@@ -13,9 +13,12 @@ from google.api_core import gapic_v1 # type: ignore
13
13
from google.api_core import retry as retries # type: ignore
14
14
from google.auth import credentials # type: ignore
15
15
from google.auth.transport import mtls # type: ignore
16
+ from google.auth.transport.grpc import SslCredentials # type: ignore
16
17
from google.auth.exceptions import MutualTLSChannelError # type: ignore
17
18
from google.oauth2 import service_account # type: ignore
18
19
20
+ import grpc # type: ignore
21
+
19
22
{% filter sort_lines -%}
20
23
{% for method in service .methods .values () -%}
21
24
{% for ref_type in method .flat_ref_types -%}
@@ -151,16 +154,19 @@ class {{ service.client_name }}(metaclass={{ service.client_name }}Meta):
151
154
client_options (ClientOptions): Custom options for the client. It
152
155
won't take effect unless ``transport`` is None.
153
156
(1) The ``api_endpoint`` property can be used to override the
154
- default endpoint provided by the client. GOOGLE_API_USE_MTLS
157
+ default endpoint provided by the client. GOOGLE_API_USE_MTLS_ENDPOINT
155
158
environment variable can also be used to override the endpoint:
156
159
"always" (always use the default mTLS endpoint), "never" (always
157
- use the default regular endpoint, this is the default value for
158
- the environment variable) and "auto" (auto switch to the default
159
- mTLS endpoint if client SSL credentials is present). However,
160
- the ``api_endpoint`` property takes precedence if provided.
161
- (2) The ``client_cert_source`` property is used to provide client
162
- SSL credentials for mutual TLS transport. If not provided, the
163
- default SSL credentials will be used if present.
160
+ use the default regular endpoint) and "auto" (auto switch to the
161
+ default mTLS endpoint if client certificate is present, this is
162
+ the default value). However, the ``api_endpoint`` property takes
163
+ precedence if provided.
164
+ (2) If GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable
165
+ is "true", then the ``client_cert_source`` property can be used
166
+ to provide client certificate for mutual TLS transport. If
167
+ not provided, the default SSL client certificate will be used if
168
+ present. If GOOGLE_API_USE_CLIENT_CERTIFICATE is "false" or not
169
+ set, no client certificate will be used.
164
170
client_info (google.api_core.gapic_v1.client_info.ClientInfo):
165
171
The client info used to send a user-agent string along with
166
172
API requests. If ``None``, then default info will be used.
@@ -175,24 +181,42 @@ class {{ service.client_name }}(metaclass={{ service.client_name }}Meta):
175
181
client_options = ClientOptions.from_dict(client_options)
176
182
if client_options is None:
177
183
client_options = ClientOptions.ClientOptions()
184
+
185
+ # Create SSL credentials for mutual TLS if needed.
186
+ use_client_cert = os.getenv("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false")
187
+ if not use_client_cert in ["true", "false"]:
188
+ raise MutualTLSChannelError(
189
+ "Unsupported GOOGLE_API_USE_CLIENT_CERTIFICATE value. Accepted values: true, false"
190
+ )
191
+
192
+ ssl_credentials = None
193
+ is_mtls = False
194
+ if use_client_cert == "true":
195
+ if client_options.client_cert_source:
196
+ cert, key = client_options.client_cert_source()
197
+ ssl_credentials = grpc.ssl_channel_credentials(
198
+ certificate_chain=cert, private_key=key
199
+ )
200
+ is_mtls = True
201
+ else:
202
+ creds = SslCredentials()
203
+ is_mtls = creds.is_mtls
204
+ ssl_credentials = creds.ssl_credentials if is_mtls else None
178
205
179
- if transport is None and client_options.api_endpoint is None:
180
- use_mtls_env = os.getenv("GOOGLE_API_USE_MTLS", "never")
206
+ # Figure out which api endpoint to use.
207
+ if client_options.api_endpoint is not None:
208
+ api_endpoint = client_options.api_endpoint
209
+ else:
210
+ use_mtls_env = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")
181
211
if use_mtls_env == "never":
182
- client_options. api_endpoint = self.DEFAULT_ENDPOINT
212
+ api_endpoint = self.DEFAULT_ENDPOINT
183
213
elif use_mtls_env == "always":
184
- client_options. api_endpoint = self.DEFAULT_MTLS_ENDPOINT
214
+ api_endpoint = self.DEFAULT_MTLS_ENDPOINT
185
215
elif use_mtls_env == "auto":
186
- has_client_cert_source = (
187
- client_options.client_cert_source is not None
188
- or mtls.has_default_client_cert_source()
189
- )
190
- client_options.api_endpoint = (
191
- self.DEFAULT_MTLS_ENDPOINT if has_client_cert_source else self.DEFAULT_ENDPOINT
192
- )
216
+ api_endpoint = self.DEFAULT_MTLS_ENDPOINT if is_mtls else self.DEFAULT_ENDPOINT
193
217
else:
194
218
raise MutualTLSChannelError(
195
- "Unsupported GOOGLE_API_USE_MTLS value. Accepted values: never, auto, always"
219
+ "Unsupported GOOGLE_API_USE_MTLS_ENDPOINT value. Accepted values: never, auto, always"
196
220
)
197
221
198
222
# Save or instantiate the transport.
@@ -212,9 +236,8 @@ class {{ service.client_name }}(metaclass={{ service.client_name }}Meta):
212
236
else:
213
237
self._transport = {{ service.name }}GrpcTransport(
214
238
credentials=credentials,
215
- host=client_options.api_endpoint,
216
- api_mtls_endpoint=client_options.api_endpoint,
217
- client_cert_source=client_options.client_cert_source,
239
+ host=api_endpoint,
240
+ ssl_channel_credentials=ssl_credentials,
218
241
client_info=client_info,
219
242
)
220
243
0 commit comments