pubsub: simple subscribers require permission pubsub.subscriptions.get since v1.10.2

[p-jahn]

Client

PubSub

Environment

• Alpine Docker on GKE
• Service using a service account that has roles/pubsub.subscriber IAM membership for my subscription

Go Environment

go version go1.16.2

Code

package main

import (
	"context"
	"log"
	"os/signal"

	"cloud.google.com/go/pubsub"
)

func main() {
	ctx := context.Background()
	client, err := pubsub.NewClient(ctx, "my-project")	
	if err != nil {
		log.Fatal("failed to create client:", err)
	}

	rxCtx, stop := signal.NotifyContext(ctx, os.Interrupt)
	defer stop()

	sub := client.Subscription("my-subscription")
	err = sub.Receive(rxCtx, func(_ context.Context, msg *pubsub.Message) {
		log.Println("received a message:", msg.ID)
		msg.Ack()
	})

	if err != nil {
		log.Fatal("failed to receive:", err)
	}
}

Expected behavior

I can receive messages

Actual behavior

failed to receive: sub.Config err: rpc error: code = PermissionDenied desc = User not authorized to perform this action.

Additional context

Started after upgrading to v1.10.2.

Looks to be introduced by the Subscription.Config(context.Context) call in fix for #3884.

Subscription.Config() requires pubsub.subscriptions.get permission for

// Config fetches the current configuration for the subscription.
func (s *Subscription) Config(ctx context.Context) (SubscriptionConfig, error) {
	pbSub, err := s.c.subc.GetSubscription(ctx, &pb.GetSubscriptionRequest{Subscription: s.name})
...

[hongalex]

Apologies for the delay in addressing this. As you pointed out, this was caused by #3886, so that when subscribing from subscriptions without ordering keys enabled, your messages will not be delivered in order. This might be useful for performance reasons.

I'll open a PR to check for config and if this call fails, just default to checking the ordering keys field of the received message. In the meantime, please add roles/pubsub.viewer or roles/viewer permissions to the service account. For more info, see access control.

[p-jahn]

Thanks for the fix @hongalex 💯

[hongalex]

This has been released in cloud.google.com/go/pubsub v1.10.3.