interop: attach per-RPC creds to TLS channel creds in the interop client (#9571) With --use_tls, the interop client added the per-RPC credentials for compute_engine_creds, service_account_creds, jwt_token_creds, and oauth2_auth_token with grpc.WithPerRPCCredentials. Those aren't part of the channel's credentials, so channels the client creates internally don't inherit them. In particular, the RLS control channel copies only DialCreds or CredsBundle, so RouteLookup calls went out without OAuth and were rejected by RLS servers that require authentication. This wraps the TLS transport credentials and the per-RPC credentials in a credentials.Bundle. The RLS control channel takes the CredsBundle path and keeps the per-RPC credentials. The bundle always returns the same TLS transport credentials, regardless of mode. This matches the C++ interop client, which attaches call credentials to the channel credentials (CompositeChannelCredentials(SslCredentials, call_creds)), so its RLS lookups carry OAuth with TLS. Java's equivalent is CompositeChannelCredentials(TlsChannelCredentials, CallCredentials). Tested with a target that uses RLS, where the RLS server requires OAuth: before, the RLS lookup failed with Unauthenticated and returned no targets; after, targets are returned and the RPC proceeds. Calls to TLS backends without RLS are unaffected. RELEASE NOTES: n/a
The Go implementation of gRPC: A high performance, open source, general RPC framework that puts mobile and HTTP/2 first. For more information see the Go gRPC docs, or jump directly into the quick start.
Simply add the following import to your code, and then go [build|run|test] will automatically fetch the necessary dependencies:
import "google.golang.org/grpc"
Note: If you are trying to access
grpc-gofrom China, see the FAQ below.
The golang.org domain may be blocked from some countries. go get usually produces an error like the following when this happens:
$ go get -u google.golang.org/grpc package google.golang.org/grpc: unrecognized import path "google.golang.org/grpc" (https fetch: Get https://google.golang.org/grpc?go-get=1: dial tcp 216.239.37.1:443: i/o timeout)
To build Go code, there are several options:
Set up a VPN and access google.golang.org through that.
With Go module support: it is possible to use the replace feature of go mod to create aliases for golang.org packages. In your project's directory:
go mod edit -replace=google.golang.org/grpc=github.com/grpc/grpc-go@latest go mod tidy go mod vendor go build -mod=vendor
Again, this will need to be done for all transitive dependencies hosted on golang.org as well. For details, refer to golang/go issue #28652.
Please update to the latest version of gRPC-Go using go get google.golang.org/grpc.
The default logger is controlled by environment variables. Turn everything on like this:
$ export GRPC_GO_LOG_VERBOSITY_LEVEL=99 $ export GRPC_GO_LOG_SEVERITY_LEVEL=info
"code = Unavailable desc = transport is closing"This error means the connection the RPC is using was closed, and there are many possible reasons, including:
It can be tricky to debug this because the error happens on the client side but the root cause of the connection being closed is on the server side. Turn on logging on both client and server, and see if there are any transport errors.