experiment(secretmanager): Otel tracing prototype in google-cloud-secretmanager by chalmerlowe · Pull Request #18086 · googleapis/google-cloud-python

chalmerlowe · 2026-08-12T13:11:46Z

Problem

Need to demonstrate and verify how generated Google Cloud Python clients should interact with the new custom tracer provider plumbing in google-api-core, specifically for gRPC.

Note

This Pull Request is Prototype Only and is illustrative of what the GAPIC (Google API Client) generator should produce. The changes in google-cloud-secret-manager are intended to inform generator template updates and/or base classes, not necessarily to be merged as handwritten code.

Solution

This Pull Request updates the google-cloud-secret-manager package to demonstrate end-to-end custom tracer provider injection and custom span attributes.

Transport Configuration: Updated SecretManagerServiceClient to pass self._client_options as the configuration parameter when initializing transports.
Transport Updates: Updated gRPC and REST transports to accept and pass through the configuration parameter.
Custom Attributes: Added custom Google Cloud Platform attributes (service, version, repo, artifact) to the generated spans in access_secret_version.
Observability Tests: Added unit tests in test_observability.py to verify that custom spans are created with the correct attributes when tracing is enabled.

Notes to Reviewers

Dependencies: This Pull Request depends on the changes in google-api-core introduced in the companion PR feat(api-core): Opentelemetry tracing support for gRPC transports in google-api-core #18069 (Core Tracing Infrastructure).

…c.intercept_channel

chalmerlowe · 2026-08-12T13:12:28Z

DO NOT MERGE label added because this is an experiment to help define what changes should go into the GAPIC generator.

gemini-code-assist

Code Review

This pull request introduces OpenTelemetry tracing support for gRPC channels in google-api-core and google-cloud-secret-manager by adding a tracer_provider option to ClientOptions and intercepting gRPC channels when tracing is enabled. The review feedback suggests defining configuration as an explicit parameter in the create_channel signatures instead of popping it from kwargs, addressing the unused configuration parameter in the REST transport, and adding test coverage to verify custom tracer provider injection rather than relying solely on the global provider.

gemini-code-assist · 2026-08-12T13:14:50Z

+    # NOTE: 'configuration' is popped to prevent a TypeError.
+    # Generated async transports (like those in secretmanager) pass 'configuration'
+    # down to this helper via **kwargs to support tracing in sync transports.
+    # However, 'aio.secure_channel' does not recognize this parameter and will
+    # crash if it is passed through.
+    # Async gRPC tracing is deferred to a future phase/PR, so we simply discard
+    # this parameter for now to ensure generated async code doesn't fail at runtime.
+    kwargs.pop("configuration", None)


Instead of manually popping configuration from kwargs inside the function body, consider adding configuration: Optional[object] = None as an explicit parameter to the create_channel function signature. Since named parameters are not captured in **kwargs, this will automatically prevent configuration from being passed down to aio.secure_channel, eliminating the need for this manual pop and the associated comment while improving type safety and discoverability.

gemini-code-assist · 2026-08-12T13:14:50Z

        target = _modify_target_for_direct_path(target)

-    return grpc.secure_channel(
+    configuration = kwargs.pop("configuration", None)


Instead of popping configuration from kwargs here, consider adding configuration: Optional[object] = None as an explicit parameter to the create_channel function signature. This makes the parameter explicit, improves discoverability, and allows static analysis tools to type-check it properly.

gemini-code-assist · 2026-08-12T13:14:50Z

        url_scheme: str = "https",
        interceptor: Optional[SecretManagerServiceRestInterceptor] = None,
        api_audience: Optional[str] = None,
+        configuration=None,


The configuration parameter is accepted in __init__ but is never stored (e.g., self._configuration = configuration) or used within the REST transport. If tracing is to be supported or if this parameter is intended for future use, it should be stored or passed to the base class/helpers. Otherwise, it is currently a dead parameter.

gemini-code-assist · 2026-08-12T13:14:50Z

+def test_access_secret_version_custom_span(setup_otel, monkeypatch):
+    """Verify that calling access_secret_version produces a custom T3 span with attributes."""
+
+    # Enable tracing via env var (assuming this is how we gate it for clients too)
+    monkeypatch.setenv("GOOGLE_CLOUD_PYTHON_TRACING_ENABLED", "true")
+
+    client = secretmanager_v1.SecretManagerServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )


The observability tests currently only verify tracing using the global tracer provider (via the setup_otel fixture). Since the primary goal of this PR is to support custom tracer provider injection via ClientOptions, it would be highly beneficial to add a test case that explicitly passes a custom tracer_provider to the client's client_options and asserts that spans are recorded on that custom provider. This also avoids having to mock or override the private trace._TRACER_PROVIDER global variable.

Captures exceptions in access_secret_version on the T3 span and sets error attributes. Refines test fixtures to prevent ProxyTracer leakage.

westarle

Thanks for sharing this PR, it helps put the other in context. I like the plan, I'll be interested to see how you update the generator to get the gcp.* values.

westarle · 2026-08-13T19:54:33Z

@@ -39,13 +39,24 @@
 from google.api_core import exceptions as core_exceptions
 from google.api_core import gapic_v1
 from google.api_core import retry as retries
+
+try:
+    from google.api_core import _feature_gating_helpers


would it be simpler to just bump the minimum version of google-api-core that supports this feature?

westarle · 2026-08-13T19:56:04Z

@@ -756,6 +771,7 @@ def __init__(
                client_info=client_info,
                always_use_jwt_access=True,
                api_audience=self._client_options.api_audience,
+                configuration=self._client_options,


this helps explain where the configuration is coming from!

if we are unpacking _client_options here, I think we should unpack the .tracer_provider as well.

westarle · 2026-08-13T19:58:17Z

-            timeout=timeout,
-            metadata=metadata,
-        )
+        if is_tracing_enabled and HAS_OTEL and tracer:


I think you would want to use the tracer_provider to get the tracer, instead of using the global one you fetched above.

I'd suggest resolving the global tracer provider here only if you don't have a tracer_provider passed via ClientOptions.

chalmerlowe added 9 commits August 11, 2026 13:22

feat(api_core): Add tracer_provider to ClientOptions

f2ecbc0

feat(api_core): Plumb tracer_provider in grpc_helpers.create_channel

f8e5f4c

fix(api_core): Prevent TypeError in grpc_helpers_async.create_channel

49a88ff

test(api_core): Add OTel gRPC helpers tests

73f91fe

chore(api_core): Clean up imports in tests

ca1559b

refactor(api_core): Parametrize OTel installation and enablement tests

6c3cca8

Update packages/google-api-core/google/api_core/grpc_helpers_async.py

8297044

Update packages/google-api-core/google/api_core/grpc_helpers_async.py

d019dd3

fix(api_core): Use grpc.intercept_channel instead of invalid otel_grp…

182da98

…c.intercept_channel

chalmerlowe self-assigned this Aug 12, 2026

chalmerlowe added the do not merge Indicates a pull request not ready for merge, due to either quality or timing. label Aug 12, 2026

gemini-code-assist Bot reviewed Aug 12, 2026

View reviewed changes

chalmerlowe added 7 commits August 13, 2026 10:15

updates comment

061fdaa

feat(api_core): add tracing extra and improve client options tests

9aa3a00

chore(api_core): fix formatting/linter issues

0309a90

feat(secretmanager): Pass configuration to transports for tracing

97ded5a

test(secretmanager): Add observability tests and update existing tests

939feeb

chore(secretmanager): Update noxfile and setup.py for tracing tests

40f7023

feat(otel): add error handling to T3 span and refine tests

fc56170

Captures exceptions in access_secret_version on the T3 span and sets error attributes. Refines test fixtures to prevent ProxyTracer leakage.

chalmerlowe force-pushed the feat/otel-tracing-secretmanager-prototype branch from 0b40f3f to fc56170 Compare August 13, 2026 17:57

westarle reviewed Aug 13, 2026

View reviewed changes

Navigation Menu

Uh oh!

experiment(secretmanager): Otel tracing prototype in google-cloud-secretmanager - #18086

experiment(secretmanager): Otel tracing prototype in google-cloud-secretmanager#18086
chalmerlowe wants to merge 16 commits into
mainfrom
feat/otel-tracing-secretmanager-prototype

chalmerlowe commented Aug 12, 2026

Uh oh!

chalmerlowe commented Aug 12, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Aug 12, 2026

Uh oh!

gemini-code-assist Bot Aug 12, 2026

Uh oh!

gemini-code-assist Bot Aug 12, 2026

Uh oh!

gemini-code-assist Bot Aug 12, 2026

Uh oh!

westarle left a comment

Uh oh!

westarle Aug 13, 2026

Uh oh!

westarle Aug 13, 2026

Uh oh!

westarle Aug 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

chalmerlowe commented Aug 12, 2026

Problem

Solution

Notes to Reviewers

Uh oh!

chalmerlowe commented Aug 12, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Aug 12, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Aug 12, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Aug 12, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Aug 12, 2026

Choose a reason for hiding this comment

Uh oh!

westarle left a comment

Choose a reason for hiding this comment

Uh oh!

westarle Aug 13, 2026

Choose a reason for hiding this comment

Uh oh!

westarle Aug 13, 2026

Choose a reason for hiding this comment

Uh oh!

westarle Aug 13, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants