feat: add experimental s2a-go integration #1874

xmenxk · 2023-02-23T21:15:35Z

s2a integration with grpc and http transport code.
With this change, client library will try establishing mtls with the google api's mtls endpoint, using credentials held by s2a.

also if dialing connection with s2a fails at runtime, it will fall back to dialing regular TLS to the regular endpoint.

The added code only changes the default behavior in a way that's transparent to customers; if other mtls approach is specified, e.g. DCA, this code will not run.

quartzmo · 2023-02-28T16:26:38Z

Hi @xmenxk,

Thank you for opening this pull request!

Can you please open a feature request issue explaining the motivation for this feature (the benefits for users) and providing some background on the stability of s2a-go and how it will work in the context of this HTTP client?

quartzmo · 2023-03-04T00:14:30Z

@xmenxk Is this PR related to #1886 in any way?

xmenxk · 2023-03-04T00:40:43Z

@xmenxk Is this PR related to #1886 in any way?

thanks @quartzmo for the response.

Both touch the transport layer code, as far as I can tell, they are for different use cases.

#1886 looks like it's specifically for allowing configuring a http-client to talk to oauth2's mtls endpoint.

The s2a integration this PR adds is a way for cloud workloads to talk to all google apis using MTLS, in a transparent way. It only runs when no other MTLS approach is specified, so there should't be any conflict.
I'll provide more information on s2a next week. thanks again!

andyrzhao

Thank you for putting up this PR Kui! Left some general comments. I'm not familiar with the S2A architecture and would love to see some more context around this PR to make sure it is integrated smoothly.

go.mod

transport/grpc/dial.go

transport/internal/s2a/s2a.go

transport/http/dial.go

andyrzhao

Looks good overall - I added some comments mostly around naming and code comments. Thanks! Also, please get one of the Yoshi team members to sign off on the change.

internal/cba.go

transport/grpc/dial.go

transport/http/dial.go

internal/cba.go

internal/cert/default_cert.go

internal/creds.go

xmenxk · 2023-03-23T18:29:39Z

Looks good overall - I added some comments mostly around naming and code comments. Thanks! Also, please get one of the Yoshi team members to sign off on the change.

Hi @codyoss, could you take a look at the PR? thanks :)

noahdietz · 2023-03-23T19:19:31Z

Looks good overall - I added some comments mostly around naming and code comments. Thanks! Also, please get one of the Yoshi team members to sign off on the change.

Hi @codyoss, could you take a look at the PR? thanks :)

I've added @codyoss as a reviewer. I'm on rotation this week but I'd feel better with Cody reviewing this change anyways :)

andyrzhao

LGTM for CBA logic.

noahdietz · 2023-03-23T20:48:41Z

Added cody back to reviewers

codyoss

LGTM overall, couple of small things

codyoss · 2023-04-03T17:32:57Z

internal/cba.go

@@ -41,10 +52,12 @@ const (
 	mTLSModeAuto   = "auto"
 )

-// GetClientCertificateSourceAndEndpoint is a convenience function that invokes
+var useS2A = flag.Bool("use_s2a", false, "Experimental: if true, the code will try MTLS with S2A as the default for transport security.")


I agree that I think a envvar would be preferable here.

internal/cba.go

go.mod

xmenxk requested review from a team and yoshi-approver as code owners February 23, 2023 21:15

xmenxk force-pushed the zatar-mtls branch from 3928cfd to a81fca0 Compare February 23, 2023 21:37

quartzmo added the needs more info This issue needs more information from the customer to proceed. label Feb 28, 2023

quartzmo mentioned this pull request Mar 4, 2023

internal: Refactor cert logic to support OAuth2 token exchange over mTLS #1886

Merged

andyrzhao suggested changes Mar 6, 2023

View reviewed changes

xmenxk force-pushed the zatar-mtls branch from f99c183 to 496f836 Compare March 9, 2023 23:14

andyrzhao suggested changes Mar 13, 2023

View reviewed changes

transport/http/dial.go Outdated Show resolved Hide resolved

xmenxk force-pushed the zatar-mtls branch 2 times, most recently from 6859717 to 983292e Compare March 21, 2023 00:10

andyrzhao suggested changes Mar 22, 2023

View reviewed changes

xmenxk force-pushed the zatar-mtls branch from 983292e to 3f235c0 Compare March 23, 2023 18:17

xmenxk requested a review from andyrzhao March 23, 2023 18:31

noahdietz removed the needs more info This issue needs more information from the customer to proceed. label Mar 23, 2023

noahdietz requested review from codyoss and removed request for andyrzhao March 23, 2023 19:19

xmenxk force-pushed the zatar-mtls branch from ef9a193 to 8625dd7 Compare March 23, 2023 20:11

xmenxk requested review from andyrzhao and removed request for codyoss March 23, 2023 20:17

andyrzhao approved these changes Mar 23, 2023

View reviewed changes

noahdietz requested a review from codyoss March 23, 2023 20:48

codyoss reviewed Apr 3, 2023

View reviewed changes

xmenxk force-pushed the zatar-mtls branch from 8625dd7 to c1a894b Compare April 3, 2023 18:32

xmenxk requested a review from codyoss April 3, 2023 18:36

codyoss reviewed Apr 4, 2023

View reviewed changes

internal/cba.go Outdated Show resolved Hide resolved

feat(all): s2a-go integration

e5deefa

xmenxk force-pushed the zatar-mtls branch from c1a894b to e5deefa Compare April 4, 2023 14:55

xmenxk requested a review from codyoss April 4, 2023 14:56

codyoss approved these changes Apr 4, 2023

View reviewed changes

codyoss changed the title ~~s2a-go integration~~ feat: add experimental s2a-go integration Apr 4, 2023

codyoss enabled auto-merge (squash) April 4, 2023 15:11

codyoss added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Apr 5, 2023

kokoro-team removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Apr 5, 2023

xmenxk added 2 commits April 5, 2023 19:32

Merge branch 'main' into zatar-mtls

7f44558

feat(all): minior varaible naming change

08bb045

auto-merge was automatically disabled April 5, 2023 19:35
Head branch was pushed to by a user without write access

codyoss added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Apr 5, 2023

kokoro-team removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Apr 5, 2023

codyoss merged commit 3c61729 into googleapis:main Apr 5, 2023
3 checks passed

release-please bot mentioned this pull request Apr 5, 2023

chore(main): release 0.117.0 #1931

Merged

liggitt reviewed Sep 1, 2023

View reviewed changes

go.mod Show resolved Hide resolved

rmehta19 mentioned this pull request May 9, 2024

Query S2A Address from MDS googleapis/google-auth-library-java#1400

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add experimental s2a-go integration #1874

feat: add experimental s2a-go integration #1874

xmenxk commented Feb 23, 2023

quartzmo commented Feb 28, 2023

quartzmo commented Mar 4, 2023

xmenxk commented Mar 4, 2023

andyrzhao left a comment

andyrzhao left a comment

xmenxk commented Mar 23, 2023

noahdietz commented Mar 23, 2023

andyrzhao left a comment

noahdietz commented Mar 23, 2023

codyoss left a comment

codyoss Apr 3, 2023

feat: add experimental s2a-go integration #1874

feat: add experimental s2a-go integration #1874

Conversation

xmenxk commented Feb 23, 2023

quartzmo commented Feb 28, 2023

quartzmo commented Mar 4, 2023

xmenxk commented Mar 4, 2023

andyrzhao left a comment

Choose a reason for hiding this comment

andyrzhao left a comment

Choose a reason for hiding this comment

xmenxk commented Mar 23, 2023

noahdietz commented Mar 23, 2023

andyrzhao left a comment

Choose a reason for hiding this comment

noahdietz commented Mar 23, 2023

codyoss left a comment

Choose a reason for hiding this comment

codyoss Apr 3, 2023

Choose a reason for hiding this comment