v2.2.0 requires AuthN when supplied with PUBSUB_EMULATOR_HOST

[seandstewart]

Environment details

• OS type and version: macOS Catalina
• Python version: 3.8.1
• pip version: 20.2.2
• google-cloud-pubsub version: 2.2.0

Steps to reproduce

1. Start up the emulator
2. Export the host:port to PUBSUB_EMULATOR_HOST
3. Initialize a client and attempt to connect.

Instead of resolving the emulator host and skipping authentication, we now receive a DefaultCredentialsError. We shouldn't be required to authenticate when using an emulator.

Code example

# N.B. - start up your emulator in your terminal at the defined host
import os
os.environ["PUBSUB_EMULATOR_HOST"] = "0.0.0.0:8085"

from google.cloud.pubsub import SubscriberClient

SubscriberClient().subscribe("foo", lambda m: print(m)).result()

Stack trace

Traceback (most recent call last):
  File "<input>", line 1, in <module>
  File "/Users/seanstewart/PycharmProjects/eligibility-api/.venv/lib/python3.8/site-packages/google/cloud/pubsub_v1/subscriber/client.py", line 92, in __init__
    client_for_mtls_info = subscriber_client.SubscriberClient(
  File "/Users/seanstewart/PycharmProjects/eligibility-api/.venv/lib/python3.8/site-packages/google/pubsub_v1/services/subscriber/client.py", line 377, in __init__
    self._transport = Transport(
  File "/Users/seanstewart/PycharmProjects/eligibility-api/.venv/lib/python3.8/site-packages/google/pubsub_v1/services/subscriber/transports/grpc.py", line 161, in __init__
    credentials, _ = auth.default(
  File "/Users/seanstewart/PycharmProjects/eligibility-api/.venv/lib/python3.8/site-packages/google/auth/_default.py", line 356, in default
    raise exceptions.DefaultCredentialsError(_HELP_MESSAGE)
google.auth.exceptions.DefaultCredentialsError: Could not automatically determine credentials. Please set GOOGLE_APPLICATION_CREDENTIALS or explicitly create credentials and re-run the application. For more information, please see https://cloud.google.com/docs/authentication/getting-started

I've verified that downgrading to v2.1.0 resolves the issue.

[HemangChothani]

For now you can follow the steps to resolve the issue:

• pip install testutils

from test_utils.system import EmulatorCreds

SubscriberClient(credentials=EmulatorCreds).subscribe("foo", lambda m: print(m)).result()

OR

from google.auth.credentials import AnonymousCredentials

SubscriberClient(credentials=AnonymousCredentials).subscribe("foo", lambda m: print(m)).result()

[tombailey]

This is now resolved with v2.3.0 which just came out a few days ago.

Please disregard my original comment:

I recently encountered this issue and, while the above seems like a reasonable workaround, to me it is exactly that; a workaround.

The JavaScript client on NPM for GCloud PubSub doesn't require credentials to be provided when the PUBSUB_EMULATOR_HOST environment variable is specified. Initialisation is as simple as:

const {PubSub} = require('@google-cloud/pubsub');

new PubSub().subscription('foo').on('message', console.log);

I believe a better resolution to this issue would be to have the same support from the Python client library. It would bring consistency and avoid the hassle of things like:

import os
from google.auth.credentials import AnonymousCredentials

SubscriberClient(credentials=AnonymousCredentials if "PUBSUB_EMULATOR_HOST" in os.environ else None)

Also, it might be out of scope, but I find this chapter of the emulator host docs to be quite unhelpful as there is no mention of the Python requirement for AnonymousCredentials or EmulatorCreds to be provided.

Similarly, the sample snippets for this repository, linked to from the previous document, aren't working with the emulator due to the above issue. I think it would be helpful to mention the part about needing AnonymousCredentials or EmulatorCreds when using the emulator in the Authentication section of the readme. At the moment, the Authentication section recommends this article that says to use the GOOGLE_APPLICATION_CREDENTIALS environment variable. I don't think that is compatible with the PubSub emulator approach, is it?