google-auth: use auth.transport.requests as new default - #16091
Conversation
Sorry, something went wrong.
mTLS support was recently added and added a hard requirement for requests. google.auth.compute_engine would fail to load, if requests is missing, so its safe to switch to google.auth.transport.requests as new default here. Therefore switch default from google.auth.transport._http_client.Request() to google.auth.transport.requests.Request() which is required for mTLS to work. Broken since google-auth 2.44.0 and later. Fixes the following code: import google.auth credentials, project_id = google.auth.default() assert(project_id) Signed-off-by: Ulrich Weber <ulrich.weber@gmail.com>
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request updates the default HTTP transport mechanism within the google-auth library, specifically for obtaining credentials on Google Cloud Engine. The change is crucial for enabling mTLS support and resolves a regression where google.auth.default() would fail in certain GCE environments due to a dependency on the requests library. By switching to google.auth.transport.requests as the default, the library now correctly handles GCE metadata service connections and ensures robust authentication. Highlights
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here. Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
Sorry, something went wrong.
There was a problem hiding this comment.
Code Review
The pull request correctly switches the default transport for GCE credentials to requests, which is necessary for mTLS support. The changes are logical and well-contained. I've added one suggestion to improve the clarity of a log message in an error case, which will enhance the debugging experience for users.
Sorry, something went wrong.
| from google.auth.compute_engine import _metadata | ||
| from google.auth.transport.requests import Request | ||
| except ImportError: | ||
| _LOGGER.warning("Import of Compute Engine auth library failed.") |
There was a problem hiding this comment.
The current log message 'Import of Compute Engine auth library failed.' could be misleading if the failure is due to the requests library not being installed, which is now a dependency for GCE authentication. A more descriptive message would help users diagnose the problem more easily.
| _LOGGER.warning("Import of Compute Engine auth library failed.") | |
| _LOGGER.warning( | |
| "Import of GCE auth library failed. This may be because the " | |
| "`google-auth-library-python[gce]` extras are not installed or " | |
| "the `requests` library is missing." | |
| ) |
Sorry, something went wrong.
|
Sorry, looks like I duplicated some of this work in #16480. I'm going to close this in favor of the new one, since I also added some additional tests there. But I appreciate you putting this together |
Sorry, something went wrong.
mTLS support was recently added and added a hard requirement for requests. google.auth.compute_engine would fail to load, if requests is missing, so its safe to switch to google.auth.transport.requests as new default here.
Therefore switch default from google.auth.transport._http_client.Request() to google.auth.transport.requests.Request() which is required for mTLS to work.
Broken since google-auth 2.44.0 and later.
Fixes the following code:
Fixes #16090