feat: Support Developer Edition connections (GoogleCloudPlatform#1433)

Author: hessjcg

.coveragerc

@@ -0,0 +1,10 @@
+[report]
+exclude_lines =
+    pragma: no cover
+    def __repr__
+    raise AssertionError
+    raise NotImplementedError
+    if __name__ == .__main__.:
+    @abc.abstractmethod
+    if TYPE_CHECKING:
+

.github/workflows/tests.yml

@@ -86,6 +86,14 @@ jobs:
             POSTGRES_CUSTOMER_CAS_PASS_VALID_DOMAIN_NAME:${{ vars.GOOGLE_CLOUD_PROJECT }}/POSTGRES_CUSTOMER_CAS_PASS_VALID_DOMAIN_NAME
             POSTGRES_MCP_CONNECTION_NAME:${{ vars.GOOGLE_CLOUD_PROJECT }}/POSTGRES_MCP_CONNECTION_NAME
             POSTGRES_MCP_PASS:${{ vars.GOOGLE_CLOUD_PROJECT }}/POSTGRES_MCP_PASS
+            POSTGRES_AIDE_CONNECTION_NAME:${{ vars.GOOGLE_CLOUD_PROJECT }}/POSTGRES_AIDE_CONNECTION_NAME
+            POSTGRES_AIDE_USER:${{ vars.GOOGLE_CLOUD_PROJECT }}/POSTGRES_AIDE_USER
+            POSTGRES_AIDE_PASS:${{ vars.GOOGLE_CLOUD_PROJECT }}/POSTGRES_AIDE_PASS
+            POSTGRES_AIDE_DB:${{ vars.GOOGLE_CLOUD_PROJECT }}/POSTGRES_AIDE_DB
+            POSTGRES_FALLBACK_CONNECTION_NAME:${{ vars.GOOGLE_CLOUD_PROJECT }}/POSTGRES_FALLBACK_CONNECTION_NAME
+            POSTGRES_FALLBACK_USER:${{ vars.GOOGLE_CLOUD_PROJECT }}/POSTGRES_FALLBACK_USER
+            POSTGRES_FALLBACK_PASS:${{ vars.GOOGLE_CLOUD_PROJECT }}/POSTGRES_FALLBACK_PASS
+            POSTGRES_FALLBACK_DB:${{ vars.GOOGLE_CLOUD_PROJECT }}/POSTGRES_FALLBACK_DB
             SQLSERVER_CONNECTION_NAME:${{ vars.GOOGLE_CLOUD_PROJECT }}/SQLSERVER_CONNECTION_NAME
             SQLSERVER_USER:${{ vars.GOOGLE_CLOUD_PROJECT }}/SQLSERVER_USER
             SQLSERVER_PASS:${{ vars.GOOGLE_CLOUD_PROJECT }}/SQLSERVER_PASS
@@ -112,6 +120,14 @@ jobs:
           POSTGRES_CUSTOMER_CAS_PASS_VALID_DOMAIN_NAME: "${{ steps.secrets.outputs.POSTGRES_CUSTOMER_CAS_PASS_VALID_DOMAIN_NAME }}"
           POSTGRES_MCP_CONNECTION_NAME: "${{ steps.secrets.outputs.POSTGRES_MCP_CONNECTION_NAME }}"
           POSTGRES_MCP_PASS: "${{ steps.secrets.outputs.POSTGRES_MCP_PASS }}"
+          POSTGRES_AIDE_CONNECTION_NAME: "${{ steps.secrets.outputs.POSTGRES_AIDE_CONNECTION_NAME }}"
+          POSTGRES_AIDE_USER: "${{ steps.secrets.outputs.POSTGRES_AIDE_USER }}"
+          POSTGRES_AIDE_PASS: "${{ steps.secrets.outputs.POSTGRES_AIDE_PASS }}"
+          POSTGRES_AIDE_DB: "${{ steps.secrets.outputs.POSTGRES_AIDE_DB }}"
+          POSTGRES_FALLBACK_CONNECTION_NAME: "${{ steps.secrets.outputs.POSTGRES_FALLBACK_CONNECTION_NAME }}"
+          POSTGRES_FALLBACK_USER: "${{ steps.secrets.outputs.POSTGRES_FALLBACK_USER }}"
+          POSTGRES_FALLBACK_PASS: "${{ steps.secrets.outputs.POSTGRES_FALLBACK_PASS }}"
+          POSTGRES_FALLBACK_DB: "${{ steps.secrets.outputs.POSTGRES_FALLBACK_DB }}"
           SQLSERVER_CONNECTION_NAME: "${{ steps.secrets.outputs.SQLSERVER_CONNECTION_NAME }}"
           SQLSERVER_USER: "${{ steps.secrets.outputs.SQLSERVER_USER }}"
           SQLSERVER_PASS: "${{ steps.secrets.outputs.SQLSERVER_PASS }}"

.gitignore

@@ -10,6 +10,7 @@ dist/
 sponge_log.xml
 .envrc
 *.iml
+build/
 .mypy_cache/
 .nox/
 .pytest_cache/

README.md

@@ -201,7 +201,7 @@ from google.cloud.sql.connector import Connector
 
 # Note: all parameters below are optional
 connector = Connector(
-    ip_type="public",  # can also be "private" or "psc"
+    ip_type="public",  # can also be "private", "psc", or "sql_data"
     enable_iam_auth=False,
     timeout=30,
     credentials=custom_creds, # google.auth.credentials.Credentials
@@ -279,7 +279,11 @@ with, set the `ip_type` keyword argument when initializing a `Connector()` or wh
 calling `connector.connect()`.
 
 Possible values for `ip_type` are `"public"` (default value),
-`"private"`, and `"psc"`.
+`"private"`, `"psc"`, and `"sql_data"`.
+
+> [!NOTE]
+>
+> Usage of the `asyncpg` driver does not currently support `ip_type="sql_data"` (`IPTypes.SQL_DATA`).
 
 Example:
 

build.sh

@@ -120,6 +120,14 @@ function write_e2e_env(){
     POSTGRES_CUSTOMER_CAS_INVALID_DOMAIN_NAME=POSTGRES_CUSTOMER_CAS_INVALID_DOMAIN_NAME
     POSTGRES_MCP_CONNECTION_NAME=POSTGRES_MCP_CONNECTION_NAME
     POSTGRES_MCP_PASS=POSTGRES_MCP_PASS
+    POSTGRES_AIDE_CONNECTION_NAME=POSTGRES_AIDE_CONNECTION_NAME
+    POSTGRES_AIDE_USER=POSTGRES_AIDE_USER
+    POSTGRES_AIDE_PASS=POSTGRES_AIDE_PASS
+    POSTGRES_AIDE_DB=POSTGRES_AIDE_DB
+    POSTGRES_FALLBACK_CONNECTION_NAME=POSTGRES_FALLBACK_CONNECTION_NAME
+    POSTGRES_FALLBACK_USER=POSTGRES_FALLBACK_USER
+    POSTGRES_FALLBACK_PASS=POSTGRES_FALLBACK_PASS
+    POSTGRES_FALLBACK_DB=POSTGRES_FALLBACK_DB
     SQLSERVER_CONNECTION_NAME=SQLSERVER_CONNECTION_NAME
     SQLSERVER_USER=SQLSERVER_USER
     SQLSERVER_PASS=SQLSERVER_PASS

google/cloud/sql/connector/client.py

@@ -173,9 +173,13 @@ async def _get_metadata(
             if psc_dns_names:
                 ip_addresses["PSC"] = psc_dns_names
 
+        server_ca_cert = None
+        if "serverCaCert" in ret_dict and "cert" in ret_dict["serverCaCert"]:
+            server_ca_cert = ret_dict["serverCaCert"]["cert"]
+
         return {
             "ip_addresses": ip_addresses,
-            "server_ca_cert": ret_dict["serverCaCert"]["cert"],
+            "server_ca_cert": server_ca_cert,
             "database_version": ret_dict["databaseVersion"],
         }
 
@@ -271,7 +275,15 @@ async def _get_ephemeral(
         finally:
             resp.raise_for_status()
 
-        ephemeral_cert: str = ret_dict["ephemeralCert"]["cert"]
+        try:
+            ephemeral_cert: str = ret_dict["ephemeralCert"]["cert"]
+        except KeyError as e:
+            logger.error(
+                "KeyError in _get_ephemeral parsing generateEphemeralCert: %s. Response dict: %s",
+                e,
+                ret_dict,
+            )
+            raise
 
         # decode cert to read expiration
         x509 = load_pem_x509_certificate(

google/cloud/sql/connector/connection_info.py

@@ -21,6 +21,7 @@
 from typing import Any, TYPE_CHECKING
 
 from google.cloud.sql.connector.connection_name import ConnectionName
+from google.cloud.sql.connector.exceptions import CloudSQLConnectionError
 from google.cloud.sql.connector.exceptions import CloudSQLIPTypeError
 from google.cloud.sql.connector.exceptions import TLSVersionError
 from google.cloud.sql.connector.utils import AsyncTemporaryDirectory
@@ -62,7 +63,7 @@ class ConnectionInfo:
 
     conn_name: ConnectionName
     client_cert: str
-    server_ca_cert: str
+    server_ca_cert: str | None
     private_key: bytes
     ip_addrs: dict[str, Any]
     database_version: str
@@ -78,6 +79,12 @@ async def create_ssl_context(self, enable_iam_auth: bool = False) -> ssl.SSLCont
         # if SSL context is cached, use it
         if self.context is not None:
             return self.context
+        
+        if self.server_ca_cert is None:
+            raise CloudSQLConnectionError(
+                "Cannot create SSL context: server CA certificate is missing."
+            )
+
         context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
 
         # update ssl.PROTOCOL_TLS_CLIENT default