Subscribe Cloud Pub/Sub Topic in Kubernetes Operator

Stefanie Lai
Apr 21 · 4 min read
from unsplash, @jasonhogan

Last week, I was tackling a task subscribing to a PubSubTopic in our operator project, which I think is worth writing down. It gives me the same relief as reaching the top of a mountain. The bumpy path ahead, but you ride it out.

There were four “big stones” on the way, and I went on a smooth journey once I killed them. They were four “how to.”

  • How to set up the Google PubSub subscription in Go?
  • How to trigger the Kubernetes Operator after consuming the message?
  • How to write the unit test?
  • How to set the proper IAM?

Now, let’s go through the process with my code example of the solutions.

Google PubSub Subscription

PubSub is the message system on Google Cloud, similar to the commonly used Kafka in Java development, applying the producer/consumer mode to obtain messages in a completely decoupled manner, and implement the corresponding logic.

from Google PubSub doc

The detailed PubSub is so verbose that I will skip it. You can easily generalize from the messaging system you are using since their design ideas are basically the same. If you don’t know any messaging system, please read here.

I searched Google’s complex documentation system to seek some code examples. However, what I found was some related examples too simple to have any reference value. But there were still gains, the available Go library:

Let’s start with creating a client and a subscription object.

Then, we can call the Receive method to consume the required event.

The above is just a template code, the actual logic must be much more complicated, but we can conclude as follows.

  • Parse the message. It is normally JSON type and can be easily unmarshaled to specific ones.
  • Handle errors. Some errors should have the re-try logic, and this is where we call Nack().
  • Finish the process. Always it is calling Ack() and making sure the system knows this message is delivered and processed.

To be noted, your code needs to be idempotent so that the result will not change no matter how many times you receive the same messages.

Trigger actions by new messages

This part involves Go’s channel, a potent tool.

Usually, consuming message logic will be run in a Goroutine. Therefore, there is nothing more reasonable than the design of triggering the business logic call through the channel when receiving new messages.

The second function is setting up the Kubernetes Operator controller, using a watcher to monitor the channel.

Test Pubsub Subscription

Test with emulator

After completing the business logic code, then it’s about writing unit tests.

Test PubSub is no easy task since ordinary mock doesn’t apply here when I want to test the whole workflow. Seeking help from Google documentation again, I find emulator. Unfortunately, only Java examples. And I failed to find the proper Go library even I dug into Google’s Github repositories. If anyone knows, please throw a link in the comment. Thanks in advance!

Eventually, I set up a test server for the unit test with testcontainers plus gcloud emulator.

Upon getting the container instance, I could follow up on the PubsubClient and create a PubSub topic.

Finally, I can write the test case code with everything set.

Test with built-in Server

In addition to the testcontainers andemulator way, we can also rely on PublisherServerand SubscriberServerAPI to simulate the whole process, a solution I found in Google’s PubSub library and a better fit for cases when both publisher and subscriber tests are needed. See the complete code👉 here.

How to set the proper IAM

Now, I have the code and tests ready. What’s the next then? Oh right, the damn permissions.

I believe many may be confused by Google IAM permissions, and it is time to figure out PubSub related permissions and roles.

I spent some time scanning the crazy permission list to figure out what I need. My service account needs the pubsub.subscriptions.consumepermission to subscribe to the topics. This permission is tied up to a set of roles starting with roles/pubsub. Obviously, if you don’t own the topics, the suitable role is roles/pubsub.subscriber. To be clear, pubsub.subscriptions.list or pubsub.subscriptions.get are not required here.

After figuring out what kind of roles needy, I can either ask the admin who owns the topic to add my service account manually in UI or simply run the below command in CLI:

gcloud projects add-iam-policy-binding project-id — member=’’ — role=’roles/pubsub.subscriber

Because I already enabled declarative management in my cluster via Google Config Connector, it is super easy to add this IAMPolicy with the YAML below.

At the end

I listed all the crucial points of subscribing PubSub topics using Go, hoping it will be beneficial to anyone reading this article.

Thanks for reading!


Geek Culture

Proud to geek out.

Sign up for Geek Culture Hits

By Geek Culture

Subscribe to receive top 10 most read stories of Geek Culture — delivered straight into your inbox, once a week. Take a look.

By signing up, you will create a Medium account if you don’t already have one. Review our Privacy Policy for more information about our privacy practices.

Check your inbox
Medium sent you an email at to complete your subscription.

Stefanie Lai

Written by

Live in Stockholm. Love writing, interested in cooking, drawing and reading. Want to travel all around Europe with my cat.

Geek Culture

A new tech publication by Start it up (

Stefanie Lai

Written by

Live in Stockholm. Love writing, interested in cooking, drawing and reading. Want to travel all around Europe with my cat.

Geek Culture

A new tech publication by Start it up (

Medium is an open platform where 170 million readers come to find insightful and dynamic thinking. Here, expert and undiscovered voices alike dive into the heart of any topic and bring new ideas to the surface. Learn more

Follow the writers, publications, and topics that matter to you, and you’ll see them on your homepage and in your inbox. Explore

If you have a story to tell, knowledge to share, or a perspective to offer — welcome home. It’s easy and free to post your thinking on any topic. Write on Medium

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store