Google Cloud Pub/Sub integration

Topic and least privilege

Use an existing project and topic. Grant the service account roles/pubsub.publisher on this topic. Optional pubsub.topics.get permission is needed for read-only connection verification; do not grant project Owner or Editor. Enter its client_email and RSA private_key fields in the encrypted credential form. Service-account keys must be protected and rotated. Workload identity is not implemented.

The adapter signs a short-lived RSA JWT and obtains an OAuth token from the fixed Google token endpoint, then calls the fixed Pub/Sub REST endpoint. It never follows token_uri from uploaded credential JSON or uses ambient metadata credentials. Publication uses base64 JSON and struct_event_id / struct_delivery_id attributes. Returned messageIds must contain one accepted publication.

Test and troubleshoot

Basic verification checks credentials and topic lookup where permitted; a principal with publish-only permissions may fail this read while publication remains possible. Explicit test-send is the publication test. HTTP 401/403 requires checking credentials and topic-level IAM. 404 indicates topic/project configuration; 429 and 5xx retry. Pub/Sub acceptance does not prove subscriber acknowledgment. Tokens are currently obtained per attempt; token caching and native batching are future efficiency work.