Support resolving credentials through Google ADC

[freddd]

Is your feature request related to a problem? Please describe.
When running locally and being authenticated using gcloud or in GKE/GCE/Cloud Run, etc on GCP I would expect the library to pick up the credentials automatically using Google ADC. I'd be super happy with just having it check for GOOGLE_APPLICATION_CREDENTIALS or gcloud auth as a first step.

Describe the solution you'd like
Google Application Default Credentials does the following checks:

1. Checks if the environment variable GOOGLE_APPLICATION_CREDENTIALS is set. If it's set it should be a path pointing to a json credentials file for a service account
2. Checks if you are authenticated using gcloud by checking:
   • %APPDATA%/gcloud/application_default_credentials.json on Windows
   • $HOME/.config/gcloud/application_default_credentials.json on Linux/OSX
3. Checks if you are running on GKE/GCE/AppEngine/Cloud Functions/Cloud Run.

An example of how it's done in the auth library provided by Google in Go: https://github.com/golang/oauth2/blob/f6687ab2804cbebdfdeef385bee94918b1ce83de/google/default.go#L111

[boulos]

(moving our discussion from #40 to here)

The one challenge is that tame-oauth tries to be sans-io, but determining if you're on GCP as the last step "requires" doing an http request to the metadata server (e.g., see the golang implementation at https://github.com/googleapis/google-cloud-go/blob/a3e97daf91e2ac1dd2f6b17bf2b919f4445be772/compute/metadata/metadata.go#L117 . GCE can be detected on some linux guests by looking at /sys/class/dmi/id/product_name, but that doesn't work on say Cloud Run).

@Jake-Shadle mentioned in #40 that the sans-io focus for tame-oauth is more narrowly "don't force a particular http library on you" (which I appreciate!), so checking the files for existence and/or parsing them is fair game. But detecting the metadata server needs another http request.

[boulos]

So actually, I think it's fine to do the "lookup /sys/class/dmi/id/product_name" trick (there's some equivalent on Windows that people seem to read via powershell, but I doubt you want to do that or even import WMI / the windows crate).

If one day Cloud Run fills that in with something starting with "Google", it should just work. That's what the golang client does (https://github.com/googleapis/google-cloud-go/blob/a3e97daf91e2ac1dd2f6b17bf2b919f4445be772/compute/metadata/metadata.go#L195) and seems reasonable.

[Jake-Shadle]

Yah, that seems completely reasonable to me, if someone wants Windows support they can open a PR later.

[Jake-Shadle]

Resolved by #42

[freddd]

Awesome! @glindstedt FYI

[boulos]

Just remember the tokens won't be cached until expiry unless #45 is resolved. That said, I was able to run cargo test on gcsfuser, which pulls a token per operation via add_auth_header. So definitely enough to get started even as is.