Skip to content

fix(auth): lower regional access boundary logs from warning to debug.#17571

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nbayati merged 5 commits into from
Jun 25, 2026
Merged

fix(auth): lower regional access boundary logs from warning to debug. #17571

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
cc424a7
fix(auth): lower regional access boundary logs from warning to info
nbayati Jun 25, 2026
f7183b2
test(auth): update async RAB logging tests for INFO level
nbayati Jun 25, 2026
ff169aa
refactor(auth): lower RAB lookup log to DEBUG
nbayati Jun 25, 2026
fad1e4a
fix unit tests
nbayati Jun 25, 2026
23bc0ca
fix lint issue
nbayati Jun 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
100 changes: 45 additions & 55 deletions packages/google-auth/google/auth/_regional_access_boundary_utils.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -219,10 +219,9 @@ def start_blocking_refresh(self, credentials, request):
"""
# Async credentials do not support blocking lookups.
if inspect.iscoroutinefunction(credentials._lookup_regional_access_boundary):
if _helpers.is_logging_enabled(_LOGGER):
_LOGGER.warning(
"Blocking Regional Access Boundary lookup is not supported for async credentials."
)
_LOGGER.debug(
"Blocking Regional Access Boundary lookup is not supported for async credentials."
)
self.process_regional_access_boundary_info(None)
return

Expand All@@ -234,12 +233,11 @@ def start_blocking_refresh(self, credentials, request):
credentials._lookup_regional_access_boundary(request, fail_fast=True)
)
except Exception as e:
if _helpers.is_logging_enabled(_LOGGER):
_LOGGER.warning(
"Blocking Regional Access Boundary lookup raised an exception: %s",
e,
exc_info=True,
)
_LOGGER.debug(
"Blocking Regional Access Boundary lookup raised an exception: %s",
e,
exc_info=True,
)
regional_access_boundary_info = None

self.process_regional_access_boundary_info(regional_access_boundary_info)
Expand All@@ -265,12 +263,11 @@ async def start_blocking_refresh_async(self, credentials, request):
)
)
except Exception as e:
if _helpers.is_logging_enabled(_LOGGER):
_LOGGER.warning(
"Regional Access Boundary lookup raised an exception: %s",
e,
exc_info=True,
)
_LOGGER.debug(
"Regional Access Boundary lookup raised an exception: %s",
e,
exc_info=True,
)
regional_access_boundary_info = None

self.process_regional_access_boundary_info(regional_access_boundary_info)
Expand All@@ -297,14 +294,12 @@ def process_regional_access_boundary_info(self, regional_access_boundary_info):
cooldown_expiry=None,
cooldown_duration=DEFAULT_REGIONAL_ACCESS_BOUNDARY_COOLDOWN,
)
if _helpers.is_logging_enabled(_LOGGER):
_LOGGER.debug("Regional Access Boundary lookup successful.")
_LOGGER.debug("Regional Access Boundary lookup successful.")
else:
# On failure, calculate cooldown and update state.
if _helpers.is_logging_enabled(_LOGGER):
_LOGGER.warning(
"Regional Access Boundary lookup failed. Entering cooldown."
)
_LOGGER.debug(
"Regional Access Boundary lookup failed. Entering cooldown."
)

next_cooldown_expiry = (
_helpers.utcnow() + current_data.cooldown_duration
Expand DownExpand Up@@ -367,12 +362,11 @@ def run(self):
self._credentials._lookup_regional_access_boundary(self._request)
)
except Exception as e:
if _helpers.is_logging_enabled(_LOGGER):
_LOGGER.warning(
"Asynchronous Regional Access Boundary lookup raised an exception: %s",
e,
exc_info=True,
)
_LOGGER.debug(
"Asynchronous Regional Access Boundary lookup raised an exception: %s",
e,
exc_info=True,
)
regional_access_boundary_info = None

self._rab_manager.process_regional_access_boundary_info(
Expand DownExpand Up@@ -419,13 +413,12 @@ def start_refresh(self, credentials, request, rab_manager):
try:
copied_request = copy.deepcopy(request)
except Exception as e:
if _helpers.is_logging_enabled(_LOGGER):
_LOGGER.warning(
"Could not deepcopy transport for background RAB refresh. "
"Skipping background refresh to avoid thread safety issues. "
"Exception: %s",
e,
)
_LOGGER.debug(
"Could not deepcopy transport for background RAB refresh. "
"Skipping background refresh to avoid thread safety issues. "
"Exception: %s",
e,
)
return

self._worker = _RegionalAccessBoundaryRefreshThread(
Expand DownExpand Up@@ -479,14 +472,13 @@ async def _close_cloned_request(lookup_request, is_cloned):
if is_async := inspect.isawaitable(maybe_coro):
await maybe_coro
except Exception as e:
if _helpers.is_logging_enabled(_LOGGER):
adapter_type = " asynchronous " if is_async else " "
_LOGGER.warning(
"Failed to cleanly close cloned%srequest transport: %s",
adapter_type,
e,
exc_info=True,
)
adapter_type = " asynchronous " if is_async else " "

@macastelazmacastelazJun 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why did we get rid of the is_logging_enabled check here? Was that intentional?

@nbayatinbayatiJun 25, 2026

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes it was intentional. Previously, these were logged a WARNING. Because warnings are printed by default, we had to manually wrap it in that if check (which checks for DEBUG level) to hide it from normal users.

Now that we are logging them as _LOGGER.debug, they are already hidden by default. The logging library automatically filters out DEBUG logs, so we no longer need to write a manual if check to hide them.

_LOGGER.debug(
"Failed to cleanly close cloned%srequest transport: %s",
adapter_type,
e,
exc_info=True,
)


class _AsyncRegionalAccessBoundaryRefreshManager(object):
Expand DownExpand Up@@ -532,12 +524,11 @@ def start_refresh(self, credentials, request, rab_manager):
is_cloned,
) = _prepare_async_lookup_callable(request)
except Exception as e:
if _helpers.is_logging_enabled(_LOGGER):

@macastelazmacastelazJun 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ditto on the removal of this check

_LOGGER.warning(
"Synchronous cloning of request for Regional Access Boundary lookup failed: %s",
e,
exc_info=True,
)
_LOGGER.debug(
"Synchronous cloning of request for Regional Access Boundary lookup failed: %s",
e,
exc_info=True,
)
rab_manager.process_regional_access_boundary_info(None)
return

Expand All@@ -549,12 +540,11 @@ async def _worker():
)
)
except Exception as e:
if _helpers.is_logging_enabled(_LOGGER):

@macastelazmacastelazJun 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ditto

_LOGGER.warning(
"Asynchronous Regional Access Boundary lookup raised an exception: %s",
e,
exc_info=True,
)
_LOGGER.debug(
"Asynchronous Regional Access Boundary lookup raised an exception: %s",
e,
exc_info=True,
)
regional_access_boundary_info = None
finally:
await _close_cloned_request(lookup_request, is_cloned)
Expand Down
2 changes: 1 addition & 1 deletion packages/google-auth/google/auth/compute_engine/credentials.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -219,7 +219,7 @@ def _build_regional_access_boundary_lookup_url(
return None

if not _metadata._is_service_account_email(self.service_account_email):
_LOGGER.info(
_LOGGER.debug(
"Service account email '%s' is not a valid email. Skipping Regional Access Boundary lookup.",
self.service_account_email,
)
Expand Down
2 changes: 1 addition & 1 deletion packages/google-auth/google/auth/credentials.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -535,7 +535,7 @@ def _lookup_regional_access_boundary(

url = self._build_regional_access_boundary_lookup_url(request=request)
if not url:
_LOGGER.warning("Failed to build Regional Access Boundary lookup URL.")
_LOGGER.debug("Failed to build Regional Access Boundary lookup URL.")
return None

headers: Dict[str, str] = {}
Expand Down
2 changes: 1 addition & 1 deletion packages/google-auth/google/oauth2/_client.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -582,7 +582,7 @@ def _lookup_regional_access_boundary_request(
request, url, can_retry=can_retry, headers=headers, fail_fast=fail_fast
)
if not response_status_ok:
_LOGGER.warning(
_LOGGER.debug(
"Regional Access Boundary HTTP request failed after retries: response_data=%s, retryable_error=%s",
response_data,
retryable_error,
Expand Down
2 changes: 1 addition & 1 deletion packages/google-auth/google/oauth2/_client_async.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -356,7 +356,7 @@ async def _lookup_regional_access_boundary_request(
request, url, can_retry=can_retry, headers=headers, fail_fast=fail_fast
)
if not response_status_ok:
client._LOGGER.warning(
client._LOGGER.debug(
"Regional Access Boundary HTTP request failed after retries: response_data=%s, retryable_error=%s",
response_data,
retryable_error,
Expand Down
44 changes: 42 additions & 2 deletions packages/google-auth/tests/test__regional_access_boundary_utils.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -13,6 +13,7 @@
# limitations under the License.

import datetime
import logging
from unittest import mock

import pytest # type: ignore
Expand All@@ -24,6 +25,23 @@
from google.oauth2 import credentials as oauth2_credentials


@pytest.fixture
def rab_caplog(caplog):
"""Fixture to configure logging capture and ensure propagation for RAB utilities."""

caplog.set_level(
logging.DEBUG, logger="google.auth._regional_access_boundary_utils"
)

google_logger = logging.getLogger("google")
original_propagate = google_logger.propagate
google_logger.propagate = True
try:
yield caplog
finally:
google_logger.propagate = original_propagate


class CredentialsImpl(credentials.CredentialsWithRegionalAccessBoundary):
def __init__(self, universe_domain=None):
super(CredentialsImpl, self).__init__()
Expand DownExpand Up@@ -379,7 +397,7 @@ def test_lookup_regional_access_boundary_success(self, mock_lookup_rab):
assert rab_manager._data.cooldown_expiry is None

@mock.patch.object(CredentialsImpl, "_lookup_regional_access_boundary")
def test_lookup_regional_access_boundary_failure(self, mock_lookup_rab):
def test_lookup_regional_access_boundary_failure(self, mock_lookup_rab, rab_caplog):
creds = CredentialsImpl()
request = mock.Mock()
rab_manager = _regional_access_boundary_utils._RegionalAccessBoundaryManager()
Expand All@@ -396,6 +414,13 @@ def test_lookup_regional_access_boundary_failure(self, mock_lookup_rab):
assert rab_manager._data.expiry is None
assert rab_manager._data.cooldown_expiry is not None

# RAB failures should be logged at DEBUG level.
assert any(
t[1] == logging.DEBUG
and "Regional Access Boundary lookup failed. Entering cooldown." in t[2]
for t in rab_caplog.record_tuples
)

def test_lookup_regional_access_boundary_null_url(self):
creds = oauth2_credentials.Credentials(token="token")
request = mock.Mock()
Expand DownExpand Up@@ -441,7 +466,9 @@ def test_regional_access_boundary_refresh_thread_run_success(self, mock_utcnow):
assert rab_manager._data.cooldown_expiry is None

@mock.patch("google.auth._helpers.utcnow")
def test_regional_access_boundary_refresh_thread_run_failure(self, mock_utcnow):
def test_regional_access_boundary_refresh_thread_run_failure(
self, mock_utcnow, rab_caplog
):
mock_now = datetime.datetime(2025, 1, 1, 12, 0, 0)
mock_utcnow.return_value = mock_now

Expand All@@ -466,6 +493,19 @@ def test_regional_access_boundary_refresh_thread_run_failure(self, mock_utcnow):
assert rab_manager._data.cooldown_expiry == expected_cooldown_expiry
assert rab_manager._data.cooldown_duration == initial_cooldown * 2

# RAB failures should be logged at DEBUG level.
assert any(
t[1] == logging.DEBUG
and "Asynchronous Regional Access Boundary lookup raised an exception"
in t[2]
for t in rab_caplog.record_tuples
)
assert any(
t[1] == logging.DEBUG
and "Regional Access Boundary lookup failed. Entering cooldown." in t[2]
for t in rab_caplog.record_tuples
)

@mock.patch("google.auth._helpers.utcnow")
def test_regional_access_boundary_refresh_thread_run_failure_hard_expiry(
self, mock_utcnow
Expand Down
47 changes: 5 additions & 42 deletions packages/google-auth/tests_async/test__regional_access_boundary_utils.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -195,63 +195,26 @@ def test_async_refresh_manager_pickle():


@pytest.mark.asyncio
async def test_async_worker_exception_logging_enabled(monkeypatch):
async def test_async_worker_exception_logging():
credentials = mock.AsyncMock()
credentials._lookup_regional_access_boundary.side_effect = Exception("lookup fail")

request = mock.Mock()
request._clone.return_value = request
rab_manager = mock.Mock()

# Force is_logging_enabled to return True
monkeypatch.setattr(
_regional_access_boundary_utils._helpers,
"is_logging_enabled",
lambda logger: True,
)

manager = (
_regional_access_boundary_utils._AsyncRegionalAccessBoundaryRefreshManager()
)

with mock.patch.object(
_regional_access_boundary_utils._LOGGER, "warning"
) as mock_warning:
manager.start_refresh(credentials, request, rab_manager)
await manager._worker_task

mock_warning.assert_called_once()
assert "lookup raised an exception" in mock_warning.call_args[0][0]
rab_manager.process_regional_access_boundary_info.assert_called_once_with(None)


@pytest.mark.asyncio
async def test_async_worker_exception_logging_disabled(monkeypatch):
credentials = mock.AsyncMock()
credentials._lookup_regional_access_boundary.side_effect = Exception("lookup fail")

request = mock.Mock()
request._clone.return_value = request
rab_manager = mock.Mock()

# Force is_logging_enabled to return False
monkeypatch.setattr(
_regional_access_boundary_utils._helpers,
"is_logging_enabled",
lambda logger: False,
)

manager = (
_regional_access_boundary_utils._AsyncRegionalAccessBoundaryRefreshManager()
)

with mock.patch.object(
_regional_access_boundary_utils._LOGGER, "warning"
) as mock_warning:
_regional_access_boundary_utils._LOGGER, "debug"
) as mock_debug:
manager.start_refresh(credentials, request, rab_manager)
await manager._worker_task

mock_warning.assert_not_called()
mock_debug.assert_called_once()
assert "lookup raised an exception" in mock_debug.call_args[0][0]
rab_manager.process_regional_access_boundary_info.assert_called_once_with(None)


Expand Down
Loading