Google-cloud-python: Provide a way to retrieve gcloud config programmatically

[nikhilk]

especially things like default project id.

[daspecster]

@nikhilk, You can get the current client project ID via client.project

Was there something else you're trying to access?

[nikhilk]

I must be missing something obvious. I tried the following two:

pip install gcloud

import gcloud
gcloud.client.project

-- as well as --

import gcloud.client
gcloud.client.project

-- then tried to instantiate Client --
c = gcloud.client.Client()
but get an error about no app default credentials being available.

Can you help with the exact code I need to use?

[daspecster]

You can use the gcloud sdk cli tool to get your default credentials as outline here.

After that, your last example should work.

from gcloud import pubsub  # Or whichever service you need
client = pubsub.Client()
client.project

You can also use $ gcloud config list project from the cli to get the project ID if you have the SDK installed.

[dhermes]

This project is distinct from the gcloud SDK. You'd want to ask that team for such an API. @jgeewax @jonparrott who would be the person to reach out to for that?

[nikhilk]

The desire was to use a programmatic API rather than calling gcloud as a subprocess (which is what we do right now). Yes, ideally this would be functionality gcloud would expose as a library, but gcloud-python seemed like the next logical thing.

So from the example above, it seems if you create a client for a particular service, you can get the project off of it. I guess I would be expected there be a way to get the project without needing to first create a client instance for a specific service, but I suppose that is a possible workaround that could work.

[tseaver]

gcloud._helpers._determine_default_project is the function the various Client classes use to sniff a project (the datastore client tweaks it a bit to deal with the emulator). It isn't public, but we could look at making it so. Note that the logic there is not related (directly) to the gcloud CLI's notion of determining the project.

[daspecster]

@nikhilk do you think that @tseaver's answer will work for you?

[jgeewax]

I'm not sure this has been settled... It seems like we have a way to do it that is private and not documented, and we should look at potentially exposing this... Re-opening for discussion, feel free to re-close if there was an off-line conversation that was omitted here.

[dhermes]

@jgeewax That is outside our purview. If people want to use what we do it is all in public surfaces provided by https://github.com/GoogleCloudPlatform/google-auth-library-python/

[timonbimon]

hey do i understand correctly that there is no way currently to access the currently active account (that i could get with 'gcloud auth list' on the command line) programmatically via python?

[tseaver]

@timonbimon Unlike the gcloud CLI, the google-cloud-* libraries do not keep any persistent store of credentials: we use the service account credentials file explicitly set in the environment (GOOGLE_APPLICATION_CREDENTIALS), or passed explicitly to the client's from_service_account_json method (we fall back from those to the implicit ones: gcloud SDK, GAE, or GCE)

If you have a client instance, you can query its project attribute to get the named project associated with the client's credentials. Two of the API clients (bigquery and storage) expose a get_service_account_email method which returns the e-mail address associated with the client.

While we don't currently expose the _credentials attribute of client instances as a public API for any client except spanner's: you could use the private attribute to get information using the interface provided by google.auth.credentials.Signing.signer_email.