fix(auth/grpctransport): use storage-direct authority for Interconnect (#20738)
When DirectPath over Interconnect is enabled, `configureDirectPath`
rewrites `storage.googleapis.com` to `storage-direct.googleapis.com`
(and accepts `storage-direct.googleapis.com` directly) but also appends
`grpc.WithAuthority("storage.googleapis.com")`. Cloud Storage identifies
DirectPath over Interconnect traffic by the `:authority` of each RPC
being `storage-direct.googleapis.com` (or
`storage-preprod-direct.sandbox.googleapis.com` in preprod); when it is
the non-direct host, the service treats the RPCs as regular traffic and
the feature is silently inactive. This affects
`InternalOptions.EnableDirectPathXdsOverInterconnect`,
`GOOGLE_CLOUD_ENABLE_DIRECT_PATH_XDS_OVER_INTERCONNECT`, and
application-supplied `storage-direct.googleapis.com`, `dns:///`, and
`google-c2p:///` endpoints. In addition, preprod hosts were rewritten
incorrectly: `storage-preprod.sandbox.googleapis.com` became
`storage-preprod.sandbox-direct.googleapis.com` because `-direct` was
inserted immediately before `googleapis.com`.
The `storage.googleapis.com` override was originally added for TLS
hostname verification, which is unnecessary: the `*.googleapis.com`
certificate covers `storage-direct.googleapis.com`, and TLS, xDS/RLS
routing, and authentication all succeed with that authority.
This PR extracts the host rewrite and authority selection into
`interconnectHostAndAuthority`. The rewrite now inserts `-direct` after
the first label, mirroring how the override removes it, so
`storage-preprod.sandbox.googleapis.com` maps to
`storage-preprod-direct.sandbox.googleapis.com`. No `:authority`
override is returned when the target host is
`storage-direct.googleapis.com` or
`storage-preprod-direct.sandbox.googleapis.com`, allowing `grpc-go` to
derive the authority from the target. Other `-direct` hosts retain their
current override. An application-supplied `grpc.WithAuthority` dial
option continues to take precedence because `Options.GRPCDialOpts` are
appended after `configureDirectPath`.
Existing interconnect tests in `directpath_test.go` asserted
`len(grpcOpts) >= 2` (credentials bundle plus `WithAuthority`). For
`storage-direct.googleapis.com`, that would now hold only on Linux,
where `timeoutDialerOption` adds a second option, so they now assert
`len(grpcOpts) >= 1` for the credentials bundle.
`TestConfigureDirectPath_Interconnect` gains a preprod row for the
rewritten endpoint. New tests:
- `TestInterconnectHostAndAuthority` verifies the rewritten target host
and `:authority` override across the prod and preprod Storage hosts,
other services, other multi-label hosts, and non-`googleapis.com`
hosts.
- `TestConfigureDirectPath_Interconnect_Authority` verifies whether
`configureDirectPath` appends `grpc.WithAuthority` across the option,
environment variable, and application-supplied `storage-direct`,
`dns:///`, and `google-c2p:///` endpoints, and the preprod Storage
hosts, by comparing the dial option count against a baseline host that
receives the override.
- `TestConfigureDirectPath_Interconnect_FallbackPreservesEndpoint` is
now table-driven. Two new characterization rows cover
`GOOGLE_CLOUD_ENABLE_DIRECT_PATH_XDS_OVER_INTERCONNECT=false` with an
application-supplied `storage-direct` endpoint and the
`google-c2p-experimental:///` scheme. Every row now sets both
environment variables explicitly and asserts that no dial options are
added in addition to the preserved endpoint.
Go packages for Google Cloud Platform services.
go get cloud.google.com/go/firestore@latest # Replace firestore with the package you want to use.
NOTE: Some of these packages are under development, and may occasionally make backwards-incompatible changes.
For an updated list of all of our released APIs please see our reference docs.
Our libraries are compatible with the two most recent major Go releases, the same policy the Go programming language follows. This means the currently supported versions are:
By default, each client library will use Application Default Credentials (ADC) to automatically configure the credentials used in calling the API endpoint. When using the libraries in a Google Cloud Platform environment such as Compute Engine, Kubernetes Engine, or App Engine, no additional authentication steps are necessary. See Authentication methods at Google and Authenticate for using client libraries for more information.
client, err := storage.NewClient(ctx)
For applications running elsewhere, such as your local development environment, you can use the gcloud auth application-default login command from the Google Cloud CLI to set user credentials in your local filesystem. Application Default Credentials will automatically detect these credentials. See Set up ADC for a local development environment for more information.
Alternately, you may need to provide an explicit path to your credentials. To authenticate using a service account key file, either set the GOOGLE_APPLICATION_CREDENTIALS environment variable to the path to your key file, or programmatically pass option.WithCredentialsFile to the NewClient function of the desired package. For example:
client, err := storage.NewClient(ctx, option.WithCredentialsFile("path/to/keyfile.json"))
You can exert even more control over authentication by using the credentials package to create an auth.Credentials. Then pass option.WithAuthCredentials to the NewClient function:
creds, err := credentials.DetectDefault(&credentials.DetectOptions{...})
...
client, err := storage.NewClient(ctx, option.WithAuthCredentials(creds))
Contributions are welcome. Please, see the CONTRIBUTING document for details.
Please note that this project is released with a Contributor Code of Conduct. By participating in this project you agree to abide by its terms. See Contributor Code of Conduct for more information.