feat: [grpc] Add retry logic when certificate mismatch for existing credentials & Agent Identity workloads - #18019
Open
agrawalradhika-cell wants to merge 34 commits into
Open
Conversation
feat: Add passphrase handling to client cert callback
feat: Add cert rotation handling support
chore: Add passphrase in _mtls_helper for requests
…rase chore: Modify _mtls_helper call to include additional variable passphrase
Updated mock return values in test cases to include None for additional parameters.
Updated mock callback to return an additional None value.
Updated mock call_client_cert_callback to include a None value in the return tuple.
chore: Add unit tests for cert rotation handling for grpc
chore: Add tests for grpc cert roatation handling changes
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request introduces mTLS certificate rotation and automatic retry capabilities for gRPC transport by implementing a refreshing channel wrapper and call interceptors. It also updates helper utilities to support key passphrases. The review feedback suggests handling potential CancelledError exceptions gracefully when checking futures to prevent thread crashes, and recommends removing several redundant getattr checks for attributes that are guaranteed to be initialized in their respective class constructors.
fix: Refactor gRPC call handling and state management
nbayati
self-requested a review
August 7, 2026 18:41
Contributor
|
The github status checks are stuck. You could try closing and re-opening this PR to re-trigger them |
agrawalradhika-cell
force-pushed
the
grpc-cert-rotation
branch
from
August 10, 2026 20:46
cdd91ce to
524247b
Compare
agrawalradhika-cell
marked this pull request as ready for review
August 11, 2026 16:06
Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>
nbayati
requested changes
Aug 20, 2026
…mments and fix doctrings chore: Update Refactor mTLS gRPC client interceptor logic based on comments and fix doctrings
…ype hint for passphrase. chore: Refactor error handling for certificate retrieval and update type hint for passphrase.
fix: Refactor deadline error handling in grpc.py
daniel-sanche
requested changes
Aug 21, 2026
daniel-sanche
left a comment
daniel-sanche
left a comment
Contributor
There was a problem hiding this comment.
I left some comments after a first pass, but I need to spend more time reviewing some of these wrappers.
First though, are you sure this is the right layer? I don't have much context on this change, but IIRC, gapic libraries use a different channel type. So I just want to make sure this is accomplishing what you want it to
agrawalradhika-cell
force-pushed
the
grpc-cert-rotation
branch
from
August 25, 2026 14:58
9ee9410 to
7b3f17b
Compare
Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>
agrawalradhika-cell
force-pushed
the
grpc-cert-rotation
branch
from
August 25, 2026 15:02
7b3f17b to
d8050ed
Compare
chore: Refactor gRPC call handling with base wrapper class
chore: Include Wrapper in CertRotationInterceptor initialization
…hannel factory arguments. chore: Refactor MTLS channel creation to use a partial function for channel factory arguments.
…ate rotation This file implements an mTLS Interceptor and Channel Wrapper that supports automatic retry logic for certificate rotation in gRPC calls.
Updated the gRPC transport module to use mtls_interceptor for mutual TLS support. Removed the old CertRotationInterceptor and MTLSRefreshingChannel classes.
chore: Rename _mtls_interceptor.py to mtls_interceptor.py to make public
Fix import statement for mtls_interceptor
Refactor mTLS interceptor and channel logic for improved certificate rotation handling.
fix: Remove unnecessary blank line in test file
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
feat: [grpc] Add retry logic when certificate mismatch for existing credentials & Agent Identity workloads
This PR introduces mTLS certificate rotation and encrypted private key passphrase handling to the gRPC transport. It implements an interceptor and a refreshing channel to automatically reload client certificates upon authentication failures when certificates rotate. It also updates tests and mock return values across all transports.
See go/grpc-cert-rotation-in-pythonsdk-for-x509 for details.