Skip to content

feat: Auto enable mTLS when supported certificates are detected #869

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
daniel-sanche merged 5 commits into from
Dec 5, 2025
+37 −11
Merged

feat: Auto enable mTLS when supported certificates are detected #869

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
633ab62
feat: Auto enable mTLS when supported certificates are detected
agrawalradhika-cell Nov 21, 2025
da0747c
fix: fix lint errors
agrawalradhika-cell Dec 1, 2025
56dc762
fix: Update tests for coverage of all branches
agrawalradhika-cell Dec 3, 2025
8bfc4ba
fix: fix the lint errors existing
agrawalradhika-cell Dec 3, 2025
4cb55e0
chore: Update comments on test and update google.auth check to be don…
agrawalradhika-cell Dec 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 14 additions & 8 deletions google/api_core/operations_v1/abstract_operations_base_client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -300,16 +300,22 @@ def __init__(
client_options = client_options_lib.ClientOptions()

# Create SSL credentials for mutual TLS if needed.
use_client_cert = os.getenv(
"GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
).lower()
if use_client_cert not in ("true", "false"):
raise ValueError(
"Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`"
)
if hasattr(mtls, "should_use_client_cert"):
use_client_cert = mtls.should_use_client_cert()
else:
# if unsupported, fallback to reading from env var
use_client_cert_str = os.getenv(
"GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
).lower()
if use_client_cert_str not in ("true", "false"):
raise ValueError(
"Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be"
" either `true` or `false`"
)
use_client_cert = use_client_cert_str == "true"
client_cert_source_func = None
is_mtls = False
if use_client_cert == "true":
if use_client_cert:
if client_options.client_cert_source:
is_mtls = True
client_cert_source_func = client_options.client_cert_source
Expand Down
15 changes: 12 additions & 3 deletions tests/unit/operations_v1/test_operations_rest_client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -346,12 +346,21 @@ def test_operations_client_client_options(
with pytest.raises(MutualTLSChannelError):
client = client_class()

# Check the case GOOGLE_API_USE_CLIENT_CERTIFICATE has unsupported value.
# Check the case GOOGLE_API_USE_CLIENT_CERTIFICATE has unsupported value and
# should_use_client_cert is unavailable.
with mock.patch.dict(
os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "Unsupported"}
):
with pytest.raises(ValueError):
client = client_class()
if not hasattr(google.auth.transport.mtls, "should_use_client_cert"):
with pytest.raises(ValueError):
client = client_class()
else:
with mock.patch.object(transport_class, "__init__") as patched:
patched.return_value = None
client = client_class(
credentials=ga_credentials.AnonymousCredentials(),
transport=transport_name,
)

# Check the case quota_project_id is provided
options = client_options.ClientOptions(quota_project_id="octopus")
Expand Down
Loading