Enable the creation of mTLS encrypted gRPC channels leveraging NI TLS via nitlsconfig (Python) - #1019
Enable the creation of mTLS encrypted gRPC channels leveraging NI TLS via nitlsconfig (Python)#1019alexdubois-ni wants to merge 9 commits into
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
Partial version-query failures can incorrectly audit an established server connection as unsuccessful.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Integrates nitlsconfig with NI-DAQmx gRPC sessions for TLS diagnostics and connection auditing.
Changes:
- Adds
nitlsconfig[grpc]dependency and lock data. - Audits connection outcomes and elaborates TLS failures.
- Adds integration-focused unit tests and release notes.
File summaries
| File | Description |
|---|---|
.config/cspell/project-software-terms.txt |
Adds dependency terminology. |
CHANGELOG.md |
Documents NI TLS support. |
generated/nidaqmx/_grpc_interpreter.py |
Adds auditing and TLS error elaboration. |
poetry.lock |
Locks new dependencies. |
poetry.toml |
Exempts nitlsconfig from release-age checks. |
pyproject.toml |
Adds nitlsconfig to the gRPC extra. |
src/codegen/templates/_grpc_interpreter.py.mako |
Generates the integration logic. |
tests/unit/test_nitlsconfig_grpc_integration.py |
Tests auditing and TLS errors. |
Review details
- Files reviewed: 6/8 changed files
- Comments generated: 1
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
zhindes
left a comment
zhindes
left a comment
There was a problem hiding this comment.
nothing more than Brad's comments!
There was a problem hiding this comment.
Does this require any new software to be installed for existing non-TLS use cases? I see that the nitlsconfig Python package shells out to a new nitlsconfig command: https://github.com/ni/nitlsconfig-python/blob/main/src/nitlsconfig/cli.py
I saw the comment about "create_grpc_device_channel needs the nitlsconfig CLI installed on the system." I just want to check that the auditing part works without the nitlsconfig CLI. Otherwise, this will break existing applications with older drivers that install the latest nidaqmx Python package.
This contribution adheres to CONTRIBUTING.md.
I've updated CHANGELOG.md if applicable.
I've added tests applicable for this pull request
Note: I've only added unit tests as of this time. We intend to add system tests in a follow-up PR.
We also intend to add documentation in a follow-up PR.
What does this Pull Request accomplish?
Leverage and integrate nitlsconfig (from the nitlsconfig-python repository). This will give us the capability to:
Why should this Pull Request be merged?
Without this integration, customers would need to know about and add nitlsconfig[grpc] themselves as a python package to install. This will add a unified platform method for mTLS encryption with gRPC.
Furthermore, we can also leverage our package and integrate it to add CRA required audit logging capabilities and also help us provide customers with additional setup debugging information telling them they need to go to Hardware Manager.
Lastly, this is all provided from a shared public github repo that we can modify to reiterate and share our code and improvements with nimi-python.
NOTE: nitlsconfig 1.0.0a4 is our most recent alpha version. We will publish a formal 1.0.0 after we've completed all of our testing. This will automatically be pulled in for customers with our existing >= 1.0.0a4. But, we will want to go back and update this to 1.0.0 most likely, especially if owners here would desire this :)
What testing has been done?
Unit tests have been added and succeeded locally. System tests are soon to follow.
We have integrated this very identically in nimi-python for all of our gRPC Python API supporting drivers and it has been unit tested and manually tested there as well (ATS tests pending in that repo, soon to follow for here too).