Infer project from credentials if not passed explicitly #27

Activity

1. yoshi-automation

   added

   triage meI really want to be triaged.I really want to be triaged.

   on Sep 17, 2020
2. busunkim96

   added

   type: feature request‘Nice-to-have’ improvement, new feature or different behavior or design.‘Nice-to-have’ improvement, new feature or different behavior or design.

   and removed

   triage meI really want to be triaged.I really want to be triaged.

   on Sep 18, 2020
3. tseaver commented on Dec 8, 2020

   

   tseaver

   on Dec 8, 2020

   ContributorAuthor

   More actions

   In the case where credentials are discovered for us, google.auth.default() already falls back to the project in the credentials. E.g.:

   $ unset GOOGLE_CLOUD_PROJECT GCLOUD_PROJECT
   $ export GOOGLE_APPLICATION_CREDENTIALS=/path/to/service_account.json
   $ grep project_id /path/to/service_account.json
       "project_id": "some-project-123"
   $ python
   >>> from google.auth import default
   >>> credentials, project = default()
   >>> project
   'some-project-123'
   >>> from google.cloud.client import ClientWithProject
   >>> client = ClientWithProject()
   >>> client.project
   'some-project-123'

   So, the case we need to cover for this feature is when the user has passed in explicit service account credentials, but not an explicit project ID, e.g. (this won't currently work):

   $ unset GOOGLE_CLOUD_PROJECT GCLOUD_PROJECT GOOGLE_APPLICATION_CREDENTIALS
   $ python
   >>> from google.oauth2.service_account import Credentials
   >>> credentials = Credentials.from_service_account_file("/path/to/service_account.json")
   >>> from google.cloud.client import ClientWithProject
   >>> client = ClientWithProject(credentials=credentials)  # currently raises
4. tseaver

   self-assigned this

   on Dec 8, 2020
5. tseaver

   added a commit that references this issue on Dec 8, 2020

   feat: infer project from explicit service account creds

   ...

   This issue will close once commit 626ae7e is merged into the 'main' branch.

   626ae7e
6. tseaver

   closed this as completedin #51on Jan 19, 2021
7. tseaver

   added a commit that references this issue on Jan 19, 2021

   feat: infer project from explicit service account creds (#51)

   ...

   This issue will close once commit 2bd41a1 is merged into the 'main' branch.

   2bd41a1
8. dhermes commented on Oct 7, 2024

   

   dhermes

   on Oct 7, 2024

   Last edited by dhermes

   Contributor

   More actions

   Is there a reason CLOUDSDK_CORE_PROJECT isn't also supported?

   I made it here via the comment near a stack-trace I followed:

   python-cloud-core/google/cloud/client/__init__.py

   Lines 252 to 260 in e5fb3ea

   	# This test duplicates the one from `google.auth.default`, but earlier,
   	# for backward compatibility: we want the environment variable to
   	# override any project set on the credentials. See:
   	# https://github.com/googleapis/python-cloud-core/issues/27
   	if project is None:
   	project = os.getenv(
   	environment_vars.PROJECT,
   	os.getenv(environment_vars.LEGACY_PROJECT),
   	)

   Update: I just did some testing and confirmed it is supported. Not sure what sort of heisenbug I was observing!