Skip to content

feat(google-auth): grpc cert rotation handling#16597

Draft
agrawalradhika-cell wants to merge 9 commits intogoogleapis:mainfrom
agrawalradhika-cell:agrawalradhika-cell-patch-1
Draft

feat(google-auth): grpc cert rotation handling#16597
agrawalradhika-cell wants to merge 9 commits intogoogleapis:mainfrom
agrawalradhika-cell:agrawalradhika-cell-patch-1

Conversation

@agrawalradhika-cell
Copy link
Copy Markdown
Contributor

Thank you for opening a Pull Request! Before submitting your PR, there are a few things you can do to make sure it goes smoothly:

  • Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
  • Ensure the tests and linter pass
  • Code coverage does not decrease (if any source code was changed)
  • Appropriate docs were updated (if necessary)

Fixes #<issue_number_goes_here> 🦕

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces a mechanism for mTLS certificate rotation in gRPC channels by implementing a refreshing channel wrapper and a call interceptor. The review identified several issues: a missing logger definition causing potential runtime errors, a typo in a variable name, redundant parameters in the interceptor, the use of print statements instead of logging, and a lack of support for non-unary gRPC call types and context manager patterns.

"""Indicates if the created SSL channel credentials is mutual TLS."""
return self._is_mtls

class _MTLSCallInterceptor(grpc.UnaryUnaryClientInterceptor):
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The _MTLSCallInterceptor currently only implements intercept_unary_unary. To fully support certificate rotation for all gRPC call types, it should also implement intercept_unary_stream, intercept_stream_unary, and intercept_stream_stream.

Comment on lines +405 to +410
def __init__(self, target, factory_args, initial_channel, initial_cert):
self._target = target
self._factory_args = factory_args
self._channel = initial_channel
self._cached_cert = initial_cert
self._lock = threading.Lock()
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

_MTLSRefreshingChannel should implement __enter__ and __exit__ to support being used as a context manager, which is a standard pattern for gRPC channels.

    def __init__(self, target, factory_args, initial_channel, initial_cert):
        self._target = target
        self._factory_args = factory_args
        self._channel = initial_channel
        self._cached_cert = initial_cert
        self._lock = threading.Lock()

    def __enter__(self):
        return self

    def __exit__(self, exc_type, exc_val, exc_tb):
        self.close()

agrawalradhika-cell and others added 5 commits April 9, 2026 14:12
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
@parthea parthea changed the title feat: grpc cert rotation handling feat(google-auth): grpc cert rotation handling Apr 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant