feat(spanner): Support dynamic certificate and key rotation in Spanner Omni by sagnghos · Pull Request #14433 · googleapis/google-cloud-java

feat(spanner): Support Dynamic Certificate/Key rotation in Spanner Omni

sagnghos

committed

0fb7c7e

fix(spanner): Throttle key/trust manager file stat checks and use native PKCS8 key parser

sagnghos

committed

8473bb7

fix(spanner): Detect PKCS#1 keys with actionable error and clean up test certs

sagnghos

committed

c5ec704

Address review comments: avoid capturing builder in SpannerOptions lambda and use monotonic nanoTime for interval throttling

sagnghos

committed

a077de2

Address review comments: simplify reloadMaterial and suppress exceptions on private key parsing

sagnghos

committed

959f887

docs(spanner): Add Javadocs for ConnectionOptions builder and DynamicKey/TrustManager constructors

sagnghos

committed

7fcbedf

fix(spanner): Validate private key matches certificate and optimize file stat calls

sagnghos

committed

6993ccf

fix(spanner): Address review comments: versioned alias map, binary DER support, file stat ordering, and SpannerOptions SSL context preservation

sagnghos

committed

ab27a98

fix(spanner): Non-blocking Netty handshakes via background scheduled reloader, lazy CertificateFactoryHolder, and deterministic alias eviction

sagnghos

committed

f78415f

fix(spanner): On-demand rate-limited checking on TLS handshake, remove background scheduler to prevent leaks, and support ECDSA key verification

sagnghos

committed

53f59f9

fix(spanner): Use monotonic System.nanoTime() and ReentrantLock for thread-safe dynamic certificate checking

sagnghos

committed

c1f0f39

Store certificate and key paths in SpannerOptions and Builder

sagnghos

committed

c031825

Validate client certificate and key are both provided in prepareBuilder

sagnghos

committed

0b61f6e

Use Strings.isNullOrEmpty for certificate and key validation

sagnghos

committed

8e80a78

Use lock.tryLock() in DynamicKeyManager and DynamicTrustManager to prevent thread blocking

sagnghos

committed

0789fb9

Perform file attribute checks only after acquiring lock in DynamicKeyManager and DynamicTrustManager

sagnghos

committed

c3ddcc7

Use removeIf on materials.keySet() in DynamicKeyManager

sagnghos

committed

1886649

Optimize parsePrivateKey and extractPemContent in DynamicKeyManager

sagnghos

committed

4da5bf9

Safely evict key material aliases in DynamicKeyManager

sagnghos

committed

27d701f

Safely handle null issuers in DynamicTrustManager and speed up tests using setLastModified

sagnghos

committed

cacf044

Use standard JKS keystore in DynamicTrustManager

sagnghos

committed

a376228

Use KeyStore.getDefaultType() and clone accepted issuers in DynamicTrustManager

sagnghos

committed

8d9c737

Navigation Menu

feat(spanner): Support dynamic certificate and key rotation in Spanner Omni - #14433

feat(spanner): Support dynamic certificate and key rotation in Spanner Omni#14433
sagnghos wants to merge 22 commits into
googleapis:mainfrom
sagnghos:sagnghos/dynamicRotation

Commits on Sep 21, 2026

feat(spanner): Support Dynamic Certificate/Key rotation in Spanner Omni

fix(spanner): Throttle key/trust manager file stat checks and use native PKCS8 key parser

fix(spanner): Detect PKCS#1 keys with actionable error and clean up test certs

Address review comments: avoid capturing builder in SpannerOptions lambda and use monotonic nanoTime for interval throttling

Address review comments: simplify reloadMaterial and suppress exceptions on private key parsing

docs(spanner): Add Javadocs for ConnectionOptions builder and DynamicKey/TrustManager constructors

fix(spanner): Validate private key matches certificate and optimize file stat calls

fix(spanner): Address review comments: versioned alias map, binary DER support, file stat ordering, and SpannerOptions SSL context preservation

fix(spanner): Non-blocking Netty handshakes via background scheduled reloader, lazy CertificateFactoryHolder, and deterministic alias eviction

fix(spanner): On-demand rate-limited checking on TLS handshake, remove background scheduler to prevent leaks, and support ECDSA key verification

fix(spanner): Use monotonic System.nanoTime() and ReentrantLock for thread-safe dynamic certificate checking

Store certificate and key paths in SpannerOptions and Builder

Validate client certificate and key are both provided in prepareBuilder

Use Strings.isNullOrEmpty for certificate and key validation

Use lock.tryLock() in DynamicKeyManager and DynamicTrustManager to prevent thread blocking

Perform file attribute checks only after acquiring lock in DynamicKeyManager and DynamicTrustManager

Use removeIf on materials.keySet() in DynamicKeyManager

Optimize parsePrivateKey and extractPemContent in DynamicKeyManager

Safely evict key material aliases in DynamicKeyManager

Safely handle null issuers in DynamicTrustManager and speed up tests using setLastModified

Use standard JKS keystore in DynamicTrustManager

Use KeyStore.getDefaultType() and clone accepted issuers in DynamicTrustManager