shunping commented on issue #39235:
URL: https://github.com/apache/beam/issues/39235#issuecomment-4906492681
Here is a step-by-step summary of how the exception is raised for the
wordcount example.
1. Pipeline Execution & GCS I/O
When the Beam Python Wordcount pipeline is run, it reads from GCS, Beam's
`ReadFromText` transform attempts to read data in chunks from the GCS file
stream handled by `apache_beam/io/gcp/gcsio.py`.
2. Underlying GCS Blob Download
`gcsio.py` calls `google.cloud.storage.fileio.BlobReader.read()`. To fetch
file chunks in 3.x code path, google-cloud-storage executes
`self._blob.download_as_bytes(...)` using HTTP Range requests over an
AuthorizedSession provided by google-auth.
3. Automatic mTLS & PyOpenSSL Injection
If `GOOGLE_API_USE_CLIENT_CERTIFICATE` is not set to false, `google-auth`
detects local client certificates on the developer machine and configures
mutual TLS (mTLS). To do this, `google-auth` calls:
`urllib3.contrib.pyopenssl.inject_into_urllib3()`. This uses PyOpenSSL as the
TLS backend for urllib3 and mounts a shared `SSLContext` on the urllib3 HTTP
connection pool.
4. Context Re-use
- Chunk 1: The first HTTP range request opens "Connection 1" using the
shared `SSLContext`.
- Chunk 2: When the second range request is issued (or when a connection
in the pool is closed and recreated), urllib3 needs to establish "Connection 2"
using the same shared SSLContext from the pool.
5. PyOpenSSL Exception
Before starting the TLS handshake for "Connection 2", urllib3's
`_ssl_wrap_socket_and_match_hostname` attempts to re-apply verification
settings to the context. However, in pyOpenSSL >= 26.2.0, PyOpenSSL strictly
forbids mutating an SSLContext after it has already created a connection.
Therefore, PyOpenSSL raises: `ValueError: Context has already been used to
create a Connection, it cannot be mutated again`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
