Repository navigation
google-cloud-ruby does not work with Application Default Credentials #951
Description
See also: google-cloud-node does not work with Application Default Credentials
Problem
After running gcloud beta auth application-default login I should be able to use google-cloud-ruby to access Google Cloud Platform services, but I can't. I must set the GOOGLE_CLOUD_PROJECT env var or explicitly pass a project ID to a client for google-cloud-ruby to work.
Steps to Reproduce
- Install the Google Cloud SDK and Ruby
- Run
gcloud init, you'll be prompted to set a default project - Run
gcloud beta auth application-default loginand follow the OAuth 2.0 flow to login - Run
gem install google-cloud-storageto install a google-cloud-ruby client library - Run
irband use the google-cloud-storage gem to interact with Google Cloud Storage. In this case, I am following the example code snippet for Retrieving Buckets found on the website for google-cloud-ruby.
>> require "google/cloud"
=> true
>> gcloud = Google::Cloud.new
=> #<Object:0x007fc27b105f78 @project=nil, @keyfile=nil, @retries=nil, @timeout=nil>
>> storage = gcloud.storage
ArgumentError: project is missing
from /Users/remily/.rbenv/versions/2.3.1/lib/ruby/gems/2.3.0/gems/google-cloud-storage-0.20.0/lib/google-cloud-storage.rb:110:in `storage'
from /Users/remily/.rbenv/versions/2.3.1/lib/ruby/gems/2.3.0/gems/google-cloud-storage-0.20.0/lib/google-cloud-storage.rb:66:in `storage'
from (irb):3
from /Users/remily/.rbenv/versions/2.3.1/bin/irb:11:in `<main>'Expected
After a user runs gcloud beta auth application-default login, google-cloud-ruby client libraries should work without explicitly setting a project ID via the code or an environment variable.
Activity
blowmage commentedon Sep 30, 2016
Thanks for the issue, @remi. I was not aware this was being discussed on the other language projects.
In googleapis/google-cloud-node#1653 it seems like the consensus is that this functionality should be provided by the authentication library, and not the google-cloud-node library. For ruby, that is the googleauth gem. The googleauth gem does sniff for both the GCE environment, and the gcloud SDK Application Default Credentials. But when we asked them to support retrieving the default project_id for GCE they declined, saying that it was not something the library should provide.
What is your opinion? Is this something that googleauth should provide, as it looks to be in future releases for python and node? Or something that google-cloud should provide?
beccasaurus commentedon Oct 1, 2016
Because this feature is so tightly coupled to the Google Cloud SDK command-line tool, I think it makes sense for this feature to be implemented in google-cloud rather than the generalized Ruby Google API client.
For Python, project ID detection is currently implemented in google-cloud-python, not pushed down into the general Python Google API client.
I rather like Python's project detection:
Also, I see that googleauth sniffs the Google Compute Engine metadata server for an auth token, which is very relevant to auth, I think that it makes the most sense for google-cloud-ruby to lookup the project ID.
What do you think?
beccasaurus commentedon Oct 1, 2016
Follow-up comment: I have been discussing this offline with Python and Node.js stakeholders. The referenced Node.js issue also includes discussion about upcoming changes to the the Python Google Auth library to move project detection into the authentication library.
Reasoning / benefits:
The benefits of putting this code into the Google Auth library for Ruby are great and will benefit all libraries that make use of googleauth
I'll follow-up with an issue files on the googleauth library. We can block this pending support for project detection in googleauth?
/cc @jonparrott @jmdobry
blowmage commentedon Oct 1, 2016
Sounds good to me! We noticed that the newer keyfile JSON files also include the project_id. Since the google-cloud libs already provide googleauth with the JSON file I think it would be great if it gave back the project_id as well as the credentials object.
blowmage commentedon Jan 8, 2018
This issue is blocked by googleapis/google-auth-library-ruby#90, so I am moving this issue to the feature backlog until we are unblocked.
AteqEjaz commentedon Sep 4, 2018
Still having the same issue with Ruby version 2.4.4 thanks
blowmage commentedon Oct 24, 2018
The recently released
googleauth0.7.0 will support the functionality to extract theproject_idfrom service account credentials, but bothgoogle-api-clientandgoogle-gaxpin the dependency ongoogleauthto a version lower than 0.7.0. We will have to coordinate the loosening of the downstream dependencies before we can start making use of this feature in thegoogle-cloud-*gems.blowmage commentedon Oct 24, 2018
I'm going to reclose this issue and open a new issue for the remaining work.