Pub/Sub

Google Pub/Sub is the messaging backbone for event-driven services on GCP. zop.dev manages topics, subscriptions, and schemas, and wires per-workload access credentials through the namespace layer.

Topics, subscriptions, schemas, and their IAM

Topics, subscriptions, and schemas, plus per-service and per-cronjob IAM grants with dedicated pubsub_editor service accounts whose keys land in Kubernetes secrets.

Storage policy, ack deadline, and push config

Topics: name, message_storage_policy regions, schema_settings, retention. Subscriptions: ack_deadline, retention, retain_acked, expiration TTL, push_config with endpoint and OIDC token. Schemas: name, type, definition.

No Azure equivalent, MSK on AWS

Pub/Sub is GCP-only; the cross-provider messaging equivalents are MSK on AWS (and nothing yet on Azure).

Options that map to failure modes

The subscription settings are a catalog of distributed-messaging failure modes with knobs attached. ack_deadline is the redelivery clock: shorter than real processing time means healthy work gets delivered twice, so consumers must be idempotent either way. Retention and retain_acked decide whether a bad deploy can be replayed after the fact: retained acked messages are the undo buffer for consumers that processed garbage. push_config with an OIDC token moves delivery to an authenticated HTTPS endpoint, trading pull-loop control for push simplicity. None of the defaults are wrong; all of them encode assumptions worth making consciously.

Idle subscriptions self-destruct

The expiration TTL is the setting that surprises people: Google’s default removes a subscription after 31 days without subscriber activity, taking its backlog with it. A consumer paused for a quarter, a disaster-recovery pipeline that only runs in drills, a seasonal batch job: all are candidates for silent deletion followed by a confusing absence months later. Anything intentionally idle needs its TTL extended or removed at creation.

Schemas bind at the beginning

A topic’s schema association (schema_settings) is set when the topic is created. A topic born without a schema cannot adopt one later. Teams that want enforced message contracts need to decide at topic creation, because retrofitting means a new topic and a producer-consumer migration.

Credentials are per workload

The namespace layer creates a dedicated pubsub_editor service account per service and per cron job, with keys landing in Kubernetes secrets. Messaging access is therefore scoped to the workload (one consumer’s credential is not the namespace’s) at the cost of static keys that belong in the rotation inventory. Pub/Sub itself bills by data volume delivered, with retained backlog as the storage-shaped extra.