cloud

README

Google Cloud Client Libraries for Go

Go packages for Google Cloud Platform services.

import "cloud.google.com/go"

To install the packages on your system, do not clone the repo. Instead:

1. Change to your project directory:

   cd /my/cloud/project
   

2. Get the package you want to use. Some products have their own module, so it's best to go get the package(s) you want to use:

   $ go get cloud.google.com/go/firestore # Replace with the package you want to use.
   

NOTE: Some of these packages are under development, and may occasionally make backwards-incompatible changes.

NOTE: Github repo is a mirror of https://code.googlesource.com/gocloud.

Supported APIs

Google API	Status	Package
Asset	stable	cloud.google.com/go/asset/apiv1
Automl	stable	cloud.google.com/go/automl/apiv1
BigQuery	stable	cloud.google.com/go/bigquery
Bigtable	stable	cloud.google.com/go/bigtable
Cloudbuild	stable	cloud.google.com/go/cloudbuild/apiv1
Cloudtasks	stable	cloud.google.com/go/cloudtasks/apiv2
Container	stable	cloud.google.com/go/container/apiv1
ContainerAnalysis	beta	cloud.google.com/go/containeranalysis/apiv1
Dataproc	stable	cloud.google.com/go/dataproc/apiv1
Datastore	stable	cloud.google.com/go/datastore
Debugger	stable	cloud.google.com/go/debugger/apiv2
Dialogflow	stable	cloud.google.com/go/dialogflow/apiv2
Data Loss Prevention	stable	cloud.google.com/go/dlp/apiv2
ErrorReporting	alpha	cloud.google.com/go/errorreporting
Firestore	stable	cloud.google.com/go/firestore
IAM	stable	cloud.google.com/go/iam
IoT	stable	cloud.google.com/go/iot/apiv1
IRM	alpha	cloud.google.com/go/irm/apiv1alpha2
KMS	stable	cloud.google.com/go/kms/apiv1
Natural Language	stable	cloud.google.com/go/language/apiv1
Logging	stable	cloud.google.com/go/logging
Memorystore	alpha	cloud.google.com/go/redis/apiv1
Monitoring	stable	cloud.google.com/go/monitoring/apiv3
OS Login	stable	cloud.google.com/go/oslogin/apiv1
Pub/Sub	stable	cloud.google.com/go/pubsub
Phishing Protection	alpha	cloud.google.com/go/phishingprotection/apiv1beta1
reCAPTCHA Enterprise	alpha	cloud.google.com/go/recaptchaenterprise/apiv1beta1
Recommender	beta	cloud.google.com/go/recommender/apiv1beta1
Scheduler	stable	cloud.google.com/go/scheduler/apiv1
Securitycenter	stable	cloud.google.com/go/securitycenter/apiv1
Spanner	stable	cloud.google.com/go/spanner
Speech	stable	cloud.google.com/go/speech/apiv1
Storage	stable	cloud.google.com/go/storage
Talent	alpha	cloud.google.com/go/talent/apiv4beta1
Text To Speech	stable	cloud.google.com/go/texttospeech/apiv1
Trace	stable	cloud.google.com/go/trace/apiv2
Translate	stable	cloud.google.com/go/translate
Video Intelligence	beta	cloud.google.com/go/videointelligence/apiv1beta2
Vision	stable	cloud.google.com/go/vision/apiv1
Webrisk	alpha	cloud.google.com/go/webrisk/apiv1beta1

Alpha status: the API is still being actively developed. As a result, it might change in backward-incompatible ways and is not recommended for production use.

Beta status: the API is largely complete, but still has outstanding features and bugs to be addressed. There may be minor backwards-incompatible changes where necessary.

Stable status: the API is mature and ready for production use. We will continue addressing bugs and feature requests.

Documentation and examples are available at pkg.go.dev/cloud.google.com/go

Go Versions Supported

We support the two most recent major versions of Go. If Google App Engine uses an older version, we support that as well.

Authorization

By default, each API will use Google Application Default Credentials for authorization credentials used in calling the API endpoints. This will allow your application to run in many environments without requiring explicit configuration.

client, err := storage.NewClient(ctx)

To authorize using a JSON key file, pass option.WithCredentialsFile to the NewClient function of the desired package. For example:

client, err := storage.NewClient(ctx, option.WithCredentialsFile("path/to/keyfile.json"))

You can exert more control over authorization by using the golang.org/x/oauth2 package to create an oauth2.TokenSource. Then pass option.WithTokenSource to the NewClient function: snip:# (auth-ts)

tokenSource := ...
client, err := storage.NewClient(ctx, option.WithTokenSource(tokenSource))

Contributing

Contributions are welcome. Please, see the CONTRIBUTING document for details.

Please note that this project is released with a Contributor Code of Conduct. By participating in this project you agree to abide by its terms. See Contributor Code of Conduct for more information.

Documentation

Overview

Package cloud is the root of the packages used to access Google Cloud Services. See https://godoc.org/cloud.google.com/go for a full list of sub-packages.

Client Options

All clients in sub-packages are configurable via client options. These options are described here: https://godoc.org/google.golang.org/api/option.

Authentication and Authorization

All the clients in sub-packages support authentication via Google Application Default Credentials (see https://cloud.google.com/docs/authentication/production), or by providing a JSON key file for a Service Account. See the authentication examples in this package for details.

Timeouts and Cancellation

By default, all requests in sub-packages will run indefinitely, retrying on transient errors when correctness allows. To set timeouts or arrange for cancellation, use contexts. See the examples for details.

Do not attempt to control the initial connection (dialing) of a service by setting a timeout on the context passed to NewClient. Dialing is non-blocking, so timeouts would be ineffective and would only interfere with credential refreshing, which uses the same context.

Connection Pooling

Connection pooling differs in clients based on their transport. Cloud clients either rely on HTTP or gRPC transports to communicate with Google Cloud.

Cloud clients that use HTTP (bigquery, compute, storage, and translate) rely on the underlying HTTP transport to cache connections for later re-use. These are cached to the default http.MaxIdleConns and http.MaxIdleConnsPerHost settings in http.DefaultTransport.

For gRPC clients (all others in this repo), connection pooling is configurable. Users of cloud client libraries may specify option.WithGRPCConnectionPool(n) as a client option to NewClient calls. This configures the underlying gRPC connections to be pooled and addressed in a round robin fashion.

Using the Libraries with Docker

Minimal docker images like Alpine lack CA certificates. This causes RPCs to appear to hang, because gRPC retries indefinitely. See https://github.com/googleapis/google-cloud-go/issues/928 for more information.

Debugging

To see gRPC logs, set the environment variable GRPC_GO_LOG_SEVERITY_LEVEL. See https://godoc.org/google.golang.org/grpc/grpclog for more information.

For HTTP logging, set the GODEBUG environment variable to "http2debug=1" or "http2debug=2".

Client Stability

Clients in this repository are considered alpha or beta unless otherwise marked as stable in the README.md. Semver is not used to communicate stability of clients.

Alpha and beta clients may change or go away without notice.

Clients marked stable will maintain compatibility with future versions for as long as we can reasonably sustain. Incompatible changes might be made in some situations, including:

- Security bugs may prompt backwards-incompatible changes.

- Situations in which components are no longer feasible to maintain without making breaking changes, including removal.

- Parts of the client surface may be outright unstable and subject to change. These parts of the surface will be labeled with the note, "It is EXPERIMENTAL and subject to change or removal without notice."

Example (ApplicationDefaultCredentials)

Google Application Default Credentials is the recommended way to authorize and authenticate clients.

For information on how to create and obtain Application Default Credentials, see https://developers.google.com/identity/protocols/application-default-credentials.

package main

import (
	"context"

	secretmanager "cloud.google.com/go/secretmanager/apiv1"
)

func main() {
	client, err := secretmanager.NewClient(context.Background())
	if err != nil {
		// TODO: handle error.
	}
	_ = client // Use the client.
}

Example (Cancellation)

To arrange for an RPC to be canceled, use context.WithCancel.

package main

import (
	"context"

	secretmanager "cloud.google.com/go/secretmanager/apiv1"

	secretmanagerpb "google.golang.org/genproto/googleapis/cloud/secretmanager/v1"
)

func main() {
	ctx := context.Background()
	// Do not cancel the context passed to NewClient: dialing happens asynchronously,
	// and the context is used to refresh credentials in the background.
	client, err := secretmanager.NewClient(ctx)
	if err != nil {
		// TODO: handle error.
	}
	cctx, cancel := context.WithCancel(ctx)
	defer cancel() // Always call cancel.

	// TODO: Make the cancel function available to whatever might want to cancel the
	// call--perhaps a GUI button.
	req := &secretmanagerpb.DeleteSecretRequest{Name: "projects/proj/secrets/name"}
	if err := client.DeleteSecret(cctx, req); err != nil {
		// TODO: handle error.
	}
}

Example (CredentialsFile)

You can use a file with credentials to authenticate and authorize, such as a JSON key file associated with a Google service account. Service Account keys can be created and downloaded from https://console.developers.google.com/permissions/serviceaccounts.

This example uses the Datastore client, but the same steps apply to the other client libraries underneath this package.

package main

import (
	"context"

	secretmanager "cloud.google.com/go/secretmanager/apiv1"
	"google.golang.org/api/option"
)

func main() {
	client, err := secretmanager.NewClient(context.Background(),
		option.WithCredentialsFile("/path/to/service-account-key.json"))
	if err != nil {
		// TODO: handle error.
	}
	_ = client // Use the client.
}

Example (CredentialsFromJSON)

In some cases (for instance, you don't want to store secrets on disk), you can create credentials from in-memory JSON and use the WithCredentials option.

The google package in this example is at golang.org/x/oauth2/google.

This example uses the Secret Manager client, but the same steps apply to the other client libraries underneath this package. Note that scopes can be found at https://developers.google.com/identity/protocols/googlescopes, and are also provided in all auto-generated libraries: for example, cloud.google.com/go/secretmanager/apiv1 provides DefaultAuthScopes.

package main

import (
	"context"

	secretmanager "cloud.google.com/go/secretmanager/apiv1"
	"golang.org/x/oauth2/google"
	"google.golang.org/api/option"
)

func main() {
	ctx := context.Background()
	creds, err := google.CredentialsFromJSON(ctx, []byte("JSON creds"), secretmanager.DefaultAuthScopes()...)
	if err != nil {
		// TODO: handle error.
	}
	client, err := secretmanager.NewClient(ctx, option.WithCredentials(creds))
	if err != nil {
		// TODO: handle error.
	}
	_ = client // Use the client.
}

Example (Timeout)

To set a timeout for an RPC, use context.WithTimeout.

package main

import (
	"context"
	"time"

	secretmanager "cloud.google.com/go/secretmanager/apiv1"

	secretmanagerpb "google.golang.org/genproto/googleapis/cloud/secretmanager/v1"
)

func main() {
	ctx := context.Background()
	// Do not set a timeout on the context passed to NewClient: dialing happens
	// asynchronously, and the context is used to refresh credentials in the
	// background.
	client, err := secretmanager.NewClient(ctx)
	if err != nil {
		// TODO: handle error.
	}
	// Time out if it takes more than 10 seconds to create a dataset.
	tctx, cancel := context.WithTimeout(ctx, 10*time.Second)
	defer cancel() // Always call cancel.

	req := &secretmanagerpb.DeleteSecretRequest{Name: "projects/project-id/secrets/name"}
	if err := client.DeleteSecret(tctx, req); err != nil {
		// TODO: handle error.
	}
}