[Feature Request]: Allow to authenticate at GCP without api key

[RouvenG]

Describe the problem

Currently I can only authenticate using the API which is generally not a recommended procedure. There is not way to use GCP's normal authentication flow e.g. through application default credentials

(see https://github.com/chroma-core/chroma/blob/main/chromadb/utils/embedding_functions/google_embedding_function.py)

Describe the proposed solution

When creating an instance of GooglePalmEmbeddingFunction, GoogleGenerativeAiEmbeddingFunction or
GoogleVertexEmbeddingFunction and not API key is provided, the application default credentials should be used.

Alternatives considered

I don't see other options than implementing the standard authentication mechanism for applications connecting to the GCP

Importance

i cannot use Chroma without it

Additional Information

No response

[tazarov]

Hey @RouvenG, this seems like a sensible request. I will have a look at how this can be implemented, unless you already have an idea, if so feel free to create a PR

[RouvenG]

Hey @tazarov, I have an implementation which I am using for myself ATM, I can create a PR for it, but I need some input from the maintainers.

Do you prefer to introduce the feature as new class or extend/replace one of the existing classes?

Suggestion

To allow authentication through the 'normal' flow a new dependency is needed (Vertex AI SDK).

Currently the classes GoogleVertexEmbeddingFunction, GoogleGenerativeAiEmbeddingFunction are already two different ways to interface the GCP language models.

• straight through a call to the REST API (GoogleVertexEmbeddingFunction)
• through the generativeai python package GoogleGenerativeAiEmbeddingFunction

I suggest to replace the inner working of GoogleVertexEmbeddingFunction by using the Python SDK as suggested by Google

[tazarov]

@RouvenG, Chroma has three EFs - GoogleGenerativeAiEmbeddingFunction (google-generativeai), GooglePalmEmbeddingFunction (google-generativeai) and GoogleVertexEmbeddingFunction (vertexai) we rely on google-generativeai and vertexai Python SDK packages.

Unfortunately, for regions that don't have generativeai-language service using the generativeai SDK is a bit tricky.

With google-generativeai the approach I've found to be generally working well is to create service account and use its key.

Here's the process:

export $PROJECT_ID="my-project-id"
gcloud config set project $PROJECT_ID
gcloud services enable generativelanguage.googleapis.com
gcloud iam service-accounts create genai-sa --display-name="GenAI Service Account"
gcloud projects add-iam-policy-binding $PROJECT_ID --member="serviceAccount:genai-sa@$PROJECT_ID.iam.gserviceaccount.com" --role="roles/aiplatform.user"
gcloud iam service-accounts keys create genai-sa-key.json --iam-account=genai-sa@$PROJECT_ID.iam.gserviceaccount.com
gcloud auth activate-service-account genai-sa@$PROJECT_ID.iam.gserviceaccount.com
gcloud auth activate-service-account genai-sa@$PROJECT_ID.iam.gserviceaccount.com --key-file genai-sa-key.json

Then using the generated key can be done like so:

import google.generativeai as genai
from google.oauth2 import service_account
credentials = service_account.Credentials.from_service_account_file('./genai-sa-key.json')
genai.configure(credentials=credentials)
e  = genai.embed_content(model="models/text-embedding-004",content="text")
print(e)

The alternative approach which would use ADC credentials is to use vertexai package:

Then you'll need to just enable quotas on your project:

gcloud auth application-default set-quota-project $PROJECTID
gcloud config set billing/quota_project $PROJECTID

then use the vertexai as follows:

from vertexai.language_models import TextEmbeddingInput, TextEmbeddingModel
model = TextEmbeddingModel.from_pretrained("text-embedding-004")
inputs = [TextEmbeddingInput(text, "RETRIEVAL_DOCUMENT") for text in ["Hello world","Chroma is awesome"]]
embeddings = model.get_embeddings(inputs)
print(embeddings)

VertexAI supports all models that the three EFs that we support.

In conclusion all three EFs should support local credentials, however for vertexai seems easier to use while offering all the capabilities (aka models) that the other two have. Google APIs and packages are a bit of a mess to be honest.

If you'd like share your suggested approach here or raise a PR directly.

[RouvenG]

@tazarov, I will open a PR in the next days