[shunping]

Part of #40569

Summary

The Go SDK's GCS and Dataflow clients default to *.googleapis.com endpoints, causing failures in non-default universes like Trusted Partner Cloud (TPC) due to universe-mismatch errors or hardcoded URLs.

Following the Python fix (#40674), this PR adds non-default universe support and introduces a --gcs_endpoint override (aligning with Java's --gcsEndpoint and the existing --dataflow_endpoint).

Changes

• gcpopts:
  • Added --gcs_endpoint flag and GetGcsEndpoint() (falls back to pipeline options on workers).
  • Added cached GetUniverseDomain(ctx) reading GOOGLE_CLOUD_UNIVERSE_DOMAIN or default credentials.
• gcsx: Configured NewClient and NewUnauthenticatedClient with --gcs_endpoint and universe domain options.
• dataflowlib: Migrated deprecated df.New to df.NewService, passing endpoint and universe domain options.
• dataflow runner: Updated bucket checks to use gcsx.NewClient for consistent endpoint and universe handling.

Behavior changes

• Dataflow client credentials now come from the newer Google auth library (through df.NewService) instead of oauth2/google. A mismatch between the client's and the credentials' universe now fails with a clear error instead of a confusing server-side failure.
• A --dataflow_endpoint value containing :// is used as-is, as before. A bare host[:port] is now combined with the default endpoint. Previously it was set as BasePath directly and produced an invalid URL.
• Nothing changes in the default universe (googleapis.com) when no flags or env vars are set.

Usage in TPC

Either rely on the universe domain from the credentials or the env var:

export GOOGLE_CLOUD_UNIVERSE_DOMAIN=<universe-domain>

or set the endpoints explicitly:

--dataflow_endpoint=https://dataflow.<universe-domain>/
--gcs_endpoint=https://storage.<universe-domain>/storage/v1/

[codecov]

Codecov Report

❌ Patch coverage is 78.94737% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 28.89%. Comparing base (76f6e6d) to head (acbfd09).
⚠️ Report is 249 commits behind head on master.

Files with missing lines	Patch %	Lines
sdks/go/pkg/beam/util/gcsx/gcs.go	50.00%	6 Missing ⚠️
sdks/go/pkg/beam/options/gcpopts/options.go	90.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@              Coverage Diff              @@
##             master   #40686       +/-   ##
=============================================
- Coverage     56.16%   28.89%   -27.28%     
=============================================
  Files          1124      381      -743     
  Lines        178336    71176   -107160     
  Branches       1489        0     -1489     
=============================================
- Hits         100170    20564    -79606     
+ Misses        75645    48756    -26889     
+ Partials       2521     1856      -665     

Flag	Coverage Δ
go	28.89% <78.94%> (-0.25%)	⬇️
java	?
python	?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

📋 Review Summary

This PR adds support for non-default Google Cloud universes (such as Trusted Partner Cloud) in the Go SDK's GCS and Dataflow clients by propagating the universe domain from GOOGLE_CLOUD_UNIVERSE_DOMAIN or default credentials via option.WithUniverseDomain, and introduces a --gcs_endpoint flag/pipeline option override. The implementation is clean, well-structured, and includes appropriate caching and unit tests.

🔍 General Feedback

• The caching strategy in gcpopts.GetUniverseDomain properly avoids caching credential lookup failures while preventing repeated metadata server calls.
• Migrating dataflowlib.NewClient from deprecated df.New to df.NewService with option.ClientOptions and switching the Dataflow runner's soft-delete check to gcsx.NewClient ensures consistent endpoint and universe handling across the SDK.

---

💡 Tip: Comment /gemini review on this pull request to trigger a new Gemini code review.

[github-actions]

Assigning reviewers:

R: @lostluck for label go.
Backup reviewer: jrmccluskey (if the main reviewer is unresponsive, you can escalate to them by tagging their username)

Note: If you would like to opt out of this review, comment assign to next reviewer.

Available commands:

• stop reviewer notifications - opt out of the automated review tooling
• remind me after tests pass - tag the comment author after tests pass
• waiting on author - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)

The PR bot will only process comments in the main thread (not review comments).