{"record":{"id":"d338707bee223902","repo":"risingwavelabs/risingwave","slug":"google-pub-sub-error-0","errorCode":null,"errorMessage":"Google Pub/Sub error: {0}","messagePattern":"Google Pub/Sub error: (.+?)","errorType":"exception","errorClass":"SinkError","httpStatus":null,"severity":"error","filePath":"src/connector/src/sink/mod.rs","lineNumber":1148,"sourceCode":"    #[error(\"Http error: {0}\")]\n    Http(\n        #[source]\n        #[backtrace]\n        anyhow::Error,\n    ),\n    #[error(\"Mqtt error: {0}\")]\n    Mqtt(\n        #[source]\n        #[backtrace]\n        anyhow::Error,\n    ),\n    #[error(\"Nats error: {0}\")]\n    Nats(\n        #[source]\n        #[backtrace]\n        anyhow::Error,\n    ),\n    #[error(\"Google Pub/Sub error: {0}\")]\n    GooglePubSub(\n        #[source]\n        #[backtrace]\n        anyhow::Error,\n    ),\n    #[error(\"Doris/Starrocks connect error: {0}\")]\n    DorisStarrocksConnect(\n        #[source]\n        #[backtrace]\n        anyhow::Error,\n    ),\n    #[error(\"Doris error: {0}\")]\n    Doris(String),\n    #[error(\"DeltaLake error: {0}\")]\n    DeltaLake(\n        #[source]\n        #[backtrace]\n        anyhow::Error,","sourceCodeStart":1130,"sourceCodeEnd":1166,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/connector/src/sink/mod.rs#L1130-L1166","documentation":"SinkError::GooglePubSub(anyhow::Error) in src/connector/src/sink/mod.rs:1149 wraps failures from the Google Cloud Pub/Sub sink connector, preserving the source anyhow::Error and backtrace from the google-cloud-pubsub client. Raised during client construction, authentication, or when publishing messages to a topic fails.","triggerScenarios":"CREATE SINK ... WITH (connector='google_pubsub') when: GOOGLE_APPLICATION_CREDENTIALS is unset/invalid, the service account lacks pubsub.publisher on the topic, the topic ID/project is wrong or nonexistent, gRPC to pubsub.googleapis.com fails, or a publish batch exceeds limits or times out.","commonSituations":"Missing or malformed service-account JSON key; workload identity/ADC not configured in the deployment environment; topic deleted or renamed after sink creation; private clusters without egress to Google APIs; message size over the 10MB Pub/Sub limit.","solutions":["Verify credentials: ensure GOOGLE_APPLICATION_CREDENTIALS points to a valid service-account JSON key (or ADC/workload identity is configured), then recreate/restart the sink.","Grant roles/pubsub.publisher on the topic to the service account and confirm project ID and topic name in the sink options.","Test with gcloud pubsub topics publish <topic> --message=hi using the same credentials.","Check network egress (DNS/TLS to pubsub.googleapis.com) from the RisingWave host or configure a proxy.","If publishing large messages, keep payloads under Pub/Sub limits or compress/shrink the encoded rows."],"exampleFix":"// before: credentials not visible to RisingWave\nCREATE SINK gcp_sink FROM mv WITH (\n  connector = 'google_pubsub', topic_id = 'projects/my-proj/topics/events'\n);\n// after: export valid credentials before starting\n// export GOOGLE_APPLICATION_CREDENTIALS=/path/to/sa.json\nCREATE SINK gcp_sink FROM mv WITH (\n  connector = 'google_pubsub', topic_id = 'projects/my-proj/topics/events'\n);","handlingStrategy":"validation","validationCode":"# Validate credentials and publish permission before creating the sink\n[[ -n \"$GOOGLE_APPLICATION_CREDENTIALS\" && -f \"$GOOGLE_APPLICATION_CREDENTIALS\" ]] || echo 'missing SA key'\ngcloud pubsub topics publish \"$TOPIC_ID\" --message=check --project=\"$PROJECT\" || echo 'publish not permitted / topic missing'","typeGuard":"fn pubsub_sink_config_ok(topic_id: &str, creds_path: Option<&str>) -> bool {\n    topic_id.starts_with(\"projects/\") && topic_id.contains(\"/topics/\")\n        && creds_path.map(|p| std::path::Path::new(p).exists()).unwrap_or(true)\n}","tryCatchPattern":"// Map auth vs topic vs transport failures to different actions\nmatch sink_result {\n    Err(SinkError::GooglePubSub(e)) if is_auth_error(&e) => refresh_credentials(),\n    Err(SinkError::GooglePubSub(e)) if is_not_found(&e) => verify_topic_exists(),\n    Err(SinkError::GooglePubSub(e)) => retry_with_backoff(&e),\n    Ok(v) => process(v),\n}","preventionTips":["Set GOOGLE_APPLICATION_CREDENTIALS (or workload identity/ADC) in the RisingWave deployment before enabling GCP sinks","Grant roles/pubsub.publisher to the service account on the exact topic","Verify topic existence and project ID with gcloud before sink creation","Ensure network egress to pubsub.googleapis.com (DNS, TLS) from private clusters","Keep published messages under the 10MB Pub/Sub limit"],"tags":["gcp","pubsub","sink","authentication","risingwave-connector"],"backgroundTag":"missing-credentials","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}