feat: add TLS/mTLS support for experimental host (#1479) · googleapis/google-cloud-python@0c4c5da

@@ -50,7 +50,10 @@

5050

from google.cloud.spanner_v1 import __version__

5151

from google.cloud.spanner_v1 import ExecuteSqlRequest

5252

from google.cloud.spanner_v1 import DefaultTransactionOptions

53-

from google.cloud.spanner_v1._helpers import _merge_query_options

53+

from google.cloud.spanner_v1._helpers import (

54+

_create_experimental_host_transport,

55+

_merge_query_options,

56+

)

5457

from google.cloud.spanner_v1._helpers import _metadata_with_prefix

5558

from google.cloud.spanner_v1.instance import Instance

5659

from google.cloud.spanner_v1.metrics.constants import (

@@ -227,6 +230,30 @@ class Client(ClientWithProject):

227230228231

:raises: :class:`ValueError <exceptions.ValueError>` if both ``read_only``

229232

and ``admin`` are :data:`True`

233+234+

:type use_plain_text: bool

235+

:param use_plain_text: (Optional) Whether to use plain text for the connection.

236+

This is intended only for experimental host spanner endpoints.

237+

If set, this will override the `api_endpoint` in `client_options`.

238+

If not set, the default behavior is to use TLS.

239+240+

:type ca_certificate: str

241+

:param ca_certificate: (Optional) The path to the CA certificate file used for TLS connection.

242+

This is intended only for experimental host spanner endpoints.

243+

If set, this will override the `api_endpoint` in `client_options`.

244+

This is mandatory if the experimental_host requires a TLS connection.

245+246+

:type client_certificate: str

247+

:param client_certificate: (Optional) The path to the client certificate file used for mTLS connection.

248+

This is intended only for experimental host spanner endpoints.

249+

If set, this will override the `api_endpoint` in `client_options`.

250+

This is mandatory if the experimental_host requires a mTLS connection.

251+252+

:type client_key: str

253+

:param client_key: (Optional) The path to the client key file used for mTLS connection.

254+

This is intended only for experimental host spanner endpoints.

255+

If set, this will override the `api_endpoint` in `client_options`.

256+

This is mandatory if the experimental_host requires a mTLS connection.

230257

"""

231258232259

_instance_admin_api = None

@@ -251,6 +278,10 @@ def __init__(

251278

default_transaction_options: Optional[DefaultTransactionOptions] = None,

252279

experimental_host=None,

253280

disable_builtin_metrics=False,

281+

use_plain_text=False,

282+

ca_certificate=None,

283+

client_certificate=None,

284+

client_key=None,

254285

):

255286

self._emulator_host = _get_spanner_emulator_host()

256287

self._experimental_host = experimental_host

@@ -265,6 +296,12 @@ def __init__(

265296

if self._emulator_host:

266297

credentials = AnonymousCredentials()

267298

elif self._experimental_host:

299+

# For all experimental host endpoints project is default

300+

project = "default"

301+

self._use_plain_text = use_plain_text

302+

self._ca_certificate = ca_certificate

303+

self._client_certificate = client_certificate

304+

self._client_key = client_key

268305

credentials = AnonymousCredentials()

269306

elif isinstance(credentials, AnonymousCredentials):

270307

self._emulator_host = self._client_options.api_endpoint

@@ -361,8 +398,13 @@ def instance_admin_api(self):

361398

transport=transport,

362399

)

363400

elif self._experimental_host:

364-

transport = InstanceAdminGrpcTransport(

365-

channel=grpc.insecure_channel(target=self._experimental_host)

401+

transport = _create_experimental_host_transport(

402+

InstanceAdminGrpcTransport,

403+

self._experimental_host,

404+

self._use_plain_text,

405+

self._ca_certificate,

406+

self._client_certificate,

407+

self._client_key,

366408

)

367409

self._instance_admin_api = InstanceAdminClient(

368410

client_info=self._client_info,

@@ -391,8 +433,13 @@ def database_admin_api(self):

391433

transport=transport,

392434

)

393435

elif self._experimental_host:

394-

transport = DatabaseAdminGrpcTransport(

395-

channel=grpc.insecure_channel(target=self._experimental_host)

436+

transport = _create_experimental_host_transport(

437+

DatabaseAdminGrpcTransport,

438+

self._experimental_host,

439+

self._use_plain_text,

440+

self._ca_certificate,

441+

self._client_certificate,

442+

self._client_key,

396443

)

397444

self._database_admin_api = DatabaseAdminClient(

398445

client_info=self._client_info,

@@ -539,7 +586,6 @@ def instance(

539586

self._emulator_host,

540587

labels,

541588

processing_units,

542-

self._experimental_host,

543589

)

544590545591

def list_instances(self, filter_="", page_size=None):