In the final layer of a container, it is pretty common to clear out env vars by setting them to empty. When GOOGLE_APPLICATION_CREDENTIALS exists but is empty (e.g. after pulling packages from Google Artifact Registry), the default credentials for the pubsub transport fails to use the assigned service account / metadata server.
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/usr/lib/python3.11/asyncio/base_events.py", line 653, in run_until_complete
return future.result()
^^^^^^^^^^^^^^^
File "<stdin>", line 2, in setup
File "/usr/local/lib/python3.11/dist-packages/google/pubsub_v1/services/publisher/async_client.py", line 215, in __init__
self._client = PublisherClient(
^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/google/pubsub_v1/services/publisher/client.py", line 492, in __init__
self._transport = Transport(
^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/google/pubsub_v1/services/publisher/transports/grpc_asyncio.py", line 198, in __init__
super().__init__(
File "/usr/local/lib/python3.11/dist-packages/google/pubsub_v1/services/publisher/transports/base.py", line 104, in __init__
credentials, _ = google.auth.default(
^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/google/auth/_default.py", line 659, in default
credentials, project_id = checker()
^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/google/auth/_default.py", line 652, in <lambda>
lambda: _get_explicit_environ_credentials(quota_project_id=quota_project_id),
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/google/auth/_default.py", line 272, in _get_explicit_environ_credentials
credentials, project_id = load_credentials_from_file(
^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/google/auth/_default.py", line 116, in load_credentials_from_file
raise exceptions.DefaultCredentialsError(
google.auth.exceptions.DefaultCredentialsError: File was not found.
In the final layer of a container, it is pretty common to clear out env vars by setting them to empty. When
GOOGLE_APPLICATION_CREDENTIALSexists but is empty (e.g. after pulling packages from Google Artifact Registry), the default credentials for the pubsub transport fails to use the assigned service account / metadata server.Environment details
Linux 5.10.176+Python 3.11.2pip 23.0.1 from /usr/lib/python3/dist-packages/pip (python 3.11)google-cloud-pubsubversion:2.18.3Steps to reproduce
Code example
Stack trace