google-cloud-alloydb-connector 1.8.1.dev0__py3-none-any.whl

google/api/field_behavior_pb2.py

@@ -0,0 +1,52 @@
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# type: ignore
+# -*- coding: utf-8 -*-
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# source: google/api/field_behavior.proto
+# isort: skip_file
+"""Generated protocol buffer code."""
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import descriptor_pool as _descriptor_pool
+from google.protobuf import symbol_database as _symbol_database
+from google.protobuf.internal import builder as _builder
+
+# @@protoc_insertion_point(imports)
+
+_sym_db = _symbol_database.Default()
+
+
+from google.protobuf import descriptor_pb2 as google_dot_protobuf_dot_descriptor__pb2
+
+
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(
+    b"\n\x1fgoogle/api/field_behavior.proto\x12\ngoogle.api\x1a google/protobuf/descriptor.proto*\xb6\x01\n\rFieldBehavior\x12\x1e\n\x1a\x46IELD_BEHAVIOR_UNSPECIFIED\x10\x00\x12\x0c\n\x08OPTIONAL\x10\x01\x12\x0c\n\x08REQUIRED\x10\x02\x12\x0f\n\x0bOUTPUT_ONLY\x10\x03\x12\x0e\n\nINPUT_ONLY\x10\x04\x12\r\n\tIMMUTABLE\x10\x05\x12\x12\n\x0eUNORDERED_LIST\x10\x06\x12\x15\n\x11NON_EMPTY_DEFAULT\x10\x07\x12\x0e\n\nIDENTIFIER\x10\x08:Q\n\x0e\x66ield_behavior\x12\x1d.google.protobuf.FieldOptions\x18\x9c\x08 \x03(\x0e\x32\x19.google.api.FieldBehaviorBp\n\x0e\x63om.google.apiB\x12\x46ieldBehaviorProtoP\x01ZAgoogle.golang.org/genproto/googleapis/api/annotations;annotations\xa2\x02\x04GAPIb\x06proto3"
+)
+
+_globals = globals()
+_builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
+_builder.BuildTopDescriptorsAndMessages(
+    DESCRIPTOR, "google.api.field_behavior_pb2", _globals
+)
+if _descriptor._USE_C_DESCRIPTORS == False:
+    google_dot_protobuf_dot_descriptor__pb2.FieldOptions.RegisterExtension(
+        field_behavior
+    )
+
+    DESCRIPTOR._options = None
+    DESCRIPTOR._serialized_options = b"\n\016com.google.apiB\022FieldBehaviorProtoP\001ZAgoogle.golang.org/genproto/googleapis/api/annotations;annotations\242\002\004GAPI"
+    _globals["_FIELDBEHAVIOR"]._serialized_start = 82
+    _globals["_FIELDBEHAVIOR"]._serialized_end = 264
+# @@protoc_insertion_point(module_scope)

google/cloud/alloydb/connector/__init__.py

@@ -0,0 +1,26 @@
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+from google.cloud.alloydb.connector.async_connector import AsyncConnector
+from google.cloud.alloydb.connector.connector import Connector
+from google.cloud.alloydb.connector.enums import IPTypes
+from google.cloud.alloydb.connector.enums import RefreshStrategy
+from google.cloud.alloydb.connector.version import __version__
+
+__all__ = [
+    "__version__",
+    "Connector",
+    "AsyncConnector",
+    "IPTypes",
+    "RefreshStrategy",
+]

google/cloud/alloydb/connector/async_connector.py

@@ -0,0 +1,245 @@
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from __future__ import annotations
+
+import asyncio
+import logging
+from types import TracebackType
+from typing import Any, Optional, TYPE_CHECKING
+
+import google.auth
+from google.auth.credentials import with_scopes_if_required
+import google.auth.transport.requests
+
+import google.cloud.alloydb.connector.asyncpg as asyncpg
+from google.cloud.alloydb.connector.client import AlloyDBClient
+from google.cloud.alloydb.connector.enums import IPTypes
+from google.cloud.alloydb.connector.enums import RefreshStrategy
+from google.cloud.alloydb.connector.exceptions import ClosedConnectorError
+from google.cloud.alloydb.connector.instance import RefreshAheadCache
+from google.cloud.alloydb.connector.lazy import LazyRefreshCache
+from google.cloud.alloydb.connector.types import CacheTypes
+from google.cloud.alloydb.connector.utils import generate_keys
+from google.cloud.alloydb.connector.utils import strip_http_prefix
+
+if TYPE_CHECKING:
+    from google.auth.credentials import Credentials
+
+logger = logging.getLogger(name=__name__)
+
+
+class AsyncConnector:
+    """A class to configure and create connections to Cloud SQL instances
+    asynchronously.
+
+    Args:
+        credentials (google.auth.credentials.Credentials):
+            A credentials object created from the google-auth Python library.
+            If not specified, Application Default Credentials are used.
+        quota_project (str): The Project ID for an existing Google Cloud
+            project. The project specified is used for quota and
+            billing purposes.
+            Defaults to None, picking up project from environment.
+        alloydb_api_endpoint (str): Base URL to use when calling
+            the AlloyDB API endpoint. Defaults to "alloydb.googleapis.com".
+        enable_iam_auth (bool): Enables automatic IAM database authentication.
+        ip_type (str | IPTypes): Default IP type for all AlloyDB connections.
+            Defaults to IPTypes.PRIVATE ("PRIVATE") for private IP connections.
+        refresh_strategy (str | RefreshStrategy): The default refresh strategy
+            used to refresh SSL/TLS cert and instance metadata. Can be one
+            of the following: RefreshStrategy.LAZY ("LAZY") or
+            RefreshStrategy.BACKGROUND ("BACKGROUND").
+            Default: RefreshStrategy.BACKGROUND
+    """
+
+    def __init__(
+        self,
+        credentials: Optional[Credentials] = None,
+        quota_project: Optional[str] = None,
+        alloydb_api_endpoint: str = "alloydb.googleapis.com",
+        enable_iam_auth: bool = False,
+        ip_type: str | IPTypes = IPTypes.PRIVATE,
+        user_agent: Optional[str] = None,
+        refresh_strategy: str | RefreshStrategy = RefreshStrategy.BACKGROUND,
+    ) -> None:
+        self._cache: dict[str, CacheTypes] = {}
+        # initialize default params
+        self._quota_project = quota_project
+        self._alloydb_api_endpoint = strip_http_prefix(alloydb_api_endpoint)
+        self._enable_iam_auth = enable_iam_auth
+        # if ip_type is str, convert to IPTypes enum
+        if isinstance(ip_type, str):
+            ip_type = IPTypes(ip_type.upper())
+        self._ip_type = ip_type
+        # if refresh_strategy is str, convert to RefreshStrategy enum
+        if isinstance(refresh_strategy, str):
+            refresh_strategy = RefreshStrategy(refresh_strategy.upper())
+        self._refresh_strategy = refresh_strategy
+        self._user_agent = user_agent
+        # initialize credentials
+        scopes = ["https://www.googleapis.com/auth/cloud-platform"]
+        if credentials:
+            self._credentials = with_scopes_if_required(credentials, scopes=scopes)
+        # otherwise use application default credentials
+        else:
+            self._credentials, _ = google.auth.default(scopes=scopes)
+
+        # check if AsyncConnector is being initialized with event loop running
+        # Otherwise we will lazy init keys
+        try:
+            self._keys: Optional[asyncio.Task] = asyncio.create_task(generate_keys())
+        except RuntimeError:
+            self._keys = None
+        self._client: Optional[AlloyDBClient] = None
+        self._closed = False
+
+    async def connect(
+        self,
+        instance_uri: str,
+        driver: str,
+        **kwargs: Any,
+    ) -> Any:
+        """
+        Asynchronously prepares and returns a database connection object.
+
+        Starts tasks to refresh the certificates and get
+        AlloyDB instance IP address. Creates a secure TLS connection
+        to establish connection to AlloyDB instance.
+
+        Args:
+            instance_uri (str): The instance URI of the AlloyDB instance.
+                ex. projects/<PROJECT>/locations/<REGION>/clusters/<CLUSTER>/instances/<INSTANCE>
+            driver (str): A string representing the database driver to connect
+                with. Supported drivers are asyncpg.
+            **kwargs: Pass in any database driver-specific arguments needed
+                to fine tune connection.
+
+        Returns:
+            connection: A DBAPI connection to the specified AlloyDB instance.
+        """
+        if self._closed:
+            raise ClosedConnectorError(
+                "Connection attempt failed because the connector has already been closed."
+            )
+        if self._keys is None:
+            self._keys = asyncio.create_task(generate_keys())
+        if self._client is None:
+            # lazy init client as it has to be initialized in async context
+            self._client = AlloyDBClient(
+                self._alloydb_api_endpoint,
+                self._quota_project,
+                self._credentials,
+                user_agent=self._user_agent,
+                driver=driver,
+            )
+
+        enable_iam_auth = kwargs.pop("enable_iam_auth", self._enable_iam_auth)
+
+        # use existing connection info if possible
+        if instance_uri in self._cache:
+            cache = self._cache[instance_uri]
+        else:
+            if self._refresh_strategy == RefreshStrategy.LAZY:
+                logger.debug(
+                    f"['{instance_uri}']: Refresh strategy is set to lazy refresh"
+                )
+                cache = LazyRefreshCache(instance_uri, self._client, self._keys)
+            else:
+                logger.debug(
+                    f"['{instance_uri}']: Refresh strategy is set to background"
+                    " refresh"
+                )
+                cache = RefreshAheadCache(instance_uri, self._client, self._keys)
+            self._cache[instance_uri] = cache
+            logger.debug(f"['{instance_uri}']: Connection info added to cache")
+
+        connect_func = {
+            "asyncpg": asyncpg.connect,
+        }
+        # only accept supported database drivers
+        try:
+            connector = connect_func[driver]
+        except KeyError:
+            raise ValueError(f"Driver '{driver}' is not a supported database driver.")
+
+        # Host and ssl options come from the certificates and instance IP
+        # address so we don't want the user to specify them.
+        kwargs.pop("host", None)
+        kwargs.pop("ssl", None)
+        kwargs.pop("port", None)
+
+        # get connection info for AlloyDB instance
+        ip_type: str | IPTypes = kwargs.pop("ip_type", self._ip_type)
+        # if ip_type is str, convert to IPTypes enum
+        if isinstance(ip_type, str):
+            ip_type = IPTypes(ip_type.upper())
+        try:
+            conn_info = await cache.connect_info()
+            ip_address = conn_info.get_preferred_ip(ip_type)
+        except Exception:
+            # with an error from AlloyDB API call or IP type, invalidate the
+            # cache and re-raise the error
+            await self._remove_cached(instance_uri)
+            raise
+        logger.debug(f"['{instance_uri}']: Connecting to {ip_address}:5433")
+
+        # callable to be used for auto IAM authn
+        def get_authentication_token() -> str:
+            """Get OAuth2 access token to be used for IAM database authentication"""
+            # refresh credentials if expired
+            if not self._credentials.valid:
+                request = google.auth.transport.requests.Request()
+                self._credentials.refresh(request)
+            return self._credentials.token
+
+        # if enable_iam_auth is set, use auth token as database password
+        if enable_iam_auth:
+            kwargs["password"] = get_authentication_token
+        try:
+            return await connector(
+                ip_address, await conn_info.create_ssl_context(), **kwargs
+            )
+        except Exception:
+            # we attempt a force refresh, then throw the error
+            await cache.force_refresh()
+            raise
+
+    async def _remove_cached(self, instance_uri: str) -> None:
+        """Stops all background refreshes and deletes the connection
+        info cache from the map of caches.
+        """
+        logger.debug(f"['{instance_uri}']: Removing connection info from cache")
+        # remove cache from stored caches and close it
+        cache = self._cache.pop(instance_uri)
+        await cache.close()
+
+    async def __aenter__(self) -> Any:
+        """Enter async context manager by returning Connector object"""
+        return self
+
+    async def __aexit__(
+        self,
+        exc_type: Optional[type[BaseException]],
+        exc_val: Optional[BaseException],
+        exc_tb: Optional[TracebackType],
+    ) -> None:
+        """Exit async context manager by closing Connector"""
+        await self.close()
+
+    async def close(self) -> None:
+        """Helper function to cancel RefreshAheadCaches' tasks
+        and close client."""
+        await asyncio.gather(*[cache.close() for cache in self._cache.values()])
+        self._closed = True

google/cloud/alloydb/connector/asyncpg.py

@@ -0,0 +1,63 @@
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import ssl
+from typing import Any, TYPE_CHECKING
+
+SERVER_PROXY_PORT = 5433
+
+if TYPE_CHECKING:
+    import asyncpg
+
+
+async def connect(
+    ip_address: str, ctx: ssl.SSLContext, **kwargs: Any
+) -> "asyncpg.Connection":
+    """Helper function to create an asyncpg DB-API connection object.
+
+    :type ip_address: str
+    :param ip_address: A string containing an IP address for the AlloyDB
+        instance.
+
+    :type ctx: ssl.SSLContext
+    :param ctx: An SSLContext object created from the AlloyDB server CA
+        cert and ephemeral cert.
+
+    :type kwargs: Any
+    :param kwargs: Keyword arguments for establishing asyncpg connection
+        object to AlloyDB instance.
+
+    :rtype: asyncpg.Connection
+    :returns: An asyncpg.Connection object to an AlloyDB instance.
+    """
+    try:
+        import asyncpg
+    except ImportError:
+        raise ImportError(
+            'Unable to import module "asyncpg." Please install and try again.'
+        )
+    user = kwargs.pop("user")
+    db = kwargs.pop("db")
+    passwd = kwargs.pop("password")
+
+    return await asyncpg.connect(
+        user=user,
+        database=db,
+        password=passwd,
+        host=ip_address,
+        port=SERVER_PROXY_PORT,
+        ssl=ctx,
+        direct_tls=True,
+        **kwargs,
+    )

google/cloud/alloydb/connector/client.py

@@ -0,0 +1,279 @@
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from __future__ import annotations
+
+import asyncio
+import logging
+from typing import Optional, TYPE_CHECKING
+
+from cryptography import x509
+from google.api_core.client_options import ClientOptions
+from google.api_core.gapic_v1.client_info import ClientInfo
+from google.auth.credentials import TokenState
+from google.auth.transport import requests
+import google.cloud.alloydb_v1beta as v1beta
+from google.protobuf import duration_pb2
+
+from google.cloud.alloydb.connector.connection_info import ConnectionInfo
+from google.cloud.alloydb.connector.version import __version__ as version
+
+if TYPE_CHECKING:
+    from google.auth.credentials import Credentials
+
+USER_AGENT: str = f"alloydb-python-connector/{version}"
+API_VERSION: str = "v1beta"
+
+logger = logging.getLogger(name=__name__)
+
+
+def _format_user_agent(
+    driver: Optional[str],
+    custom_user_agent: Optional[str],
+) -> str:
+    """
+    Appends user-defined user agents to the base default agent.
+    """
+    agent = f"{USER_AGENT}+{driver}" if driver else USER_AGENT
+    if custom_user_agent and isinstance(custom_user_agent, str):
+        agent = f"{agent} {custom_user_agent}"
+
+    return agent
+
+
+class AlloyDBClient:
+    def __init__(
+        self,
+        alloydb_api_endpoint: str,
+        quota_project: Optional[str],
+        credentials: Credentials,
+        client: Optional[v1beta.AlloyDBAdminAsyncClient] = None,
+        driver: Optional[str] = None,
+        user_agent: Optional[str] = None,
+    ) -> None:
+        """
+        Establish the client to be used for AlloyDB API requests.
+
+        Args:
+            alloydb_api_endpoint (str): Base URL to use when calling
+                the AlloyDB API endpoint.
+            quota_project (str): The Project ID for an existing Google Cloud
+                project. The project specified is used for quota and
+                billing purposes.
+            credentials (google.auth.credentials.Credentials):
+                A credentials object created from the google-auth Python library.
+                Must have the AlloyDB Admin scopes. For more info check out
+                https://google-auth.readthedocs.io/en/latest/.
+            client (v1beta.AlloyDBAdminAsyncClient): Async client used to make
+                requests to AlloyDB APIs.
+                Optional, defaults to None and creates new client.
+            driver (str): Database driver to be used by the client.
+            user_agent (str): The custom user-agent string to use in the HTTP
+                header when making requests to AlloyDB APIs.
+                Optional, defaults to None and uses a pre-defined one.
+        """
+        user_agent = _format_user_agent(driver, user_agent)
+
+        # TODO(rhatgadkar-goog): Rollback the PR of deciding between creating
+        # AlloyDBAdminClient or AlloyDBAdminAsyncClient when either
+        # https://github.com/grpc/grpc/issues/25364 is resolved or an async REST
+        # transport for AlloyDBAdminAsyncClient gets introduced.
+        # The issue is that the async gRPC transport does not work with multiple
+        # event loops in the same process. So all calls to the AlloyDB Admin
+        # API, even from multiple threads, need to be made to a single-event
+        # loop. See https://github.com/GoogleCloudPlatform/alloydb-python-connector/issues/435
+        # for more details.
+        self._is_sync = False
+        if client:
+            self._client = client
+        elif driver == "pg8000":
+            self._client = v1beta.AlloyDBAdminClient(
+                credentials=credentials,
+                transport="grpc",
+                client_options=ClientOptions(
+                    api_endpoint=alloydb_api_endpoint,
+                    quota_project_id=quota_project,
+                ),
+                client_info=ClientInfo(
+                    user_agent=user_agent,
+                ),
+            )
+            self._is_sync = True
+        else:
+            self._client = v1beta.AlloyDBAdminAsyncClient(
+                credentials=credentials,
+                transport="grpc_asyncio",
+                client_options=ClientOptions(
+                    api_endpoint=alloydb_api_endpoint,
+                    quota_project_id=quota_project,
+                ),
+                client_info=ClientInfo(
+                    user_agent=user_agent,
+                ),
+            )
+
+        self._credentials = credentials
+        # asyncpg does not currently support using metadata exchange
+        # only use metadata exchange for pg8000 driver
+        self._use_metadata = True if driver == "pg8000" else False
+        self._user_agent = user_agent
+
+    async def _get_metadata(
+        self,
+        project: str,
+        region: str,
+        cluster: str,
+        name: str,
+    ) -> dict[str, Optional[str]]:
+        """
+        Fetch the metadata for a given AlloyDB instance.
+
+        Call the AlloyDB APIs connectInfo method to retrieve the
+        information about an AlloyDB instance that is used to create secure
+        connections.
+
+        Args:
+            project (str): Google Cloud project ID that the AlloyDB instance
+                resides in.
+            region (str): Google Cloud region of the AlloyDB instance.
+            cluster (str): The name of the AlloyDB cluster.
+            name (str): The name of the AlloyDB instance.
+
+        Returns:
+            dict: IP addresses of the AlloyDB instance.
+        """
+        parent = (
+            f"projects/{project}/locations/{region}/clusters/{cluster}/instances/{name}"
+        )
+
+        req = v1beta.GetConnectionInfoRequest(parent=parent)
+        if self._is_sync:
+            resp = self._client.get_connection_info(request=req)
+        else:
+            resp = await self._client.get_connection_info(request=req)
+
+        # Remove trailing period from PSC DNS name.
+        psc_dns = resp.psc_dns_name
+        if psc_dns:
+            psc_dns = psc_dns.rstrip(".")
+
+        return {
+            "PRIVATE": resp.ip_address,
+            "PUBLIC": resp.public_ip_address,
+            "PSC": psc_dns,
+        }
+
+    async def _get_client_certificate(
+        self,
+        project: str,
+        region: str,
+        cluster: str,
+        pub_key: str,
+    ) -> tuple[str, list[str]]:
+        """
+        Fetch a client certificate for the given AlloyDB cluster.
+
+        Call the AlloyDB API's generateClientCertificate
+        method to create a signed TLS certificate that is authorized to connect via the
+        AlloyDB instance's serverside proxy. The cert is valid for twenty-four hours.
+
+        Args:
+            project (str): Google Cloud project ID that the AlloyDB instance
+                resides in.
+            region (str): Google Cloud region of the AlloyDB instance.
+            cluster (str): The name of the AlloyDB cluster.
+            pub_key (str): PEM-encoded client public key.
+
+        Returns:
+            tuple[str, list[str]]: tuple containing the CA certificate
+                and certificate chain for the AlloyDB instance.
+        """
+        parent = f"projects/{project}/locations/{region}/clusters/{cluster}"
+        dur = duration_pb2.Duration()
+        dur.seconds = 3600
+        req = v1beta.GenerateClientCertificateRequest(
+            parent=parent,
+            cert_duration=dur,
+            public_key=pub_key,
+            use_metadata_exchange=self._use_metadata,
+        )
+        if self._is_sync:
+            resp = self._client.generate_client_certificate(request=req)
+        else:
+            resp = await self._client.generate_client_certificate(request=req)
+        return (resp.ca_cert, resp.pem_certificate_chain)
+
+    async def get_connection_info(
+        self,
+        project: str,
+        region: str,
+        cluster: str,
+        name: str,
+        keys: asyncio.Future,
+    ) -> ConnectionInfo:
+        """Immediately performs a full refresh operation using the AlloyDB API.
+
+        Args:
+            project (str): The name of the project the AlloyDB instance is
+                located in.
+            region (str): The region the AlloyDB instance is located in.
+            cluster (str): The cluster the AlloyDB instance is located in.
+            name (str): Name of the AlloyDB instance.
+            keys (asyncio.Future): A future to the client's public-private key
+                pair.
+
+        Returns:
+            ConnectionInfo: All the information required to connect securely to
+                the AlloyDB instance.
+        """
+        priv_key, pub_key = await keys
+
+        # before making AlloyDB API calls, refresh creds if required
+        if not self._credentials.token_state == TokenState.FRESH:
+            self._credentials.refresh(requests.Request())
+
+        # fetch metadata
+        metadata_task = asyncio.create_task(
+            self._get_metadata(
+                project,
+                region,
+                cluster,
+                name,
+            )
+        )
+        # generate client and CA certs
+        certs_task = asyncio.create_task(
+            self._get_client_certificate(
+                project,
+                region,
+                cluster,
+                pub_key,
+            )
+        )
+
+        ip_addrs, certs = await asyncio.gather(metadata_task, certs_task)
+
+        # unpack certs
+        ca_cert, cert_chain = certs
+        # get expiration from client certificate
+        cert_obj = x509.load_pem_x509_certificate(cert_chain[0].encode("UTF-8"))
+        expiration = cert_obj.not_valid_after_utc
+
+        return ConnectionInfo(
+            cert_chain,
+            ca_cert,
+            priv_key,
+            ip_addrs,
+            expiration,
+        )