fix(gcp): surface GCP Secret Manager errors and validate DB credentials

model-engine/model_engine_server/api/dependencies.py

@@ -202,10 +202,13 @@ def get_monitoring_metrics_gateway() -> MonitoringMetricsGateway:
         )
 
         return get_custom_monitoring_metrics_gateway()
-    except ModuleNotFoundError:
+    except ModuleNotFoundError as e:
+        if e.name is None or not e.name.startswith("plugins"):
+            raise
+        logger.warning(
+            "plugins module not found, falling back to default monitoring metrics gateway"
+        )
         return get_default_monitoring_metrics_gateway()
-    finally:
-        pass
 
 
 def _get_external_interfaces(
@@ -453,7 +456,10 @@ async def get_external_interfaces():
         from plugins.dependencies import get_external_interfaces as get_custom_external_interfaces
 
         ei = get_custom_external_interfaces()
-    except ModuleNotFoundError:
+    except ModuleNotFoundError as e:
+        if e.name is None or not e.name.startswith("plugins"):
+            raise
+        logger.warning("plugins module not found, falling back to default external interfaces")
         ei = get_default_external_interfaces()
     try:
         yield ei
@@ -468,7 +474,12 @@ async def get_external_interfaces_read_only():
         )
 
         ei = get_custom_external_interfaces_read_only()
-    except ModuleNotFoundError:
+    except ModuleNotFoundError as e:
+        if e.name is None or not e.name.startswith("plugins"):
+            raise
+        logger.warning(
+            "plugins module not found, falling back to default external interfaces (read-only)"
+        )
         ei = get_default_external_interfaces_read_only()
     try:
         yield ei
@@ -489,10 +500,11 @@ async def get_auth_repository():
         from plugins.dependencies import get_auth_repository as get_custom_auth_repository
 
         yield get_custom_auth_repository()
-    except ModuleNotFoundError:
+    except ModuleNotFoundError as e:
+        if e.name is None or not e.name.startswith("plugins"):
+            raise
+        logger.warning("plugins module not found, falling back to default auth repository")
         yield get_default_auth_repository()
-    finally:
-        pass
 
 
 async def verify_authentication(

model-engine/model_engine_server/core/gcp/secrets.py

@@ -23,10 +23,5 @@ def get_key_file(secret_name: str, gcp_project: Optional[str] = None):
     if gcp_project is not None:
         secret_name = f"projects/{gcp_project}/secrets/{secret_name}/versions/latest"
     client = secretmanager.SecretManagerServiceClient()
-    try:
-        response = client.access_secret_version(name=secret_name)
-        return json.loads(response.payload.data.decode("utf-8"))
-    except Exception as e:
-        logger.error(e)
-        logger.error(f"Failed to retrieve secret: {secret_name}")
-        return {}
+    response = client.access_secret_version(name=secret_name)
+    return json.loads(response.payload.data.decode("utf-8"))

model-engine/model_engine_server/db/base.py

@@ -76,11 +76,24 @@ def get_engine_url(
 
                 db_secret_gcp_project_id = os.environ.get("DB_SECRET_GCP_PROJECT_ID")
                 creds = get_gcp_key_file(db_secret_name, db_secret_gcp_project_id)
-                user = creds.get("username")
-                password = creds.get("password")
-                host = creds.get("clusterHostRo") if read_only else creds.get("clusterHost")
-                port = str(creds.get("port"))
-                dbname = creds.get("dbname")
+                missing = [
+                    k
+                    for k in ("username", "password", "clusterHost", "port", "dbname")
+                    if not creds.get(k)
+                ]
+                if missing:
+                    raise ValueError(
+                        f"GCP DB secret {db_secret_name!r} is missing required fields: {missing}"
+                    )
+                user = creds["username"]
+                password = creds["password"]
+                host = (
+                    creds.get("clusterHostRo") or creds["clusterHost"]
+                    if read_only
+                    else creds["clusterHost"]
+                )
+                port = str(creds["port"])
+                dbname = creds["dbname"]
             else:
                 user = os.environ.get("DB_USER", "postgres")
                 password = os.environ.get("DB_PASSWORD", "postgres")