Do I have to commit service account file my file for CI/CD? Why do you advise using a file path? Or am I confused?

[tinonetic]

Hi there,

I am a newbie to the Firebase Admin SDK.

I have gone through the docs on how to configure it for use. We have a CI/CD setup (using Git, Rancher & K8s... also our early attempt).

We know that you are not supposed to commit credentials.

But the documentation says:

Set the environment variable GOOGLE_APPLICATION_CREDENTIALS to the file path of the JSON file that contains your service account key. This variable only applies to your current shell session, so if you open a new session, set the variable again.

I am trying to test setting of the environment in my development environment (Windows).

The recommended way means I should run the following Powershell command:

$env:GOOGLE_APPLICATION_CREDENTIALS="C:\Users\username\Downloads\service-account-file.json"`

So that I can initialise as follows:

FirebaseApp.Create(new AppOptions()
{
    Credential = GoogleCredential.GetApplicationDefault(),
});

If I am running this, as advised, then for this to work, I will have to upload my credentials at some point in my CI/CD pipeline right? Is this an advisable way to do it?

[google-oss-bot]

I found a few problems with this issue:

• I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.
• This issue does not seem to follow the issue template. Make sure you provide all the required information.

[hiranya911]

Is this an advisable way to do it?

Service account files should never be checked into version control.

Your dev environment should make it available to your application via some scripting or automation (or just set it up manually for local testing). In production environments like Cloud Functions, Compute Engine and App Engine, you don't have to do anything extra as the environment will automatically provide app default credentials for you.

Please refer to https://cloud.google.com/docs/authentication/production for more information and best practices on app default credentials.