Clarify Google Cloud Run support

[jnolis]

Hi everyone! I'm trying to connect to a Google Cloud Storage bucket from a Docker container running in Google Cloud Run. It feels like this would already be supported in gargle, but I don't see any documentation either way. This leads to my two proposals:

1. Can someone (and this could easily be me), make an article in the documentation on how one should get credentials when running Docker containers within GCP? That could be either Google Cloud Run, kubernetes, or anything like that. It looks like a previous issue discussed it, but I couldn't understand the outcome.
2. If gargle doesn't have the functionality to get credentials from Docker containers in GCP, could that be added? I do not understand the complexities of GCP enough to know if that's a small or big request.

Thanks! Love the package.

[jennybc]

I think I'll need some help (or time or, TBH, both) to get my head around what exactly needs to happen here. This is a usage scenario that just doesn't come up for me, so it's much harder for me to get oriented.

[MarkEdmondson1234]

It should be a very similar authentication workflow as if you are authenticating upon GCE VMs. When you create the Cloud Run service you have an option of selecting the service key you wish to authenticate with, the default being the global GCE service key:

You should then be able to auth within your R script (such as say a plumber service) via gargle::token_fetch() or more directly with gargle::credentials_gce() without needing to upload a service auth key with your app, since the default service key should have access to all buckets within the same GCP project.

There is more configuring if you want to create your own service key etc. this tutorial may help with some of those cases https://cloud.google.com/community/tutorials/cloud-run-conditional-iam

I will see if I can add a GCS listing endpoint to the googleCloudRunner Cloud Run plumber examples so you can see it running in R.

[MarkEdmondson1234]

I now have some example R code I put in MarkEdmondson1234/googleCloudRunner@a435d80

Deploy to Cloud Run and reusing the default authentication

When you deploy to Cloud Run, you can choose which service key the Cloud Run service will run under, the default being the GCE default service key. This means you can authenticate using this key without needing to upload your own service JSON file. An example is available in the example Cloud Run app included with the package, deployable via cr_deploy_plumber(system.file("example", package = "googleCloudRunner"))

The relevant R code is shown below, which lets you list a Google Cloud Storage bucket within the same GCP project, reusing the default authentication.

#' List a Google Cloud Storage bucket as an auth example
#' @get /gcs_list
#' @param bucket the bucket to list.  Must be authenticated for this Cloud Run service account
function(bucket=NULL){
  if(is.null(bucket)){
    return("No bucket specified in URL parameter e.g ?bucket=my-bucket")
  }

  library(googleCloudStorageR)

  auth <- gargle::credentials_gce()
  if(is.null(auth)){
    return("Could not authenticate")
  }

  message("Authenticated with service token")

  # put it into googleCloudStorageR auth
  gcs_auth(token = auth)

  gcs_list_objects(bucket)

}

Once deployed, you can see it listing objects via the endpoint browseURL("https://{your-app-endpoint}/gcs_list?bucket={your-bucket}")

[jennybc]

Thanks @MarkEdmondson1234 for your help! @jnolis I'll be interested to hear if this addresses your need.

[jnolis]

This does look like it would solve my problem! I’m going to try this out and report back. Assuming this does work, I think there are some places this should be added to the documentation for other people. (Which I can do!)

Also, this might be too breaking of a change but I would think the name of the function credentials_gce might deserve to be changed to something more general since it’s used for more than just Google Compute Engine? Assuming it’s too big to change the name just making a note in the function docs would be good.

[jnolis]

Also feel free to consider this ticket assigned to me if that’s helpful!

[jennybc]

the name of the function credentials_gce might deserve to be changed

I would say that's off the table, i.e. causes more pain than it's worth. Plus, given the first screenshot of @MarkEdmondson1234, there is a strong connection to GCE, even in Google's UI.

[jennybc]

But yes I would be happy to get a documentation PR from you @jnolis.

[jnolis]

Totally makes sense to me to keep the name the same. I'll get cracking on some docs!

[jennybc]

Gentle ping @jnolis. Are you still interested in this and, specifically, into contributing more docs? If not, I'm going to close this since #223 has already made a big improvement.