# Configuration (/connectors/gcp-pub-sub/concepts/configuration)



The Pub/Sub connector is configured server-side under the `Connectors.Gcp` block of the KubeMQ
server config, exposed as **thirteen `CONNECTORS_GCP_*` environment variables**. The connector
is **opt-in (disabled by default)** — a stock kubemq-server does not bind gRPC port 8085 until
you enable it.

<Callout type="info">
  The only thing **clients** configure is the emulator host via the standard
  `PUBSUB_EMULATOR_HOST` environment variable (default `localhost:8085`) plus any
  `PUBSUB_PROJECT_ID`. Everything below is broker-side server configuration.
</Callout>

## Enable the connector [#enable-the-connector]

Enable the connector with its enable variable:

<RunKubeMQ ports="[8085, 50000]" env="{ CONNECTORS_GCP_ENABLE: 'true' }" />

To turn it **off** again, set `CONNECTORS_GCP_ENABLE=false`.

<Callout type="info">
  Setting `CONNECTORS_GCP_ENABLE=false` closes port 8085 and skips the connector entirely — a
  config-only rollback with no data migration. The enable variable carries the underscore in its
  prefix (`CONNECTORS_GCP_*`), and the port **must differ** from the server's gRPC/REST/HTTP and
  AWS-connector ports — a collision aborts startup.
</Callout>

## Security posture [#security-posture]

<Callout type="warn">
  **The connector runs in emulator mode: no authentication, no TLS, insecure gRPC — by design.**
  There is no Google OAuth2/JWT validation, no IAM enforcement (the IAM RPCs are permissive
  stubs), and no per-connector TLS option. &#x2A;*Do not expose port 8085 to untrusted networks.** TLS
  is provided by the server-wide `Security` block, not by a Pub/Sub-specific setting. DoS guards
  stay active regardless — the message-size cap, `MaxInflightPerSubscription`,
  `MaxConcurrentPolls`, `MaxSeekReplay`, and push backoff. See
  [Auth & security](/connectors/reference/auth-and-security) and
  [Connectivity & emulator mode](/connectors/gcp-pub-sub/how-to/connectivity-and-emulator-mode).
</Callout>

## Configuring the connector [#configuring-the-connector]

The same settings can be supplied through a TOML config file, environment variables, or
`docker run` flags. Every environment variable uses the `CONNECTORS_GCP_` prefix (with the
underscore between `CONNECTORS` and `GCP`). For the full field-by-field table and copy-paste
TOML/env/Docker examples, see
[Configuration reference](../reference/configuration).

## Related [#related]

<Cards>
  <Card title="Getting Started" href="/connectors/gcp-pub-sub/tutorials/getting-started" description="Point your Pub/Sub SDK at port 8085 and run a publish-and-pull round-trip end-to-end in minutes." />

  <Card title="Architecture" href="/connectors/gcp-pub-sub/concepts/architecture" description="The gRPC emulator listener, the 38-RPC surface, and the publish-once-then-fan-out model." />

  <Card title="Connectivity & emulator mode" href="/connectors/gcp-pub-sub/how-to/connectivity-and-emulator-mode" description="The PUBSUB_EMULATOR_HOST drop-in, per-language emulator opt-in, and the insecure-gRPC posture." />

  <Card title="Configuration reference" href="/connectors/gcp-pub-sub/reference/configuration" description="The thirteen CONNECTORS_GCP_* fields, their defaults, and TOML/env/Docker examples." />
</Cards>