache Beam's standard Service Provider Interface (SPI) pattern (similar to
FileSystems/FileSystemRegistrar). It allows secret providers to register dynamically at runtime viaServiceLoaderand@AutoService, decoupling the core Secret management from specific provider implementations.