cloud-sql-python-connector 1.22.0__py3-none-any.whl → 1.24.0__py3-none-any.whl

google/cloud/sql/connector/connector.py

@@ -17,13 +17,17 @@ limitations under the License.
 from __future__ import annotations
 
 import asyncio
+from collections.abc import Callable
 from functools import partial
 import logging
 import os
+import random
 import socket
+import ssl
 from threading import Thread
+import time
 from types import TracebackType
-from typing import Any, Callable
+from typing import Any
 
 import google.auth
 from google.auth.credentials import Credentials
@@ -35,16 +39,22 @@ from google.cloud.sql.connector import psycopg
 from google.cloud.sql.connector import pymysql
 from google.cloud.sql.connector import pytds
 from google.cloud.sql.connector.client import CloudSQLClient
+from google.cloud.sql.connector.connection_info import ConnectionInfo
+from google.cloud.sql.connector.connection_name import ConnectionName
 from google.cloud.sql.connector.enums import DriverMapping
 from google.cloud.sql.connector.enums import IPTypes
 from google.cloud.sql.connector.enums import RefreshStrategy
 from google.cloud.sql.connector.exceptions import ClosedConnectorError
 from google.cloud.sql.connector.exceptions import ConnectorLoopError
+from google.cloud.sql.connector.exceptions import IncompatibleDriverError
+from google.cloud.sql.connector.exceptions import ResourceExhaustedError
 from google.cloud.sql.connector.instance import RefreshAheadCache
 from google.cloud.sql.connector.lazy import LazyRefreshCache
 from google.cloud.sql.connector.monitored_cache import MonitoredCache
+from google.cloud.sql.connector.postgres_connection import PostgresConnection
 from google.cloud.sql.connector.resolver import DefaultResolver
 from google.cloud.sql.connector.resolver import DnsResolver
+from google.cloud.sql.connector.sqldata_client import SqlDataClient
 from google.cloud.sql.connector.utils import format_database_user
 from google.cloud.sql.connector.utils import generate_keys
 
@@ -57,6 +67,49 @@ _DEFAULT_UNIVERSE_DOMAIN = "googleapis.com"
 _SQLADMIN_HOST_TEMPLATE = "sqladmin.{universe_domain}"
 
 
+class SqlDataConnState:
+    """Tracks connection state, fallback status, and resource exhaustion cooldown for SQL Data Service."""
+
+    def __init__(self) -> None:
+        self.allowed: bool = True
+        self.cooldown_until: float | None = None
+        self.backoff_counter: int = 0
+        self.last_err: Exception | None = None
+
+    def is_cooldown_active(self) -> bool:
+        """Returns True if the instance connection is in cooldown due to resource exhaustion."""
+        return bool(
+            self.allowed
+            and self.cooldown_until
+            and time.time() < self.cooldown_until
+        )
+
+    def record_exhausted(self, err: Exception, base_cooldown: float) -> float:
+        """Records a resource exhaustion error, increments backoff counter, and returns the cooldown duration."""
+        if self.backoff_counter < 5:
+            self.backoff_counter += 1
+        backoff = _cooldown_backoff(base_cooldown, self.backoff_counter)
+        self.cooldown_until = time.time() + backoff
+        self.last_err = err
+        return backoff
+
+    def record_success(self) -> None:
+        """Resets cooldown and backoff state on successful communication."""
+        self.backoff_counter = 0
+        self.cooldown_until = None
+        self.last_err = None
+
+    def record_fallback(self) -> None:
+        """Marks SQL Data Service as not allowed for this instance."""
+        self.allowed = False
+
+
+def _cooldown_backoff(base_cooldown: float, attempt: int) -> float:
+    multi = 1.618
+    exp = float(attempt - 1) + random.random()
+    return base_cooldown * (multi**exp)
+
+
 class Connector:
     """Configure and create secure connections to Cloud SQL."""
 
@@ -74,14 +127,20 @@ class Connector:
         refresh_strategy: str | RefreshStrategy = RefreshStrategy.BACKGROUND,
         resolver: type[DefaultResolver | DnsResolver] = DefaultResolver,
         failover_period: int = 30,
+        sql_data_endpoint: str | None = None,
+        sql_data_stream_timeout: int = 7200,
+        resource_exhausted_cooldown_period: float = 5.0,
     ) -> None:
         """Initializes a Connector instance.
 
         Args:
             ip_type (str | IPTypes): The default IP address type used to connect to
                 Cloud SQL instances. Can be one of the following:
-                IPTypes.PUBLIC ("PUBLIC"), IPTypes.PRIVATE ("PRIVATE"), or
-                IPTypes.PSC ("PSC"). Default: IPTypes.PUBLIC
+                IPTypes.PUBLIC ("PUBLIC"), IPTypes.PRIVATE ("PRIVATE"),
+                IPTypes.PSC ("PSC"), or IPTypes.SQL_DATA ("SQL_DATA").
+                Note: IPTypes.SQL_DATA is not currently supported with the
+                asyncpg driver.
+                Default: IPTypes.PUBLIC
 
             enable_iam_auth (bool): Enables automatic IAM database authentication
                 (Postgres and MySQL) as the default authentication method for all
@@ -126,6 +185,16 @@ class Connector:
                 attempt to check if a failover has occured for a given instance.
                 Must be used with `resolver=DnsResolver` to have any effect.
                 Default: 30
+
+            sql_data_endpoint (str | None): Endpoint host for SQL Data Service
+                calls. If not specified, derived from `sqladmin_api_endpoint`.
+                Default: "sqladmin.googleapis.com".
+
+            sql_data_stream_timeout (int): Timeout in seconds for the SQL Data
+                Service gRPC stream. Default: 7200.
+
+            resource_exhausted_cooldown_period (float): Cooldown period in seconds
+                after a ResourceExhausted error. Default: 5.0.
         """
         # if refresh_strategy is str, convert to RefreshStrategy enum
         if isinstance(refresh_strategy, str):
@@ -214,6 +283,22 @@ class Connector:
                 "configured the universe domain explicitly, `googleapis.com` "
                 "is the default."
             )
+        if sql_data_endpoint:
+            self._sql_data_endpoint = sql_data_endpoint
+        else:
+            self._sql_data_endpoint = (
+                self._sqladmin_api_endpoint.split("://", 1)[-1].split("/", 1)[0]
+            )
+        self._sql_data_stream_timeout = sql_data_stream_timeout
+        self._resource_exhausted_cooldown_period = (
+            resource_exhausted_cooldown_period
+        )
+        self._sql_data_fallback_cache: set[str] = set()
+        self._sql_data_conn_state: dict[str, SqlDataConnState] = {}
+        self._sqldata_clients: set[Any] = set()
+        self._sqldata_client: SqlDataClient | None = None
+
+
 
     @property
     def universe_domain(self) -> str:
@@ -260,6 +345,63 @@ class Connector:
         )
         return connect_future.result()
 
+    def _get_or_create_cache(
+        self,
+        conn_name: ConnectionName,
+        enable_iam_auth: bool,
+        ip_type: IPTypes | None = None,
+    ) -> MonitoredCache:
+        assert self._client is not None, "client must be initialized before creating cache"
+        assert self._keys is not None, "keys must be initialized before creating cache"
+        assert self._resolver is not None, "resolver must be initialized before creating cache"
+        if (str(conn_name), enable_iam_auth) in self._cache and not self._cache[
+            (str(conn_name), enable_iam_auth)
+        ].closed:
+            return self._cache[(str(conn_name), enable_iam_auth)]
+
+        effective_ip_type = ip_type if ip_type is not None else self._ip_type
+        dial_func = partial(
+            self._dial_probe_connection,
+            enable_iam_auth=enable_iam_auth,
+            ip_type=effective_ip_type,
+        )
+
+        if self._refresh_strategy == RefreshStrategy.LAZY:
+            logger.debug(
+                f"['{conn_name}']: Refresh strategy is set to lazy refresh"
+            )
+            cache: LazyRefreshCache | RefreshAheadCache = LazyRefreshCache(
+                conn_name,
+                self._client,
+                self._keys,
+                enable_iam_auth,
+                ip_type=effective_ip_type,
+                timeout=self._timeout,
+                dial_func=dial_func,
+            )
+        else:
+            logger.debug(
+                f"['{conn_name}']: Refresh strategy is set to backgound refresh"
+            )
+            cache = RefreshAheadCache(
+                conn_name,
+                self._client,
+                self._keys,
+                enable_iam_auth,
+                ip_type=effective_ip_type,
+                timeout=self._timeout,
+                dial_func=dial_func,
+            )
+        # wrap cache as a MonitoredCache
+        monitored_cache = MonitoredCache(
+            cache,
+            self._failover_period,
+            self._resolver,
+        )
+        logger.debug(f"['{conn_name}']: Connection info added to cache")
+        self._cache[(str(conn_name), enable_iam_auth)] = monitored_cache
+        return monitored_cache
+
     async def connect_async(
         self, instance_connection_string: str, driver: str, **kwargs: Any
     ) -> Any:
@@ -321,42 +463,15 @@ class Connector:
         if self._resolver is None:
             self._resolver = self._resolver_cls(client=self._client)
         enable_iam_auth = kwargs.pop("enable_iam_auth", self._enable_iam_auth)
+        ip_type = kwargs.pop("ip_type", self._ip_type)
+        if isinstance(ip_type, str):
+            ip_type = IPTypes._from_str(ip_type)
 
         conn_name = await self._resolver.resolve(instance_connection_string)
-        # Cache entry must exist and not be closed
-        if (str(conn_name), enable_iam_auth) in self._cache and not self._cache[
-            (str(conn_name), enable_iam_auth)
-        ].closed:
-            monitored_cache = self._cache[(str(conn_name), enable_iam_auth)]
-        else:
-            if self._refresh_strategy == RefreshStrategy.LAZY:
-                logger.debug(
-                    f"['{conn_name}']: Refresh strategy is set to lazy refresh"
-                )
-                cache: LazyRefreshCache | RefreshAheadCache = LazyRefreshCache(
-                    conn_name,
-                    self._client,
-                    self._keys,
-                    enable_iam_auth,
-                )
-            else:
-                logger.debug(
-                    f"['{conn_name}']: Refresh strategy is set to backgound refresh"
-                )
-                cache = RefreshAheadCache(
-                    conn_name,
-                    self._client,
-                    self._keys,
-                    enable_iam_auth,
-                )
-            # wrap cache as a MonitoredCache
-            monitored_cache = MonitoredCache(
-                cache,
-                self._failover_period,
-                self._resolver,
+        if ip_type != IPTypes.SQL_DATA:
+            monitored_cache = self._get_or_create_cache(
+                conn_name, enable_iam_auth, ip_type
             )
-            logger.debug(f"['{conn_name}']: Connection info added to cache")
-            self._cache[(str(conn_name), enable_iam_auth)] = monitored_cache
 
         connect_func = {
             "pymysql": pymysql.connect,
@@ -371,11 +486,6 @@ class Connector:
             connector: Callable = connect_func[driver]  # type: ignore
         except KeyError:
             raise KeyError(f"Driver '{driver}' is not supported.")
-
-        ip_type = kwargs.pop("ip_type", self._ip_type)
-        # if ip_type is str, convert to IPTypes enum
-        if isinstance(ip_type, str):
-            ip_type = IPTypes._from_str(ip_type)
         kwargs["timeout"] = kwargs.get("timeout", self._timeout)
 
         # Host and ssl options come from the certificates and metadata, so we don't
@@ -384,113 +494,206 @@ class Connector:
         kwargs.pop("ssl", None)
         kwargs.pop("port", None)
 
-        # attempt to get connection info for Cloud SQL instance
+        # attempt to establish connection
         try:
-            conn_info = await monitored_cache.connect_info()
-            # validate driver matches intended database engine
-            DriverMapping.validate_engine(driver, conn_info.database_version)
-            preferred_ips = conn_info.get_preferred_ips(ip_type)
-        except Exception:
-            # with an error from Cloud SQL Admin API call or IP type, invalidate
-            # the cache and re-raise the error
-            await self._remove_cached(str(conn_name), enable_iam_auth)
-            raise
-
-        targets = []
-        # If the connector is configured with a custom DNS name, attempt to use
-        # that DNS name to connect to the instance. Fall back to the metadata IP
-        # address if the DNS name does not resolve to an IP address.
-        if conn_info.conn_name.domain_name and isinstance(self._resolver, DnsResolver):
-            try:
-                ips = await self._resolver.resolve_a_record(conn_info.conn_name.domain_name)
-                if ips:
-                    targets.extend(ips)
+            if ip_type == IPTypes.SQL_DATA:
+                if driver in ASYNC_DRIVERS:
+                    raise IncompatibleDriverError(
+                        f"Driver '{driver}' is not supported with ip_type '{ip_type}'."
+                    )
+                state = self._sql_data_conn_state.setdefault(
+                    str(conn_name), SqlDataConnState()
+                )
+                if state.is_cooldown_active():
                     logger.debug(
-                        f"['{instance_connection_string}']: Custom DNS name "
-                        f"'{conn_info.conn_name.domain_name}' resolved to '{ips}', "
-                        "using it to connect"
+                        f"['{conn_name}']: SQL Data Service in cooldown until {state.cooldown_until}"
+                    )
+                    raise ResourceExhaustedError(
+                        "cooldown active", str(conn_name), state.last_err
+                    )
+
+                logger.debug(f"['{conn_name}']: Connecting via SQL Data Service tunnel")
+                if enable_iam_auth:
+                    engine = DriverMapping[driver.upper()].value
+                    formatted_user = format_database_user(
+                        engine, kwargs["user"]
+                    )
+                    if formatted_user != kwargs["user"]:
+                        logger.debug(
+                            f"['{instance_connection_string}']: Truncated IAM database username from {kwargs['user']} to {formatted_user}"
+                        )
+                        kwargs["user"] = formatted_user
+
+                if self._sqldata_client is None:
+                    sqldata_client = SqlDataClient(
+                        endpoint=self._sql_data_endpoint,
+                        credentials=self._credentials,
+                        quota_project=self._quota_project,
+                        timeout=self._sql_data_stream_timeout,
+                    )
+                    self._sqldata_client = sqldata_client
+                    self._sqldata_clients.add(sqldata_client)
+                    sqldata_client._on_close_callbacks.append(
+                        lambda: self._sqldata_clients.discard(sqldata_client)
                     )
                 else:
+                    sqldata_client = self._sqldata_client
+
+                def on_resource_exhausted(err: Exception) -> None:
+                    backoff = state.record_exhausted(
+                        err, self._resource_exhausted_cooldown_period
+                    )
                     logger.debug(
-                        f"['{instance_connection_string}']: Custom DNS name "
-                        f"'{conn_info.conn_name.domain_name}' resolved but returned no "
-                        f"entries, using '{preferred_ips}' from instance metadata"
+                        f"['{conn_name}']: ResourceExhausted occurred, backing off for {backoff:.2f}s "
+                        f"(attempt {state.backoff_counter})"
                     )
-                    targets.extend(preferred_ips)
-            except Exception as e:  # noqa: BLE001
-                logger.debug(
-                    f"['{instance_connection_string}']: Custom DNS name "
-                    f"'{conn_info.conn_name.domain_name}' did not resolve to an IP "
-                    f"address: {e}, using '{preferred_ips}' from instance metadata"
-                )
-                targets.extend(preferred_ips)
-        else:
-            targets.extend(preferred_ips)
 
-        # format `user` param for automatic IAM database authn
-        if enable_iam_auth:
-            formatted_user = format_database_user(
-                conn_info.database_version, kwargs["user"]
-            )
-            if formatted_user != kwargs["user"]:
-                logger.debug(
-                    f"['{instance_connection_string}']: Truncated IAM database username from {kwargs['user']} to {formatted_user}"
+                def on_success() -> None:
+                    state.record_success()
+
+                def on_fallback(name: str) -> None:
+                    state.record_fallback()
+                    self._sql_data_fallback_cache.add(name)
+
+                def is_fallback_cached(name: str) -> bool:
+                    return not state.allowed or name in self._sql_data_fallback_cache
+
+                # Defer cache creation and connect_info call
+                async def get_conn_info():
+                    cache = self._get_or_create_cache(conn_name, enable_iam_auth)
+                    return await cache.connect_info()
+
+                sock = await sqldata_client.connect(
+                    instance_connection_name=str(conn_name),
+                    region=conn_name.region,
+                    project=conn_name.project,
+                    get_conn_info=get_conn_info,
+                    enable_iam_auth=enable_iam_auth,
+                    on_fallback=on_fallback,
+                    is_fallback_cached=is_fallback_cached,
+                    on_resource_exhausted=on_resource_exhausted,
+                    on_success=on_success,
+                    connect_timeout=kwargs.get("timeout", self._timeout),
                 )
-                kwargs["user"] = formatted_user
 
-        try:
-            last_ex = None
-            for target_ip in targets:
-                logger.debug(f"['{conn_info.conn_name}']: Connecting to {target_ip}:3307")
+                cache = None
+                if conn_name.domain_name:
+                    cache = self._get_or_create_cache(conn_name, enable_iam_auth)
+                    cache.sockets.append(sock)
+
+                connect_partial = partial(
+                    connector,
+                    "127.0.0.1",
+                    sock,
+                    **kwargs,
+                )
                 try:
-                    # async drivers are unblocking and can be awaited directly
-                    if driver in ASYNC_DRIVERS:
-                        conn = await connector(
+                    return await self._loop.run_in_executor(None, connect_partial)
+                except Exception:
+                    sock.close()
+                    if conn_name.domain_name and cache:
+                        cache._purge_closed_sockets()
+                    raise
+            else:
+                try:
+                    conn_info = await monitored_cache.connect_info()
+                    # validate driver matches intended database engine
+                    DriverMapping.validate_engine(driver, conn_info.database_version)
+                    preferred_ips = conn_info.get_preferred_ips(ip_type)
+                except Exception:
+                    # with an error from Cloud SQL Admin API call or IP type, invalidate
+                    # the cache and re-raise the error
+                    await self._remove_cached(str(conn_name), enable_iam_auth)
+                    raise
+
+                targets = await self._resolve_targets(conn_info, preferred_ips)
+                # format `user` param for automatic IAM database authn
+                if enable_iam_auth:
+                    formatted_user = format_database_user(
+                        conn_info.database_version, kwargs["user"]
+                    )
+                    if formatted_user != kwargs["user"]:
+                        logger.debug(
+                            f"['{instance_connection_string}']: Truncated IAM database username from {kwargs['user']} to {formatted_user}"
+                        )
+                        kwargs["user"] = formatted_user
+
+                last_ex = None
+                for target_ip in targets:
+                    logger.debug(f"['{conn_info.conn_name}']: Connecting to {target_ip}:3307")
+                    try:
+                        # async drivers are unblocking and can be awaited directly
+                        if driver in ASYNC_DRIVERS:
+                            conn = await connector(
+                                target_ip,
+                                await conn_info.create_ssl_context(enable_iam_auth),
+                                **kwargs,
+                            )
+                            if (
+                                enable_iam_auth
+                                and conn_info.database_version.startswith("POSTGRES")
+                            ):
+                                db_name = kwargs.get("database")
+                                if db_name is None:
+                                    db_name = kwargs.get("db")
+                                user = kwargs.get("user")
+                                if user:
+                                    monitored_cache.record_principal(
+                                        str(user),
+                                        str(db_name) if db_name else str(user),
+                                    )
+                            last_ex = None
+                            return conn
+
+                        # Create socket with SSLContext for sync drivers
+                        ctx = await conn_info.create_ssl_context(enable_iam_auth)
+                        raw_sock = socket.create_connection((target_ip, SERVER_PROXY_PORT))
+                        sync_sock: socket.socket | ssl.SSLSocket | PostgresConnection
+                        try:
+                            sync_sock = ctx.wrap_socket(
+                                raw_sock,
+                                server_hostname=target_ip,
+                            )
+                        except Exception:
+                            raw_sock.close()
+                            raise
+
+                        if (
+                            enable_iam_auth
+                            and conn_info.database_version.startswith("POSTGRES")
+                        ):
+                            sync_sock = PostgresConnection(
+                                sync_sock,
+                                on_startup=monitored_cache.record_principal,
+                            )
+
+                        # If this connection was opened using a domain name, then store it
+                        # for later in case we need to forcibly close it on failover.
+                        if conn_info.conn_name.domain_name:
+                            monitored_cache.sockets.append(sync_sock)
+                        # Synchronous drivers are blocking and run using executor
+                        connect_partial = partial(
+                            connector,
                             target_ip,
-                            await conn_info.create_ssl_context(enable_iam_auth),
+                            sync_sock,
                             **kwargs,
                         )
+                        conn = await self._loop.run_in_executor(None, connect_partial)
                         last_ex = None
                         return conn
-
-                    # Create socket with SSLContext for sync drivers
-                    ctx = await conn_info.create_ssl_context(enable_iam_auth)
-                    raw_sock = socket.create_connection((target_ip, SERVER_PROXY_PORT))
-                    try:
-                        sock = ctx.wrap_socket(
-                            raw_sock,
-                            server_hostname=target_ip,
+                    except Exception as e:  # noqa: BLE001
+                        logger.debug(
+                            f"['{conn_info.conn_name}']: Connection to {target_ip} failed: {e}"
                         )
-                    except Exception:
-                        raw_sock.close()
-                        raise
-
-                    # If this connection was opened using a domain name, then store it
-                    # for later in case we need to forcibly close it on failover.
-                    if conn_info.conn_name.domain_name:
-                        monitored_cache.sockets.append(sock)
-                    # Synchronous drivers are blocking and run using executor
-                    connect_partial = partial(
-                        connector,
-                        target_ip,
-                        sock,
-                        **kwargs,
-                    )
-                    conn = await self._loop.run_in_executor(None, connect_partial)
-                    last_ex = None
-                    return conn
-                except Exception as e:  # noqa: BLE001
-                    logger.debug(
-                        f"['{conn_info.conn_name}']: Connection to {target_ip} failed: {e}"
-                    )
-                    last_ex = e
-
-            if last_ex:
-                raise last_ex
+                        last_ex = e
+                if last_ex:
+                    raise last_ex
 
         except Exception:
             # with any exception, we attempt a force refresh, then throw the error
-            await monitored_cache.force_refresh()
+            cached_entry = self._cache.get((str(conn_name), enable_iam_auth))
+            if cached_entry:
+                await cached_entry.force_refresh()
             raise
 
     async def _remove_cached(
@@ -506,6 +709,87 @@ class Connector:
         cache = self._cache.pop((instance_connection_string, enable_iam_auth))
         await cache.close()
 
+    async def _resolve_targets(
+        self,
+        conn_info: ConnectionInfo,
+        preferred_ips: list[str],
+    ) -> list[str]:
+        """Resolves target IP addresses for a Cloud SQL instance, with DNS fallback."""
+        targets: list[str] = []
+        if conn_info.conn_name.domain_name and isinstance(self._resolver, DnsResolver):
+            try:
+                ips = await self._resolver.resolve_a_record(
+                    conn_info.conn_name.domain_name
+                )
+                if ips:
+                    targets.extend(ips)
+                    logger.debug(
+                        f"['{conn_info.conn_name}']: Custom DNS name "
+                        f"'{conn_info.conn_name.domain_name}' resolved to '{ips}', "
+                        "using it to connect"
+                    )
+                else:
+                    logger.debug(
+                        f"['{conn_info.conn_name}']: Custom DNS name "
+                        f"'{conn_info.conn_name.domain_name}' resolved but returned no "
+                        f"entries, using '{preferred_ips}' from instance metadata"
+                    )
+                    targets.extend(preferred_ips)
+            except Exception as e:  # noqa: BLE001
+                logger.debug(
+                    f"['{conn_info.conn_name}']: Custom DNS name "
+                    f"'{conn_info.conn_name.domain_name}' did not resolve to an IP "
+                    f"address: {e}, using '{preferred_ips}' from instance metadata"
+                )
+                targets.extend(preferred_ips)
+        else:
+            targets.extend(preferred_ips)
+        return targets
+
+    async def _dial_probe_connection(
+        self,
+        conn_info: ConnectionInfo,
+        enable_iam_auth: bool,
+        ip_type: IPTypes | None = None,
+    ) -> tuple[asyncio.StreamReader, asyncio.StreamWriter]:
+        """Dials a TLS probe connection using the connector's IP resolution and SSLContext."""
+        effective_ip_type = ip_type if ip_type is not None else self._ip_type
+        preferred_ips = conn_info.get_preferred_ips(effective_ip_type)
+        targets = await self._resolve_targets(conn_info, preferred_ips)
+
+        if not targets:
+            raise ConnectionError(
+                f"No target IP addresses found for {conn_info.conn_name}"
+            )
+
+        ssl_context = await conn_info.create_ssl_context(enable_iam_auth)
+        server_hostname = (
+            conn_info.conn_name.domain_name
+            if conn_info.conn_name.domain_name
+            else None
+        )
+
+        last_err: Exception | None = None
+        for target in targets:
+            try:
+                reader, writer = await asyncio.wait_for(
+                    asyncio.open_connection(
+                        host=target,
+                        port=SERVER_PROXY_PORT,
+                        ssl=ssl_context,
+                        server_hostname=server_hostname,
+                    ),
+                    timeout=float(max(1, self._timeout)),
+                )
+                return reader, writer
+            except Exception as e:  # noqa: BLE001
+                last_err = e
+        if last_err:
+            raise last_err
+        raise ConnectionError(
+            f"Failed to connect to any target for {conn_info.conn_name}"
+        )
+
     def __enter__(self) -> Any:
         """Enter context manager by returning Connector object"""
         return self
@@ -538,8 +822,11 @@ class Connector:
             close_future = asyncio.run_coroutine_threadsafe(
                 self.close_async(), loop=self._loop
             )
-            # Will attempt to safely shut down tasks for 3s
-            close_future.result(timeout=3)
+            try:
+                # Will attempt to safely shut down tasks for 3s
+                close_future.result(timeout=3)
+            except Exception as e:  # noqa: BLE001
+                logger.error(f"Error during close_async: {e}")
         # if background thread exists for Connector, clean it up
         if self._thread:
             if self._loop.is_running():
@@ -552,9 +839,14 @@ class Connector:
         """Helper function to cancel the cache's tasks
         and close aiohttp.ClientSession."""
         self._closed = True
+        self._sqldata_client = None
         if self._client:
             await self._client.close()
-        await asyncio.gather(*[cache.close() for cache in self._cache.values()])
+        await asyncio.gather(
+            *[cache.close() for cache in self._cache.values()],
+            *[client.close() for client in list(self._sqldata_clients)],
+            return_exceptions=True,
+        )
 
 
 async def create_async_connector(
@@ -570,6 +862,9 @@ async def create_async_connector(
     refresh_strategy: str | RefreshStrategy = RefreshStrategy.BACKGROUND,
     resolver: type[DefaultResolver | DnsResolver] = DefaultResolver,
     failover_period: int = 30,
+    sql_data_endpoint: str | None = None,
+    sql_data_stream_timeout: int = 7200,
+    resource_exhausted_cooldown_period: float = 5.0,
 ) -> Connector:
     """Helper function to create Connector object for asyncio connections.
 
@@ -579,8 +874,11 @@ async def create_async_connector(
     Args:
         ip_type (str | IPTypes): The default IP address type used to connect to
             Cloud SQL instances. Can be one of the following:
-            IPTypes.PUBLIC ("PUBLIC"), IPTypes.PRIVATE ("PRIVATE"), or
-            IPTypes.PSC ("PSC"). Default: IPTypes.PUBLIC
+            IPTypes.PUBLIC ("PUBLIC"), IPTypes.PRIVATE ("PRIVATE"),
+            IPTypes.PSC ("PSC"), or IPTypes.SQL_DATA ("SQL_DATA").
+            Note: IPTypes.SQL_DATA is not currently supported with the
+            asyncpg driver.
+            Default: IPTypes.PUBLIC
 
         enable_iam_auth (bool): Enables automatic IAM database authentication
             (Postgres and MySQL) as the default authentication method for all
@@ -626,6 +924,16 @@ async def create_async_connector(
             Must be used with `resolver=DnsResolver` to have any effect.
             Default: 30
 
+        sql_data_endpoint (str | None): Endpoint host for SQL Data Service
+            calls. If not specified, derived from `sqladmin_api_endpoint`.
+            Default: "sqladmin.googleapis.com".
+
+        sql_data_stream_timeout (int): Timeout in seconds for the SQL Data
+            Service gRPC stream. Default: 7200.
+
+        resource_exhausted_cooldown_period (float): Cooldown period in seconds
+            after a ResourceExhausted error. Default: 5.0.
+
     Returns:
         A Connector instance configured with running event loop.
     """
@@ -645,4 +953,7 @@ async def create_async_connector(
         refresh_strategy=refresh_strategy,
         resolver=resolver,
         failover_period=failover_period,
+        sql_data_endpoint=sql_data_endpoint,
+        sql_data_stream_timeout=sql_data_stream_timeout,
+        resource_exhausted_cooldown_period=resource_exhausted_cooldown_period,
     )