chore(auth): Address remaining Regional Access Boundary feedback by vverman · Pull Request #12867 · googleapis/google-cloud-java

vverman · 2026-04-20T22:06:44Z

The RAB refresh uses a direct executor with a fixed thread pool as opposed to instantiating a new thread each time.
The RAB env gate -> GOOGLE_AUTH_TRUST_BOUNDARY_ENABLE_EXPERIMENT has been removed. This means RAB refresh triggers by default.
Added other fixes/suggestions made in the previous Java PR.

gemini-code-assist

Code Review

This pull request refactors the RegionalAccessBoundary and RegionalAccessBoundaryManager classes to improve resource management and testability. Key changes include replacing environment-variable-based feature toggling with a ThreadLocal mechanism for tests, migrating from manual thread creation to a bounded ExecutorService for asynchronous refresh tasks to prevent resource exhaustion, and ensuring HTTP responses are properly disconnected in a finally block. Additionally, the test suite has been migrated to JUnit 5, and several tests were cleaned up by removing deprecated environment provider mocks. I have no feedback to provide.

lqiu96 · 2026-04-23T17:30:34Z

+  // Unbounded thread creation is discouraged in library code to avoid resource
+  // exhaustion. A shared, bounded executor service ensures a hard limit (5)
+  // on concurrent refresh tasks, while threadCount provides unique names
+  // for easier debugging.
+  private static final AtomicInteger threadCount = new AtomicInteger(0);
+  private static final ExecutorService EXECUTOR =
+      Executors.newFixedThreadPool(
+          5,
+          r -> {
+            Thread t = new Thread(r, "RAB-refresh-" + threadCount.getAndIncrement());
+            t.setDaemon(true);
+            return t;
+          });


The tradeoff we are making is between:

Executor - Possible memory leak where the executor and the threads cannot be released as the auth library does not have a lifecycle.

Thread - Possible unbounded threads created (note: we aim to limit the amount of threads spawning per credential, but it may be possible to spawn an unbounded number of credentials).

I don't think there will be perfect solution. For a middle ground, is it possible to add allowCoreThreadTimeOut() and set a keep-alive value of something like ~1ish hour(s)? Single credentials would end up just invoking new Thread() in the pool as the RAB call should be idle for the other ~5 hours. If there are multiple credentials that need RAB calls, the executor should be able to use the existing threads as they'll no longer be marked as idle. WDYT?

I think this is a good idea to manage memory usage, especially in situations where the application is redeployed.

In the present implementation, since we don't shutdown the threads within the pool, they would not be garbage collected and the reference would live on while the server doesn't use the old application.

With this thread shutdown suggestion, we avoid that pitfall.

I agree that the threads which are idle for an hour can be timed-out and removed from the pool.

lqiu96 · 2026-04-23T17:32:50Z

@vverman The sdk-platform-java-ci CI issues are not relevant for this PR (existing issues as part of the monorepo migration).

PTAL at the conventialcommit CI complaints: https://github.com/googleapis/google-cloud-java/pull/12867/checks?check_run_id=72739487063

… memory.

vverman · 2026-04-24T19:45:37Z

Conventional commits addressed.

lqiu96

Changes LGTM overall. Added a few comments if you could take a look. I'm not entirely sure what the DISABLE_RAB_TESTS_ENV is for

vverman · 2026-05-01T21:31:18Z

Added per-test disablement of RAB refresh and bounded queue.

lsirac · 2026-05-02T03:21:52Z

    transportFactory.transport.setServiceAccountEmail("SA_CLIENT_EMAIL");
    ComputeEngineCredentials credentials =
        ComputeEngineCredentials.newBuilder().setHttpTransportFactory(transportFactory).build();
+    credentials.regionalAccessBoundaryManager.setCachedRAB(


This seeds a fake cached RAB, but that isn't the same as disabling RAB.

We should replace the fake cached RAB setup with a real test-only disable path.

For non-RAB tests, we want two things:

no background RAB refresh

no x-allowed-locations header added to request metadata

Adding fake cached RAB only solves the first part, and changes the headers/logs under test.

For non-RAB tests we want ... no x-allowed-locations header added to request metadata

For those test that do check the presence of the headers, they check for the presence of the authorization header. Which is rightly present, thereby not affecting the existing testing logic.

It is not that the x-allowed-locations header is incorrect, that we're 'disabling RAB' rather it is because async refreshes might non-deterministically consume mocks. That problem is avoided here.

Additionally, this method doesn't add any production logic exclusively for testing.

The downside with your approach is you need to make sure to update all the assertions. There are now 5 log events, not 3, so the test is failing. Please make sure the necessary places are updated.

Thank you for the suggestion.

I checked the failure in LoggingTest and found the test which was failing "getRequestMetadata_hasAccessToken" was caused by the lazy loading of the universe domain, triggered by the new RAB check, rather than the RAB refresh itself."

For ComputeEngineCredentials, the first call to getUniverseDomain() fetches it from the metadata server, generating 2 extra logs. Since the RAB check now calls this lazily during getRequestMetadata(), these logs were captured in the test.

So I bumped the count for the test to 5. The rest of the tests weren't updated because they don't trigger a lazy load of the universe domain and aren't at risk of triggering the increased logs.

lqiu96 · 2026-05-04T20:35:52Z

  /**
-   * Checks if the regional access boundary feature is enabled. The feature is enabled if the
-   * environment variable or system property "GOOGLE_AUTH_TRUST_BOUNDARY_ENABLE_EXPERIMENT" is set
-   * to "true" or "1" (case-insensitive).
+   * Checks if the regional access boundary feature is enabled.
+   *
+   * <p>This method is for internal use only and may be changed or removed in future releases.
   *
   * @return True if the regional access boundary feature is enabled, false otherwise.
   */


Since we deleted the isEnabled() method, can we remove the associated method?

lqiu96 · 2026-05-04T20:36:20Z


-  // Note: this is for internal testing use use only.
-  // TODO: Fix unit test mocks so this can be removed
-  // Refer -> https://github.com/googleapis/google-auth-library-java/issues/1898


can we close this ticket created here? Or we want to wait until this is merged into main?

lqiu96 · 2026-05-04T20:41:06Z

+            LOGGER_PROVIDER,
+            java.util.logging.Level.WARNING,
+            null,
+            "Regional Access Boundary background refresh failed to schedule: " + e.getMessage());


I forgot to ask about this earlier. Do we plan to have any public docs regarding this to explain this behavior? I wonder if something like this may be confusing to the user and they may be asking what RAB is.

If not, can we use something that either has a bit softer wording or adding something that assures this is nothing to worry about

lqiu96 · 2026-05-04T20:43:12Z

 * This duplicates tests setups, but centralizes logging test setup in this class.
 */
-class LoggingTest {
+public class LoggingTest {


nit: is this needed? Or just slipped in

lqiu96 · 2026-05-04T20:45:12Z

+    awsCredential.regionalAccessBoundaryManager.setCachedRAB(
+        new RegionalAccessBoundary(
+            "dummy-locations", Arrays.asList("dummy-loc"), awsCredential.clock));


nit: changes make sense. thanks I like this more than the env var idea.

Is possible just to create one constant RegionalAccessBoundary object per file?

lqiu96 · 2026-05-04T20:46:15Z

-            new Exception("Regional Access Boundary background refresh failed to schedule", e));
+        LoggingUtils.log(
+            LOGGER_PROVIDER,
+            java.util.logging.Level.WARNING,


nit: can you use the short name and import instead?

lqiu96

added a few small nits. Changes look fine on my end. PTAL at the nits and see if the make sense/ should be addressed. Feel free to merge afterwards

Using executor; RAB refresh not gated by env var; other fixes.

fa9583e

vverman requested review from a team as code owners April 20, 2026 22:06

vverman requested review from lqiu96 and nbayati April 20, 2026 22:08

gemini-code-assist Bot reviewed Apr 20, 2026

View reviewed changes

vverman changed the title ~~feat: Update Regional Access Boundary~~ feat(auth): Update Regional Access Boundary Apr 22, 2026

lqiu96 changed the title ~~feat(auth): Update Regional Access Boundary~~ chore(auth): Address remaining Regional Access Boundary feedback Apr 23, 2026

lqiu96 reviewed Apr 23, 2026

View reviewed changes

vverman added 2 commits April 24, 2026 12:39

Added change to terminate idle threads in the executorPool to free up…

5d6193f

… memory.

Lint fix.

cae1afa

vverman requested a review from lqiu96 April 24, 2026 19:45

lqiu96 reviewed Apr 24, 2026

View reviewed changes

Comment thread ...auth-library-java/oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundaryManager.java Outdated

lqiu96 reviewed Apr 24, 2026

View reviewed changes

Comment thread ...auth-library-java/oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundaryManager.java

lqiu96 reviewed Apr 24, 2026

View reviewed changes

Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundary.java Outdated

lqiu96 approved these changes Apr 24, 2026

View reviewed changes

Nit fixes.

a758cc8

lsirac reviewed Apr 25, 2026

View reviewed changes

vverman added 3 commits May 1, 2026 12:59

Made individual tests disable rab refresh by seeding RAB.

4a1c1e9

Now using bound executor pool with a limit of 100.

c65c290

Lint fixes.

58525bd

vverman requested review from lqiu96 and lsirac May 1, 2026 21:32

lsirac requested changes May 2, 2026

View reviewed changes

lsirac reviewed May 2, 2026

View reviewed changes

Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundary.java

Refreshes that failed to schedule are not entered into cooldown.

1a5753f

Added loggingTest fixes.

e6b043e

vverman requested a review from lsirac May 3, 2026 07:59

lsirac reviewed May 4, 2026

View reviewed changes

Comment thread google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/LoggingTest.java Outdated

lsirac approved these changes May 4, 2026

View reviewed changes

Loggingtest lint correction.

ef6eff6

lqiu96 reviewed May 4, 2026

View reviewed changes

lqiu96 approved these changes May 4, 2026

View reviewed changes

nbayati approved these changes May 5, 2026

View reviewed changes

Conversation

vverman commented Apr 20, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lqiu96 commented Apr 23, 2026

Uh oh!

vverman commented Apr 24, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lqiu96 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vverman commented May 1, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vverman May 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lqiu96 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

vverman May 2, 2026 •

edited

Loading