Vercel's Google Cloud integration is broken

[ian]

Happy 2021 to everyone. I'm actually coming from #749 because of the same issues everyone else is running into re: complex secrets storage, and since this question seemed on-topic given this issue's underlying google cloud auth root cause, can we talk about Vercel's Google Cloud integration?

First things first: Vercel's Google Cloud integration is broken.

If someone:

1. Enables Vercel's Google Cloud integration from the Intetgrations tab, and
2. Adds GCLOUD_CREDENTIALS via "Add to Project" button

This will completely break serverless deploys since the associated GCLOUD_CREDENTIALS env var is above 4k:

Of course, many have found the solution via a workaround in #749 but the real question is why doesn't Vercel do auth the way that it's recommended from google?

Forget cramming B64 encoded keys manually split out from a service account json. Why doesn't Vercel just put the imported support key.json directly onto the stack instance and add a GOOGLE_APPLICATION_CREDENTIALS env var like google recommends?

Seems like this is by far the preferred method from google and it would actually fix the 4k env var issue that currently exists as part of this integration?

[coetry]

Hi @ian thank you for sharing your feedback. The Google Cloud integration was created by @rdev over the course of a weekend for an internal company Hackathon. It's marked as beta quality software and we've never endorsed it to be anything beyond that.

Some good news is that we're spending a lot more time on polishing our integrations, which includes making production quality integrations front and center with anything less than that taking a back seat.

[ian]

Well then for being a weekend project it's quite polished :)

If there's any other feedback I can offer lemme know. I'm not sure what the integration API looks like but supporting some sort of deploy runtime GCLOUD_CREDENTIALS file copy would be a solid solution that provides a working gCloud integration without any configuration.

[72L]

I'm new to Vercel and trying to figure out what to do after adding the GCP integration. There are no docs? I have a GCLOUD_CREDENTIALS environment variable added... now what? Understood this is a beta feature, but it seems pretty basic / important to have on the platform. If not GCP, curious what other services people are using for Cloud Storage?

[ian]

Poke @coetry

[72L]

Thanks @ian! Here's what I did in the end for Cloud Storage:

const { Storage } = require("@google-cloud/storage");
const storage = new Storage(
    process.env.GOOGLE_PRIVATE_KEY
        ? {
              credentials: {
                  client_email: process.env.GCLOUD_SERVICE_ACCOUNT_EMAIL,
                  private_key: process.env.GOOGLE_PRIVATE_KEY,
              },
          }
        : {}
);

GOOGLE_PRIVATE_KEY is just a string I copied directly from the service account json into the Vercel dashboard environment variables (it displays the newlines)

GCLOUD_SERVICE_ACCOUNT_EMAIL is the associated service account email

I check process.env.GOOGLE_PRIVATE_KEY because in .env.local I have it set up in the GCP recommended way: GOOGLE_APPLICATION_CREDENTIALS=./path/to/google-credentials.json

[72L]

Also, I deleted the GCLOUD_CREDENTIALS environment variable because there's a 4kb env variable limit and it's not used anymore now. Don't know what I'll do when I need to add more environment variables above 4kb... But hopefully Vercel will be fixed by then! haha

[ian]

Last I checked they have a limit on ENV var size and the key is larger than that. Did you try storing the key in Vercel ENV as ASCII and were able to? If so it sounds like it's something they fixed.

[72L]

Yeah I was able to store it as ASCII