feat: add TLS/mTLS support for experimental host (#1479) · googleapis/google-cloud-python@0c4c5da
@@ -50,7 +50,10 @@
5050from google.cloud.spanner_v1 import __version__
5151from google.cloud.spanner_v1 import ExecuteSqlRequest
5252from google.cloud.spanner_v1 import DefaultTransactionOptions
53-from google.cloud.spanner_v1._helpers import _merge_query_options
53+from google.cloud.spanner_v1._helpers import (
54+_create_experimental_host_transport,
55+_merge_query_options,
56+)
5457from google.cloud.spanner_v1._helpers import _metadata_with_prefix
5558from google.cloud.spanner_v1.instance import Instance
5659from google.cloud.spanner_v1.metrics.constants import (
@@ -227,6 +230,30 @@ class Client(ClientWithProject):
227230228231 :raises: :class:`ValueError <exceptions.ValueError>` if both ``read_only``
229232 and ``admin`` are :data:`True`
233+234+ :type use_plain_text: bool
235+ :param use_plain_text: (Optional) Whether to use plain text for the connection.
236+ This is intended only for experimental host spanner endpoints.
237+ If set, this will override the `api_endpoint` in `client_options`.
238+ If not set, the default behavior is to use TLS.
239+240+ :type ca_certificate: str
241+ :param ca_certificate: (Optional) The path to the CA certificate file used for TLS connection.
242+ This is intended only for experimental host spanner endpoints.
243+ If set, this will override the `api_endpoint` in `client_options`.
244+ This is mandatory if the experimental_host requires a TLS connection.
245+246+ :type client_certificate: str
247+ :param client_certificate: (Optional) The path to the client certificate file used for mTLS connection.
248+ This is intended only for experimental host spanner endpoints.
249+ If set, this will override the `api_endpoint` in `client_options`.
250+ This is mandatory if the experimental_host requires a mTLS connection.
251+252+ :type client_key: str
253+ :param client_key: (Optional) The path to the client key file used for mTLS connection.
254+ This is intended only for experimental host spanner endpoints.
255+ If set, this will override the `api_endpoint` in `client_options`.
256+ This is mandatory if the experimental_host requires a mTLS connection.
230257 """
231258232259_instance_admin_api = None
@@ -251,6 +278,10 @@ def __init__(
251278default_transaction_options: Optional[DefaultTransactionOptions] = None,
252279experimental_host=None,
253280disable_builtin_metrics=False,
281+use_plain_text=False,
282+ca_certificate=None,
283+client_certificate=None,
284+client_key=None,
254285 ):
255286self._emulator_host = _get_spanner_emulator_host()
256287self._experimental_host = experimental_host
@@ -265,6 +296,12 @@ def __init__(
265296if self._emulator_host:
266297credentials = AnonymousCredentials()
267298elif self._experimental_host:
299+# For all experimental host endpoints project is default
300+project = "default"
301+self._use_plain_text = use_plain_text
302+self._ca_certificate = ca_certificate
303+self._client_certificate = client_certificate
304+self._client_key = client_key
268305credentials = AnonymousCredentials()
269306elif isinstance(credentials, AnonymousCredentials):
270307self._emulator_host = self._client_options.api_endpoint
@@ -361,8 +398,13 @@ def instance_admin_api(self):
361398transport=transport,
362399 )
363400elif self._experimental_host:
364-transport = InstanceAdminGrpcTransport(
365-channel=grpc.insecure_channel(target=self._experimental_host)
401+transport = _create_experimental_host_transport(
402+InstanceAdminGrpcTransport,
403+self._experimental_host,
404+self._use_plain_text,
405+self._ca_certificate,
406+self._client_certificate,
407+self._client_key,
366408 )
367409self._instance_admin_api = InstanceAdminClient(
368410client_info=self._client_info,
@@ -391,8 +433,13 @@ def database_admin_api(self):
391433transport=transport,
392434 )
393435elif self._experimental_host:
394-transport = DatabaseAdminGrpcTransport(
395-channel=grpc.insecure_channel(target=self._experimental_host)
436+transport = _create_experimental_host_transport(
437+DatabaseAdminGrpcTransport,
438+self._experimental_host,
439+self._use_plain_text,
440+self._ca_certificate,
441+self._client_certificate,
442+self._client_key,
396443 )
397444self._database_admin_api = DatabaseAdminClient(
398445client_info=self._client_info,
@@ -539,7 +586,6 @@ def instance(
539586self._emulator_host,
540587labels,
541588processing_units,
542-self._experimental_host,
543589 )
544590545591def list_instances(self, filter_="", page_size=None):