credentials

credentials replaces Application Default Credentials with a credentials value built by google-cloud-auth.

By default every client of the broker authenticates with Application Default Credentials. They come from GOOGLE_APPLICATION_CREDENTIALS, the file gcloud auth application-default login writes, or the metadata server of the machine the service runs on. credentials takes a Credentials value instead. The google-cloud-auth crate builds one from a service account key, an impersonated service account, or an external account. The value only records how to obtain a token; the clients ask for one when they call the service. Startup does not read the credentials, so wrong credentials surface on the first call, as an error of the subscription or the publish.

Example

The deployment mounts a service account key as a secret, and the broker signs in with it.

Macros

examples/pubsub_broker_config.rs

/// Signs in with the service account key the deployment mounts as a secret.
fn broker(key: Value) -> Result<PubSubBroker, CredentialsError> {
    let credentials = service_account::Builder::new(key).build()?;
    Ok(PubSubBroker::new("my-project").credentials(credentials))
}

Manual

examples/manual/pubsub_broker_config.rs

/// Signs in with the service account key the deployment mounts as a secret.
fn broker(key: Value) -> Result<PubSubBroker, CredentialsError> {
    let credentials = service_account::Builder::new(key).build()?;
    Ok(PubSubBroker::new("my-project").credentials(credentials))
}