py: prioritize requests_verify param over envs

abhizer · abhizer · commit 41021acc2d56 · 2025-10-06T14:27:39.000Z
Signed-off-by: Abhinav Gyawali &lt;22275402+abhizer@users.noreply.github.com&gt;
diff --git a/python/feldera/rest/_helpers.py b/python/feldera/rest/_helpers.py
@@ -1,3 +1,7 @@
+import logging
+import os
+
+
 def client_version() -> str:
     from importlib.metadata import version, PackageNotFoundError
 
@@ -7,3 +11,26 @@ def client_version() -> str:
         version = "unknown"
 
     return version
+
+
+def requests_verify_from_env() -> str | bool:
+    env_feldera_tls_insecure = os.environ.get("FELDERA_TLS_INSECURE")
+    FELDERA_HTTPS_TLS_CERT = os.environ.get("FELDERA_HTTPS_TLS_CERT")
+
+    if env_feldera_tls_insecure is not None and FELDERA_HTTPS_TLS_CERT is not None:
+        logging.warning(
+            "environment variables FELDERA_HTTPS_TLS_CERT and "
+            "FELDERA_TLS_INSECURE both are set."
+            "\nFELDERA_HTTPS_TLS_CERT takes priority."
+        )
+
+    if env_feldera_tls_insecure is None:
+        FELDERA_TLS_INSECURE = False
+    else:
+        FELDERA_TLS_INSECURE = env_feldera_tls_insecure.strip().lower() in ("1", "true", "yes")
+
+    requests_verify = not FELDERA_TLS_INSECURE
+    if FELDERA_HTTPS_TLS_CERT is not None:
+        requests_verify = FELDERA_HTTPS_TLS_CERT
+
+    return requests_verify
diff --git a/python/feldera/rest/config.py b/python/feldera/rest/config.py
@@ -1,5 +1,7 @@
 from typing import Optional
 import os
+from feldera.rest._helpers import requests_verify_from_env
+import logging
 
 
 class Config:
@@ -14,7 +16,7 @@ def __init__(
         version: Optional[str] = None,
         timeout: Optional[float] = None,
         connection_timeout: Optional[float] = None,
-        requests_verify: bool | str = True,
+        requests_verify: Optional[bool | str] = None,
     ) -> None:
         """
         :param url: The url to the Feldera API (ex: https://try.feldera.com)
@@ -23,7 +25,10 @@ def __init__(
         :param timeout: The timeout for the HTTP requests
         :param connection_timeout: The connection timeout for the HTTP requests
         :param requests_verify: The `verify` parameter passed to the requests
-            library. `True` by default.
+            library. `True` by default. Can also be set using environment
+            variables `FELDERA_TLS_INSECURE` to disable TLS and
+            `FELDERA_HTTPS_TLS_CERT` to set the certificate path. The latter
+            takes priority.
         """
 
         BASE_URL = (
@@ -37,11 +42,10 @@ def __init__(
         self.version: Optional[str] = version or "v0"
         self.timeout: Optional[float] = timeout
         self.connection_timeout: Optional[float] = connection_timeout
+        env_verify = requests_verify_from_env()
+        self.requests_verify: bool | str = (
+            requests_verify if requests_verify is not None else env_verify
+        )
 
-        FELDERA_TLS_INSECURE = True if os.environ.get("FELDERA_TLS_INSECURE") else False
-        FELDERA_HTTPS_TLS_CERT = os.environ.get("FELDERA_HTTPS_TLS_CERT")
-        requests_verify = not FELDERA_TLS_INSECURE
-        if requests_verify and FELDERA_HTTPS_TLS_CERT is not None:
-            requests_verify = FELDERA_HTTPS_TLS_CERT
-
-        self.requests_verify: bool | str = requests_verify
+        if self.requests_verify is False:
+            logging.warning("TLS verification is disabled.")
diff --git a/python/feldera/rest/feldera_client.py b/python/feldera/rest/feldera_client.py
@@ -49,7 +49,7 @@ def __init__(
         api_key: Optional[str] = None,
         timeout: Optional[float] = None,
         connection_timeout: Optional[float] = None,
-        requests_verify: bool | str = True,
+        requests_verify: Optional[bool | str] = None,
     ) -> None:
         """
         :param url: The url to Feldera API (ex: https://try.feldera.com). If
diff --git a/python/feldera/testutils.py b/python/feldera/testutils.py
@@ -13,6 +13,7 @@
 from feldera.pipeline_builder import PipelineBuilder
 from feldera.runtime_config import Resources, RuntimeConfig
 from feldera.rest import FelderaClient
+from feldera.rest._helpers import requests_verify_from_env
 
 API_KEY = os.environ.get("FELDERA_API_KEY")
 
@@ -46,12 +47,7 @@ def _get_effective_api_key():
 PIPELINE_TO_KAFKA_SERVER = os.environ.get(
     "FELDERA_PIPELINE_TO_KAFKA_SERVER", "redpanda:9092"
 )
-FELDERA_TLS_INSECURE = True if os.environ.get("FELDERA_TLS_INSECURE") else False
-FELDERA_HTTPS_TLS_CERT = os.environ.get("FELDERA_HTTPS_TLS_CERT")
-if not FELDERA_TLS_INSECURE and FELDERA_HTTPS_TLS_CERT is not None:
-    FELDERA_REQUESTS_VERIFY = FELDERA_HTTPS_TLS_CERT
-else:
-    FELDERA_REQUESTS_VERIFY = not FELDERA_TLS_INSECURE
+FELDERA_REQUESTS_VERIFY = requests_verify_from_env()
 
 
 class _LazyClient:
diff --git a/python/tests/__init__.py b/python/tests/__init__.py
@@ -6,8 +6,7 @@
     BASE_URL,
     PIPELINE_TO_KAFKA_SERVER,
     KAFKA_SERVER,
-    FELDERA_TLS_INSECURE,
-    FELDERA_HTTPS_TLS_CERT,
+    FELDERA_REQUESTS_VERIFY,
 )
 
 __all__ = [
@@ -18,6 +17,5 @@
     "BASE_URL",
     "PIPELINE_TO_KAFKA_SERVER",
     "KAFKA_SERVER",
-    "FELDERA_TLS_INSECURE",
-    "FELDERA_HTTPS_TLS_CERT",
+    "FELDERA_REQUESTS_VERIFY",
 ]
diff --git a/python/tests/platform/helper.py b/python/tests/platform/helper.py
@@ -22,8 +22,8 @@
 from http import HTTPStatus
 from urllib.parse import quote, quote_plus
 
-from tests import FELDERA_TLS_INSECURE, API_KEY, BASE_URL, unique_pipeline_name
 from feldera.testutils_oidc import get_oidc_test_helper
+from tests import FELDERA_REQUESTS_VERIFY, API_KEY, BASE_URL, unique_pipeline_name
 
 API_PREFIX = "/v0"
 
@@ -80,7 +80,7 @@ def http_request(method: str, path: str, **kwargs) -> requests.Response:
 
     # Provide a default timeout to avoid hanging tests.
     timeout = kwargs.pop("timeout", 30)
-    kwargs["verify"] = not FELDERA_TLS_INSECURE
+    kwargs["verify"] = FELDERA_REQUESTS_VERIFY
     resp = requests.request(
         method.upper(), url, headers=headers, timeout=timeout, **kwargs
     )
