fix(auth): exit early when agent cert config is outside well-known directory by nbayati · Pull Request #17762 · googleapis/google-cloud-python · GitHub

To prevent unnecessary startup latency, this updates the agent certificate retrieval to only poll when the config points to the well-known workload directory (where Cloud Run dynamically mounts files). For all other paths, it exits early.

Extracts config parsing into a dedicated helper function
Removes the hardcoded fallback to the well-known path when no config is provided
Adds test coverage for new logic

fixes b/522957573

…ectory To prevent unnecessary startup latency, this updates the agent certificate retrieval to only poll when the config points to the well-known workload directory (where Cloud Run dynamically mounts files). For all other paths, it exits early. - Extracts config parsing into a dedicated helper function - Removes the hardcoded fallback to the well-known path when no config is provided - Adds test coverage for new logic

Code Review

This pull request refactors the agent identity certificate path retrieval logic in _agent_identity_utils.py by extracting configuration parsing and polling into dedicated helper functions, and conditionally disabling polling for paths outside the well-known directory to avoid startup delays. The review feedback recommends specifying encoding="utf-8" when opening the configuration file to ensure consistent cross-platform behavior.

Using string prefix matching here is not safe and can create both false positives and false negatives (e.g. when paths contain symlinks, but not sure if that is something we need to handle).

Good point. I did some digging into the Cloud Run implementation, and it seems like CR doesn't use symlinks for these mounts (unlike Kubernetes), and it supplies a strict logical path to the environment variable. So we can safely fix the prefix vulnerability purely via string manipulation using os.path.abspath and os.path.commonpath without needing to hit the filesystem to resolve symlinks! I've updated the logic.

We now return None when env var is not set. Is this intentional? Will this break anything?

Yes, this is intentional. The goal of this change is to completely skip any filesystem checks (and polling) unless the feature is explicitly enabled via the GOOGLE_API_CERTIFICATE_CONFIG environment variable. Cloud Run injects this environment variable, so relying on it exclusively is safe. Removing the hardcoded fallback prevents us from introducing unnecessary I/O or startup delays for users who aren't using this feature (see b/522957573)

Let's test when the first attempt has the file missing, second attempt succeeds, and cert path is returned

Done!

Can we confirm if this is the correct behavior? Gemini says this breaks polling when Cloud Run rotates secret volumes.

Not sure what Gemini means by that, but the actual behavior didn't change, I just removed the redundant cert_config_path and truthiness check since we now guarantee it's not None at the top of the function.
So I don't think this would break or make any functional difference for CR.

Just missing tests for the absolute path / startsWith change

…rectory (#17762) To prevent unnecessary startup latency, this updates the agent certificate retrieval to only poll when the config points to the well-known workload directory (where Cloud Run dynamically mounts files). For all other paths, it exits early. - Extracts config parsing into a dedicated helper function - Removes the hardcoded fallback to the well-known path when no config is provided - Adds test coverage for new logic fixes b/522957573

🤖 I have created a release *beep* *boop* --- ## [2.56.2](google-auth-v2.56.1...google-auth-v2.56.2) (2026-07-21) ### Bug Fixes * **auth:** centralize cert discovery logic and steps ([#17696](#17696)) ([edc0423](edc0423)) * **auth:** exit early when agent cert config is outside well-known directory ([#17762](#17762)) ([61e795a](61e795a)) * **transport:** propagate mTLS adapter to auth session and fix connection leaks ([#17689](#17689)) ([8289d32](8289d32)) * update _SERVICE_ACCOUNT_EMAIL_PATTERN to require .gserviceaccount.com suffix ([#17748](#17748)) ([b60bb04](b60bb04)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

nbayati requested review from a team as code owners July 17, 2026 06:42

gemini-code-assist Bot reviewed Jul 17, 2026

View reviewed changes

Comment thread packages/google-auth/google/auth/_agent_identity_utils.py Outdated

fix lint issue

d43f6de

nbayati changed the title refactor: exit early when agent cert config is outside well-known directory fix(aith): exit early when agent cert config is outside well-known directory Jul 17, 2026

parthea added kokoro:force-run Add this label to force Kokoro to re-run the tests. kokoro:run Add this label to force Kokoro to re-run the tests. labels Jul 17, 2026

parthea assigned nbayati Jul 17, 2026

yoshi-kokoro removed kokoro:run Add this label to force Kokoro to re-run the tests. kokoro:force-run Add this label to force Kokoro to re-run the tests. labels Jul 17, 2026

lsirac changed the title fix(aith): exit early when agent cert config is outside well-known directory fix(auth): exit early when agent cert config is outside well-known directory Jul 17, 2026

lsirac requested changes Jul 17, 2026

View reviewed changes

nbayati added 2 commits July 17, 2026 13:04

fix: address PR feedback for agent identity utils

fbf1452

test: add missing unit test

10763ad

nbayati requested a review from lsirac July 17, 2026 20:42

lsirac approved these changes Jul 17, 2026

View reviewed changes

test: add unit test

961e9d2

nbayati enabled auto-merge (squash) July 17, 2026 22:52

fix lint issue

dbd7fd4

nbayati merged commit 61e795a into googleapis:main Jul 17, 2026
39 checks passed

release-please Bot mentioned this pull request Jul 17, 2026

chore: release main #17764

Closed

release-please Bot mentioned this pull request Jul 21, 2026

chore: release main #17809

Merged

suztomo mentioned this pull request Jul 21, 2026

chore(main): release google-auth 2.56.2 #17814

Merged

+                  # delays.
                   well_known_dir = os.path.dirname(_WELL_KNOWN_CERT_PATH)
-                  has_well_known_dir = os.path.exists(well_known_dir)
+                  should_poll = cert_config_path.startswith(well_known_dir)

                           return None
                       except (IOError, ValueError, KeyError) as e:
-                          if cert_config_path and os.path.exists(cert_config_path):
+                          if os.path.exists(cert_config_path):

fix(auth): exit early when agent cert config is outside well-known directory by nbayati · Pull Request #17762 · googleapis/google-cloud-python · GitHub

Uh oh!

fix(auth): exit early when agent cert config is outside well-known directory - #17762

fix(auth): exit early when agent cert config is outside well-known directory#17762
nbayati merged 6 commits into
googleapis:mainfrom
nbayati:skip-polling-if-not-explicitly-set

nbayati commented Jul 17, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

lsirac Jul 17, 2026

Uh oh!

nbayati Jul 17, 2026

Uh oh!

lsirac Jul 17, 2026

Uh oh!

nbayati Jul 17, 2026

Uh oh!

lsirac Jul 17, 2026

Uh oh!

nbayati Jul 17, 2026

Uh oh!

lsirac Jul 17, 2026

Uh oh!

nbayati Jul 17, 2026

Uh oh!

lsirac left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

                   cert_config_path = os.environ.get(environment_vars.GOOGLE_API_CERTIFICATE_CONFIG)
-                  # Check if the well-known workload directory is mounted.
+                  if not cert_config_path:

fix(auth): exit early when agent cert config is outside well-known directory by nbayati · Pull Request #17762 · googleapis/google-cloud-python · GitHub

Uh oh!

fix(auth): exit early when agent cert config is outside well-known directory - #17762

Conversation

nbayati commented Jul 17, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lsirac left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants