Deployment with gcloud utility fails without additional environment variables

[tilgovi]

Related issues

#669
#437

Version info

node: v12.18.3

firebase-functions: v3.3.0

firebase-admin: v8.9.2

I have looked in the source and this issue still exists. Read further for details.

Test case

This simple, quickstart example can be used to demonstrate the issue: https://github.com/firebase/functions-samples/tree/master/quickstarts/uppercase-firestore/functions

Steps to reproduce

• Deploy the function using gcloud functions deploy, not firebase deploy
• Write to the collection

Expected behavior

Since firebase-admin can read the project ID from the application default credentials, I expect not to require any explicit setting for the project ID.

Actual behavior

Code in firebase-functions throws an exception about GCLOUD_PROJECT not being defined.
https://github.com/firebase/firebase-functions/blob/master/src/providers/firestore.ts#L112

Were you able to successfully deploy your functions?

I was lead to this discovery because the documentation around the environment variables is not very clear:

There are environment variables that are automatically populated in the functions runtime

Source: https://firebase.google.com/docs/functions/config-env

This statement is only true if you deploy with firebase deploy, which populates FIREBASE_CONFIG.
I think firebase-functions should support the project ID from the default credentials, or use GOOGLE_CLOUD_PROJECT. The warning during startup if neither GCLOUD_PROJECT nor FIREBASE_CONFIG is also erroneous, because initializing firebase-admin works just fine using the project ID from the default credentials. Only firebase-functions fails.

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[mbleigh]

Default credentials cannot be read synchronously in a Cloud Function but the Admin SDK is initialized synchronously. Therefore without an available environment variable, it is not possible to implicitly initialize without waiting for a network call to resolve default credentials. To behave otherwise would require a different initialization pattern and would be an issue to address in the firebase-admin-node repo.

…

On Wed, Sep 2, 2020, 6:23 PM Google Open Source Bot < ***@***.***> wrote: I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#772 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAH7RPCW6SY2XGFUVAOZDSD3VZHANCNFSM4QUCNR7A> .

[tilgovi]

That's a very helpful response, thank you.

I read more carefully and I see that firebase-admin can only get the project ID from a ServiceAccountCredential, and I'm guessing that functions run maybe with a ComputeEngineCredential that needs to fetch credentials from the metadata service.

If that's the case, then it makes sense that there is a requirement for firebase-functions to have synchronous access to the project ID through an environment variable.

Would a PR to support GOOGLE_CLOUD_PROJECT as an alternative to GCLOUD_PROJECT be appreciated?

[mbleigh]

Unfortunately, I believe in more recent Node.js runtimes in Cloud Functions, not even GOOGLE_CLOUD_PROJECT is available by default in the functions runtime (the only place it you can get it is by async querying the metadata service via HTTP). If I'm misremembering that fact and GOOGLE_CLOUD_PROJECT is available by default in all Node.js runtimes, I'd be happy to take a look at a PR.

[tilgovi]

It's not available by default. I was suggesting it only for consistency with other libraries like googleapis/google-auth-library-nodejs, which recognizes both.

[tilgovi]

It also seems like it should maybe be possible, though perhaps uncommon or not advisable for some reason, to provide service account credentials as JSON in GOOGLE_APPLICATIONS_CREDENTIALS.

It also seems like firebase-admin takes care of a lot of this, so maybe it's possible to lean on it rather than munge environment variables and throw errors in firebase-functions.

https://github.com/firebase/firebase-admin-node/blob/master/src/firestore/firestore-internal.ts#L66

If I tried to make a PR, I would look at either supporting these alternatives ways to get synchronous credentials, or remove some of the code in firebase-functions that tries to sniff out credentials when firebase-admin can probably handle most of it.

[tilgovi]

I'm closing this ticket, though. Thank you so much for the fast and clear explanation.