[config/configgrpc] Return PerRPCCredentials error instead of swallowing it#15657
Open
lazureykis wants to merge 1 commit into
Open
[config/configgrpc] Return PerRPCCredentials error instead of swallowing it#15657lazureykis wants to merge 1 commit into
lazureykis wants to merge 1 commit into
Conversation
…ing it getGrpcDialOptions returned the outer (nil) err rather than perr when a client auth extension's PerRPCCredentials() failed, so the error was silently swallowed and the gRPC client was built without the intended per-RPC credentials instead of failing. Return perr, and add a test exercising the failure path via extensionauthtest.NewErr, which was previously untested (every auth test used NewNopClient, whose PerRPCCredentials returns a nil error). Assisted-by: Claude Opus 4.8 Signed-off-by: Pavel Lazureykis <pavel@lazureykis.dev>
lazureykis
force-pushed
the
fix/configgrpc-perrpc-auth-swallow
branch
from
July 24, 2026 18:12
41640f9 to
1da8b15
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #15657 +/- ##
==========================================
- Coverage 91.10% 91.03% -0.07%
==========================================
Files 726 729 +3
Lines 48079 48491 +412
==========================================
+ Hits 43803 44146 +343
- Misses 2978 3019 +41
- Partials 1298 1326 +28 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
songy23
approved these changes
Jul 24, 2026
songy23
added
the
ready-to-merge
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
ClientConfig.getGrpcDialOptionsswallowed the error from a gRPC client auth extension'sPerRPCCredentials(). On failure it ranreturn nil, err, buterrat that point is the (nil) result of the earlier successfulcc.TLS.LoadTLSConfig(ctx)— so the function returned(nil, nil). The gRPC client was then built without the intended per-RPC credentials instead of failing, silently dropping client auth.The fix returns
perr(the actualPerRPCCredentials()error) so the failure propagates throughToClientConn.Link to tracking issue
Fixes #15658
Testing
Added
TestGetGRPCDialOptionsPerRPCCredentialsError, which configures a client auth extension viaextensionauthtest.NewErr(whosePerRPCCredentials()returns an error) and assertsgetGrpcDialOptionspropagates it. This path was previously untested: every existing configgrpc auth test usesextensionauthtest.NewNopClient, whosePerRPCCredentials()returns a nil error, so the bug was never exercised. The test fails against the old code (An error is expected but got nil) and passes with the fix. It mirrors the existing HTTP-side analog inconfighttp/client_test.go.Documentation
Changelog entry added under
.chloggen/.Authorship