googleapis / googleapis/google-cloud-go

storage: specifying grpc.WithTransportCredentials default to storage.mtls.googleapis.com endpoint

Open
#11,804 4 comments 1 reaction 1 assignee Claimed by @shollyman View on GitHub
api: storage type: question
Dominant language
Go
Stars
4.5k
Forks
1.6k
Avg merge
1d 13h
Merged PRs (30d)
109

Description

[Storage gRPC client](https://cloud.google.com/storage/docs/enable-grpc-api) automatically defaults to mtls endpoint if the transportcredentials is set

In the follwoing code, if i want to just specify my own transport credentials (so that i can keylog), the endpoint defaults to the mtls endpoint (which i dont' want here).

If you run the follwoing with the env vars set

```bash
export GRPC_GO_LOG_SEVERITY_LEVEL=info
export GRPC_GO_LOG_VERBOSITY_LEVEL=99
export GODEBUG=http2debug=2
```

you'll see it attempts to connect to the mtls endpoint though i didn't specify it

```log
2025/03/11 12:00:46 INFO: [core] Creating new client transport to "{Addr: \"storage.mtls.googleapis.com:443\", ServerName: \"storage.mtls.googleapis.com:443\", }": connection error: desc = "error reading server preface: remote error: tls: certificate required"
2025/03/11 12:00:46 WARNING: [core] [Channel #1 SubChannel #2]grpc: addrConn.createTransport failed to connect to {Addr: "storage.mtls.googleapis.com:443", ServerName: "storage.mtls.googleapis.com:443", }. Err: connection error: desc = "error reading server preface: remote error: tls: certificate required"
2025/03/11 12:00:46 INFO: [core] [Channel #1 SubChannel #2]Subchannel Connectivity change to TRANSIENT_FAILURE, last error: connection error: desc = "error reading server preface: remote error: tls: certificate required"
```

the code below works if you uncomment the to not specify transportcredentials or if you specify the endpoint directly.

---

```go
package main

/*
*/
import (
"crypto/tls"
"flag"
"fmt"
"io"
"log"
"os"
"time"

"cloud.google.com/go/storage"
"golang.org/x/net/context"
"google.golang.org/api/option"
"google.golang.org/grpc"
"google.golang.org/grpc/credentials"
)

const ()

var (
bucketName = flag.String("bucketName", "someproject", "Bucket to upload/download")
fileName = flag.String("fileName", "foo.txt", "Bucket to upload/download")
)

func main() {

flag.Parse()

ctx, cancel := context.WithTimeout(context.Background(), time.Second*10)
defer cancel()

/*
export GRPC_GO_LOG_SEVERITY_LEVEL=info
export GRPC_GO_LOG_VERBOSITY_LEVEL=99
export GODEBUG=http2debug=2
*/
tlsCfg := &tls.Config{
MinVersion: tls.VersionTLS13,
}

sslKeyLogfile := os.Getenv("SSLKEYLOGFILE")
if sslKeyLogfile != "" {
var w *os.File
w, err := os.OpenFile(sslKeyLogfile, os.O_WRONLY|os.O_CREATE|os.O_APPEND, 0600)
if err != nil {
log.Fatalf("Could not create keylogger: %v", err)
}
tlsCfg.KeyLogWriter = w
}
rpcreds := credentials.NewTLS(tlsCfg)

storageClient, err := storage.NewGRPCClient(ctx, option.WithGRPCDialOption(grpc.WithTransportCredentials(rpcreds)))

//storageClient, err := storage.NewGRPCClient(ctx, option.WithEndpoint("storage.googleapis.com:443"), option.WithGRPCDialOption(grpc.WithTransportCredentials(rpcreds)))
//storageClient, err := storage.NewGRPCClient(ctx)
if err != nil {
fmt.Printf("storage.NewClient: %v", err)
return
}
defer storageClient.Close()

bkt := storageClient.Bucket(*bucketName)

rc, err := bkt.Object(*fileName).NewReader(ctx)
if err != nil {
fmt.Printf("Error Reading: Object(%q).NewReader: %v", *fileName, err)
return
}
defer rc.Close()

if _, err := io.Copy(os.Stdout, rc); err != nil {
fmt.Printf("io.Copy: %v", err)
return
}
fmt.Println("")

}

```

go.mod

```text
module main

go 1.24.0

require (
cloud.google.com/go/storage v1.50.0
golang.org/x/net v0.37.0
google.golang.org/api v0.224.0
google.golang.org/grpc v1.71.0
)
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.