Use GCE service account

[tyron_]

I am running Splunk on top of GCE instances, and I'd like to use GCE service account for the pubsub subscription instead of providing a JSON file. Is that possible? What would be the effort to implement this?

[tyron_ · Accepted solution]

After asking, I decided to take a look and implement myself. If anyone needs a similar solution, you need to change 2 files: bin/splunk_ta_gcp/common/credentials.py and bin/splunk_ta_gcp/legacy/common.py.
The diff of the changes (git format) is available below. Too bad Splunk doesn't have an open source repo for this add-on.

diff --git a/bin/splunk_ta_gcp/common/credentials.py b/bin/splunk_ta_gcp/common/credentials.py
index 3bacb9f..c763fb8 100644
--- a/bin/splunk_ta_gcp/common/credentials.py
+++ b/bin/splunk_ta_gcp/common/credentials.py
@@ -1,6 +1,6 @@
 import json
 from google.oauth2 import service_account
-
+import google.auth

 class CredentialFactory(object):
     def __init__(self, config):
@@ -11,4 +11,9 @@ def load(self, profile, scopes):
         content = self._config.load(collection, stanza=profile, virtual=True)
         key = content['google_credentials']
         info = json.loads(key)
+
+        if not bool(info): # bool(dict) evaluates to False if empty
+            credentials, _ = google.auth.default()
+            return credentials
+
         return service_account.Credentials.from_service_account_info(info, scopes=scopes)
diff --git a/bin/splunk_ta_gcp/legacy/common.py b/bin/splunk_ta_gcp/legacy/common.py
index 2d7b601..f23f301 100755
--- a/bin/splunk_ta_gcp/legacy/common.py
+++ b/bin/splunk_ta_gcp/legacy/common.py
@@ -192,16 +192,19 @@ def create_google_client(config):
     }
     """

-    if config.get("google_credentials"):
+    scopes = config.get("scopes")
+
+    if config.get("google_credentials") and bool(config["google_credentials"]):
         credentials = service_account.Credentials.from_service_account_info(
             config["google_credentials"]
         )
+        if scopes:
+            credentials = credentials.with_scopes(scopes)
     else:
-        credentials, project = google.auth.default()
-
-    scopes = config.get("scopes")
-    if scopes:
-        credentials = credentials.with_scopes(scopes)
+        if scopes:
+            credentials, project = google.auth.default(scopes=scopes)
+        else:
+            credentials, project = google.auth.default()

     http = sr.build_http_connection(config, timeout=config.get("pulling_interval", 30))
     http = AuthorizedHttp(credentials, http=http)

[richgalloway]

@tyron_ If your problem is resolved, please accept the answer to help future readers.