gcpclient¶

Detect Google Cloud credentials once, and share them as client options.

gcpclient hands out []option.ClientOption carrying a detected credential — the thing a Google Cloud service client is built from.

src := gcpclient.Ambient(gcpclient.WithScopes("https://www.googleapis.com/auth/cloud-platform"))

opts, err := src.GCPClientOptions(ctx)
client, err := secretmanager.NewClient(ctx, opts...)   // you own this, and you Close it

Why it yields options rather than a client¶

Every other provider module here hands out the thing you build a client from. This one looks like it could go further and hand you a ready-made client — and an earlier draft of the specification said it should.

It does not, for a reason that only appears with more than one consumer: the config family alone has three GCP adapters taking three different client types — *storage.Client, *parametermanager.Client, *secretmanager.Client. One accessor serves one of them. Three would drag three GCP service SDKs into this module and inherit that union to every consumer.

So what crosses the boundary is the credential. Detecting Application Default Credentials is the expensive, failure-prone, shareable part; constructing the client is the adapter's job — and so is closing it.

The full reasoning.

The rungs¶

Rung	You supply	When
`FromOptions`	options you already hold	an explicit credentials file, an emulator endpoint
`Ambient`	nothing	Application Default Credentials, detected once and shared
`PerCall`	nothing	the same, detected afresh every time and retained

Scopes are required and never guessed¶

Ambient and PerCall refuse without WithScopes:

no OAuth scopes configured; pass WithScopes with the scope the service needs

There is no safe default. cloud-platform grants everything the calling principal can do; anything narrower fails only later, when some call needs more. Each adapter knows the scope its service needs — this module does not, so it declines rather than choosing on your behalf.

Start here¶

Getting started
Share one credential across components
Why options, not a client

Where this comes from¶

org spec 0003 — P-2 as revised by R1, which is the revision that changed this module from yielding a client to yielding options.