gcloud run & Firebase Admin SDK

Question

I have deployed a JVM application to Google cloud run that uses the Firebase Admin SDK to send notifications on Firebase Cloud Messaging. Everything works fine locally using GOOGLE_APPLICATION_CREDENTIALS. The deployed app, however, throws errors as follows:

java.lang.IllegalArgumentException: Project ID is required to access messaging service. Use a service account credential or set the project ID explicitly via FirebaseOptions. Alternatively you can also set the project ID via the GOOGLE_CLOUD_PROJECT environment variable.

I create the FirebaseMessaging instance as:

FirebaseMessaging.getInstance(
FirebaseApp.initializeApp(
    FirebaseOptions.Builder().setCredentials(
        GoogleCredentials.getApplicationDefault()
    ).build()

I have deployed the Cloud Run instance with a service account which has admin permissions for Cloud Run.

My understanding is that an application deployed to any GCP service acquires application credentials automatically. Is there a difference for the combination of Cloud Run and Firebase Admin SDK?

Any help would be much appreciated.

Doug Stevenson Doug Stevenson · Accepted Answer · 2020-03-15T20:47:02

You have two options:

Query the cloud metadata service to find the project ID where your Cloud Run instance is deployed to. This can only be done within Cloud Run - it won't work if you're testing locally.
Make the project ID available to Cloud Run in some way during deployment.

An easy way to implement #2 is to put the project ID in the environment for the Admin SDK to automatically pick up. For example, a shell script:

service_id="your-service-id"
project_id="your-project-id"

gcloud run deploy "$service_id" \
    --project "$project_id" \
    --image "..." \
    --platform managed \
    --update-env-vars "GOOGLE_CLOUD_PROJECT=$project_id"

Note the --update-env-vars which populates GOOGLE_CLOUD_PROJECT.

gcloud run & Firebase Admin SDK

1 Answers