feat(secretmanager): adopt get_otel_channel_wrapper and apply_channel_wrappers

Author: chalmerlowe

packages/google-cloud-secret-manager/google/cloud/secretmanager_v1/services/secret_manager_service/client.py

@@ -13,7 +13,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-import functools
 import json
 import logging as std_logging
 import os
@@ -44,9 +43,10 @@
 from google.auth.exceptions import MutualTLSChannelError  # type: ignore
 from google.auth.transport import mtls  # type: ignore
 from google.auth.transport.grpc import SslCredentials  # type: ignore
-from google.cloud.secretmanager_v1 import gapic_version as package_version
 from google.oauth2 import service_account  # type: ignore
 
+from google.cloud.secretmanager_v1 import gapic_version as package_version
+
 try:
     OptionalRetry = Union[retries.Retry, gapic_v1.method._MethodDefault, None]
 except AttributeError:  # pragma: NO COVER
@@ -68,6 +68,7 @@
 import google.protobuf.field_mask_pb2 as field_mask_pb2  # type: ignore
 import google.protobuf.timestamp_pb2 as timestamp_pb2  # type: ignore
 from google.cloud.location import locations_pb2  # type: ignore
+
 from google.cloud.secretmanager_v1.services.secret_manager_service import pagers
 from google.cloud.secretmanager_v1.types import resources, service
 
@@ -757,17 +758,14 @@ def __init__(
                 "api_audience": self._client_options.api_audience,
             }
 
-            # When OpenTelemetry tracing is enabled, bind create_channel_with_otel
-            # using functools.partial and pass it as the channel factory.
-            # This preserves lazy channel instantiation inside the Transport and avoids
-            # duplicating channel initialization arguments here in the client.
+            # When OpenTelemetry tracing is enabled, obtain the channel wrapper
+            # and pass it to the transport.
             if transport_init is SecretManagerServiceGrpcTransport:
-                if _observability.is_otel_capabilities_enabled(self._client_options):
-                    transport_kwargs["channel"] = functools.partial(
-                        _observability.create_channel_with_otel,
-                        SecretManagerServiceGrpcTransport.create_channel,
-                        client_options=self._client_options,
-                    )
+                otel_wrapper = _observability.get_otel_channel_wrapper(
+                    self._client_options
+                )
+                if otel_wrapper is not None:
+                    transport_kwargs["wrappers"] = [otel_wrapper]
 
             self._transport = transport_init(**transport_kwargs)
 

packages/google-cloud-secret-manager/google/cloud/secretmanager_v1/services/secret_manager_service/transports/grpc.py

@@ -27,13 +27,14 @@
 import grpc  # type: ignore
 import proto  # type: ignore
 from google.api_core import gapic_v1, grpc_helpers
-from google.api_core.grpc_helpers import ClientInterceptor
+from google.api_core.grpc_helpers import ChannelWrapper
 from google.auth import credentials as ga_credentials  # type: ignore
 from google.auth.transport.grpc import SslCredentials  # type: ignore
 from google.cloud.location import locations_pb2  # type: ignore
-from google.cloud.secretmanager_v1.types import resources, service
 from google.protobuf.json_format import MessageToJson
 
+from google.cloud.secretmanager_v1.types import resources, service
+
 from .base import DEFAULT_CLIENT_INFO, SecretManagerServiceTransport
 
 try:
@@ -148,7 +149,7 @@ def __init__(
         client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
         always_use_jwt_access: Optional[bool] = False,
         api_audience: Optional[str] = None,
-        interceptors: Optional[Sequence[ClientInterceptor]] = None,
+        wrappers: Optional[Sequence[ChannelWrapper]] = None,
     ) -> None:
         """Instantiate the transport.
 
@@ -199,9 +200,9 @@ def __init__(
                 to the service that will be set when using certain 3rd party
                 authentication flows. Audience is typically a resource identifier.
                 If not set, the host value will be used as a default.
-            interceptors (Optional[Sequence[ClientInterceptor]]):
-                Additional interceptors to be injected into the gRPC channel pipeline.
-                These are executed in order.
+            wrappers (Optional[Sequence[ChannelWrapper]]):
+                Additional channel wrappers (interceptors or callables) to apply to the
+                gRPC channel.
 
         Raises:
           google.auth.exceptions.MutualTLSChannelError: If mutual TLS transport
@@ -278,8 +279,8 @@ def __init__(
                 ],
             )
 
-        self._grpc_channel = grpc_helpers.apply_interceptors(
-            self._grpc_channel, interceptors
+        self._grpc_channel = grpc_helpers.apply_channel_wrappers(
+            self._grpc_channel, wrappers
         )
 
         self._interceptor = _LoggingClientInterceptor()

packages/google-cloud-secret-manager/tests/unit/gapic/secretmanager_v1/test_secret_manager_service.py

@@ -62,14 +62,15 @@
 from google.auth import credentials as ga_credentials
 from google.auth.exceptions import MutualTLSChannelError
 from google.cloud.location import locations_pb2
+from google.oauth2 import service_account
+
 from google.cloud.secretmanager_v1.services.secret_manager_service import (
     SecretManagerServiceAsyncClient,
     SecretManagerServiceClient,
     pagers,
     transports,
 )
 from google.cloud.secretmanager_v1.types import resources, service
-from google.oauth2 import service_account
 
 CRED_INFO_JSON = {
     "credential_source": "/path/to/file",
@@ -773,73 +774,57 @@ def test_secret_manager_service_client_client_options(
 def test_secret_manager_service_client_otel_channel_injection_enabled():
     """Proves that when OpenTelemetry tracing is enabled:
 
-    1. SecretManagerServiceClient detects the feature flag via
-       _observability.is_otel_capabilities_enabled.
-    2. The client binds _observability.create_channel_with_otel using
-       functools.partial with SecretManagerServiceGrpcTransport.create_channel and client_options.
-    3. The bound channel factory callable is passed into transport kwargs under 'channel',
-       allowing the Transport to initialize the channel lazily with its own parameters.
+    1. SecretManagerServiceClient obtains the channel wrapper via
+       _observability.get_otel_channel_wrapper passing client_options.
+    2. The wrapper is passed into transport kwargs under 'wrappers',
+       allowing the Transport to apply it via apply_channel_wrappers.
     """
+    mock_wrapper = mock.Mock()
     with (
         mock.patch(
-            "google.cloud.secretmanager_v1.services.secret_manager_service.client._observability.is_otel_capabilities_enabled",
-            return_value=True,
-        ) as mock_is_enabled,
+            "google.cloud.secretmanager_v1.services.secret_manager_service.client._observability.get_otel_channel_wrapper",
+            return_value=mock_wrapper,
+        ) as mock_get_wrapper,
         mock.patch.object(
             transports.SecretManagerServiceGrpcTransport, "__init__", return_value=None
         ) as patched_transport_init,
     ):
         client = SecretManagerServiceClient(transport="grpc")
 
-        mock_is_enabled.assert_called_once()
+        mock_get_wrapper.assert_called_once_with(client._client_options)
         called_kwargs = patched_transport_init.call_args.kwargs
-        assert "channel" in called_kwargs
-        channel_factory = called_kwargs["channel"]
-        assert isinstance(channel_factory, functools.partial)
-        assert (
-            channel_factory.func
-            is google.cloud.secretmanager_v1.services.secret_manager_service.client._observability.create_channel_with_otel
-        )
-        assert channel_factory.args == (
-            transports.SecretManagerServiceGrpcTransport.create_channel,
-        )
-        assert channel_factory.keywords == {"client_options": client._client_options}
+        assert "wrappers" in called_kwargs
+        assert called_kwargs["wrappers"] == [mock_wrapper]
 
 
 def test_secret_manager_service_client_otel_channel_injection_disabled():
     """Proves that when OpenTelemetry tracing is disabled:
 
-    1. SecretManagerServiceClient checks the feature flag and finds it disabled.
-    2. Eager channel creation via _observability.create_channel_with_otel is skipped.
-    3. No 'channel' argument is passed to the transport constructor, preserving lazy
-       channel initialization in the transport.
+    1. SecretManagerServiceClient checks for an OTel wrapper and receives None.
+    2. No 'wrappers' argument is passed to the transport constructor.
     """
     with (
         mock.patch(
-            "google.cloud.secretmanager_v1.services.secret_manager_service.client._observability.is_otel_capabilities_enabled",
-            return_value=False,
-        ) as mock_is_enabled,
-        mock.patch(
-            "google.cloud.secretmanager_v1.services.secret_manager_service.client._observability.create_channel_with_otel",
-        ) as mock_create_channel_with_otel,
+            "google.cloud.secretmanager_v1.services.secret_manager_service.client._observability.get_otel_channel_wrapper",
+            return_value=None,
+        ) as mock_get_wrapper,
         mock.patch.object(
             transports.SecretManagerServiceGrpcTransport, "__init__", return_value=None
         ) as patched_transport_init,
     ):
-        SecretManagerServiceClient(transport="grpc")
+        client = SecretManagerServiceClient(transport="grpc")
 
-        mock_is_enabled.assert_called_once()
-        mock_create_channel_with_otel.assert_not_called()
+        mock_get_wrapper.assert_called_once_with(client._client_options)
         called_kwargs = patched_transport_init.call_args.kwargs
-        assert "channel" not in called_kwargs
+        assert "wrappers" not in called_kwargs
 
 
-def test_secret_manager_service_grpc_transport_interceptors():
-    """Proves that SecretManagerServiceGrpcTransport accepts custom client interceptors
-    and invokes grpc_helpers.apply_interceptors to inject them into the underlying
-    gRPC channel pipeline.
+def test_secret_manager_service_grpc_transport_wrappers():
+    """Proves that SecretManagerServiceGrpcTransport accepts channel wrappers
+    and invokes grpc_helpers.apply_channel_wrappers to apply them to the underlying
+    gRPC channel.
     """
-    mock_interceptor = mock.Mock()
+    mock_wrapper = mock.Mock()
     mock_channel = mock.Mock()
 
     with (
@@ -849,18 +834,35 @@ def test_secret_manager_service_grpc_transport_interceptors():
             return_value=mock_channel,
         ),
         mock.patch(
-            "google.api_core.grpc_helpers.apply_interceptors",
+            "google.api_core.grpc_helpers.apply_channel_wrappers",
             return_value=mock_channel,
-        ) as mock_apply_interceptors,
+        ) as mock_apply_wrappers,
     ):
-        transport = transports.SecretManagerServiceGrpcTransport(
-            interceptors=[mock_interceptor],
+        transports.SecretManagerServiceGrpcTransport(
+            wrappers=[mock_wrapper],
         )
 
-        mock_apply_interceptors.assert_called_once_with(
-            mock_channel, [mock_interceptor]
+        mock_apply_wrappers.assert_called_once_with(mock_channel, [mock_wrapper])
+
+
+def test_secret_manager_service_grpc_transport_custom_channel_wrappers():
+    """Proves that SecretManagerServiceGrpcTransport wraps explicitly passed custom channels
+    using grpc_helpers.apply_channel_wrappers.
+    """
+    mock_wrapper = mock.Mock()
+    mock_custom_channel = mock.Mock(spec=grpc.Channel)
+
+    with mock.patch(
+        "google.api_core.grpc_helpers.apply_channel_wrappers",
+        return_value=mock_custom_channel,
+    ) as mock_apply_wrappers:
+        transports.SecretManagerServiceGrpcTransport(
+            channel=mock_custom_channel,
+            wrappers=[mock_wrapper],
         )
 
+        mock_apply_wrappers.assert_called_once_with(mock_custom_channel, [mock_wrapper])
+
 
 @pytest.mark.parametrize(
     "client_class,transport_class,transport_name,use_client_cert_env",