fix(integrations): use the mTLS Model Armor endpoint when mTLS is enabled

ModelArmorPlugin passed the plain regional host as an explicit api_endpoint,
so it never switched to the regional mTLS host. Certificate-bound credentials,
such as Agent Identity on Agent Runtime and Cloud Run, are rejected by the
plain host, so every screening call failed with UNAUTHENTICATED and, with the
default block_on_screening_failure, every prompt was blocked.

The endpoint is now resolved with _mtls_utils.get_api_endpoint, as other
regional Google API clients in ADK do.

Fixes #7553

Co-authored-by: Jason Zhang <jasoncz@google.com>
PiperOrigin-RevId: 1000269814

Author: jazhang00

src/google/adk/integrations/model_armor/_plugin.py

@@ -44,6 +44,7 @@
 from ...plugins.base_plugin import BasePlugin
 from ...tools.base_tool import BaseTool
 from ...tools.tool_context import ToolContext
+from ...utils import _mtls_utils
 from ._config import ModelArmorConfig
 
 try:
@@ -474,8 +475,12 @@ def _extract_tool_result_text(result: Any) -> Optional[str]:
 
 
 def _regional_endpoint(location: str) -> str:
-  """Builds the Model Armor regional endpoint for a location."""
-  return f'modelarmor.{location}.rep.googleapis.com'
+  """Returns the regional Model Armor endpoint, the mTLS one if enabled."""
+  return _mtls_utils.get_api_endpoint(
+      location=location,
+      default_template='modelarmor.{location}.rep.googleapis.com',
+      mtls_template='modelarmor.{location}.rep.mtls.googleapis.com',
+  )
 
 
 def _shared_template_location(*template_names: Optional[str]) -> str:

tests/unittests/integrations/model_armor/test_model_armor_plugin.py

@@ -30,6 +30,7 @@
 from google.adk.integrations.model_armor._plugin import _TOOL_OUTPUT_CHUNK_OVERLAP_CHARS
 from google.adk.models.llm_request import LlmRequest
 from google.adk.models.llm_response import LlmResponse
+from google.adk.utils import _mtls_utils
 from google.auth.credentials import AnonymousCredentials
 from google.cloud import modelarmor_v1
 from google.genai import types
@@ -550,12 +551,31 @@ async def test_fully_screened_clean_content_passes_through():
 # --- Regional endpoint ------------------------------------------------------
 
 
-def test_regional_endpoint_format():
-  """The host pattern Model Armor serves regional traffic on."""
-  assert (
-      _regional_endpoint('us-central1')
-      == 'modelarmor.us-central1.rep.googleapis.com'
-  )
+@pytest.mark.parametrize(
+    ('mtls_setting', 'cert_available', 'expected'),
+    [
+        ('never', True, 'modelarmor.us-central1.rep.googleapis.com'),
+        ('auto', False, 'modelarmor.us-central1.rep.googleapis.com'),
+        ('auto', True, 'modelarmor.us-central1.rep.mtls.googleapis.com'),
+        ('always', False, 'modelarmor.us-central1.rep.mtls.googleapis.com'),
+    ],
+)
+def test_regional_endpoint_follows_mtls_setting(
+    monkeypatch, mtls_setting, cert_available, expected
+):
+  """The regional endpoint is the mTLS one if mTLS is enabled."""
+  monkeypatch.setenv('GOOGLE_API_USE_MTLS_ENDPOINT', mtls_setting)
+  with (
+      mock.patch.object(
+          _mtls_utils, 'use_client_cert_effective', return_value=cert_available
+      ),
+      mock.patch.object(
+          _mtls_utils.mtls,
+          'has_default_client_cert_source',
+          return_value=cert_available,
+      ),
+  ):
+    assert _regional_endpoint('us-central1') == expected
 
 
 @pytest.mark.asyncio