When running in GCE, it should respect GOOGLE_APPLICATION_CREDENTIALS first

[saturnism]

When running inside of GCE, it seems to be picking up machine credentials. I have credentials set via the env var GOOGLE_APPLICATION_CREDENTIALS

root@6a740ead3d2c:/# export
declare -x GOOGLE_APPLICATION_CREDENTIALS="/var/secrets/wise-coyote-827.json"

root@6a740ead3d2c:/# ls -lh $GOOGLE_APPLICATION_CREDENTIALS
-rw------- 1 1001 1001 2.3K Apr  6 17:47 /var/secrets/wise-coyote-827.json

root@6a740ead3d2c:/# cat $GOOGLE_APPLICATION_CREDENTIALS
{
  "type": "service_account",
...

When I start my app, it complains:

Apr 06, 2016 6:08:29 PM com.google.datastore.v1beta3.client.DatastoreFactory makeClient
INFO: Not using any credentials
18:08:29.859 [main] ERROR c.s.apollo.httpservice.HttpService - Uncaught exception on thread Thread[main,5,main], exiting
com.spotify.apollo.httpservice.LoadingException: Something went wrong
    at com.spotify.apollo.httpservice.HttpService.failure(HttpService.java:149) ~[apollo-http-service-1.0.4.jar:1.0.4]
    at com.spotify.apollo.httpservice.HttpService.boot(HttpService.java:142) ~[apollo-http-service-1.0.4.jar:1.0.4]
    at com.spotify.apollo.httpservice.HttpService.boot(HttpService.java:90) ~[apollo-http-service-1.0.4.jar:1.0.4]
    at com.spotify.apollo.httpservice.HttpService.boot(HttpService.java:80) ~[apollo-http-service-1.0.4.jar:1.0.4]
    at com.spotify.apollo.httpservice.HttpService.boot(HttpService.java:71) ~[apollo-http-service-1.0.4.jar:1.0.4]
    at com.example.apollo.books.BooksService.main(BooksService.java:25) ~[books-service.jar:na]
Caused by: com.google.gcloud.datastore.DatastoreException: Not authorized.
    at com.google.gcloud.datastore.spi.DefaultDatastoreRpc.translate(DefaultDatastoreRpc.java:102) ~[gcloud-java-datastore-0.1.7.jar:0.1.7]
    at com.google.gcloud.datastore.spi.DefaultDatastoreRpc.lookup(DefaultDatastoreRpc.java:139) ~[gcloud-java-datastore-0.1.7.jar:0.1.7]
    at com.google.gcloud.datastore.DatastoreOptions.normalize(DatastoreOptions.java:116) ~[gcloud-java-datastore-0.1.7.jar:0.1.7]
    at com.google.gcloud.datastore.DatastoreOptions.access$300(DatastoreOptions.java:34) ~[gcloud-java-datastore-0.1.7.jar:0.1.7]
    at com.google.gcloud.datastore.DatastoreOptions$Builder.build(DatastoreOptions.java:81) ~[gcloud-java-datastore-0.1.7.jar:0.1.7]
    at com.google.gcloud.datastore.DatastoreOptions.defaultInstance(DatastoreOptions.java:167) ~[gcloud-java-datastore-0.1.7.jar:0.1.7]
    at com.example.apollo.books.BooksService.init(BooksService.java:29) ~[books-service.jar:na]
    at com.spotify.apollo.environment.ApolloEnvironmentModule$ApolloEnvironmentImpl.initialize(ApolloEnvironmentModule.java:155) ~[apollo-environment-1.0.4.jar:1.0.4]
    at com.spotify.apollo.httpservice.HttpServiceModule.lambda$bindAppInit$1(HttpServiceModule.java:52) ~[apollo-http-service-1.0.4.jar:1.0.4]
    at com.spotify.apollo.httpservice.HttpServiceModule.requestHandler(HttpServiceModule.java:58) ~[apollo-http-service-1.0.4.jar:1.0.4]
    at com.spotify.apollo.httpservice.HttpService.boot(HttpService.java:116) ~[apollo-http-service-1.0.4.jar:1.0.4]
    ... 4 common frames omitted
Caused by: com.google.datastore.v1beta3.client.DatastoreException: Not authorized.
    at com.google.datastore.v1beta3.client.RemoteRpc.makeException(RemoteRpc.java:126) ~[datastore-v1beta3-proto-client-1.0.0-beta.jar:na]
    at com.google.datastore.v1beta3.client.RemoteRpc.makeException(RemoteRpc.java:169) ~[datastore-v1beta3-proto-client-1.0.0-beta.jar:na]
    at com.google.datastore.v1beta3.client.RemoteRpc.call(RemoteRpc.java:89) ~[datastore-v1beta3-proto-client-1.0.0-beta.jar:na]
    at com.google.datastore.v1beta3.client.Datastore.lookup(Datastore.java:92) ~[datastore-v1beta3-proto-client-1.0.0-beta.jar:na]
    at com.google.gcloud.datastore.spi.DefaultDatastoreRpc.lookup(DefaultDatastoreRpc.java:137) ~[gcloud-java-datastore-0.1.7.jar:0.1.7]
    ... 13 common frames omitted

[mziccard]

Might be a dumb question: I see the variable is there for root, are you also starting your app as root? If not, is the variable there for the user that starts the app?

[aozarov]

Also, I wonder if it is using the expected projectId.

@mziccard recently fixed #827 and I think the change to capture the project id from the credentials files,
d17e325, was only merged after 0.1.7 was released.

[saturnism]

Arie - I feel what you mentioned is probably it. I was able to 100% sure
using the Json file but it still complained about being unauthorized. I'll
try setting the project id (in env var?)

Thanks!
On Thu, Apr 7, 2016 at 4:30 AM Arie [email protected] wrote:

Also, I wonder if it is using the expected projectId.

@mziccard https://github.com/mziccard recently fixed #827
#827 and I
think the change to capture the project id from the credentials files,
d17e325
d17e325,
was only merged after 0.1.7 was released.

—
You are receiving this because you authored the thread.
Reply to this email directly or view it on GitHub
#867 (comment)

[mziccard]

@saturnism If you are using version 0.1.7 gcloud-java will set the project id from the "project_id" field in the JSON credentials pointed by GOOGLE_APPLICATION_CREDENTIALS. For future use: please notice that the "project_id" field has been recently introduced so your JSON credentials might not have it (depending on how recently you generated them).

Setting the env var GCLOUD_PROJECT will do it in any case.

[mziccard]

Let me correct my last comment: I see you are actually using 0.1.7 and @aozarov is right, extracting project id from the JSON credentials pointed by GOOGLE_APPLICATION_CREDENTIALS IS NOT part of 1.7.0. This feature will be available in the next release.

[mziccard]

gcloud-java 0.2.0 is out. This version is capable of extracting project's id from GOOGLE_APPLICATION_CREDENTIALS (if set). Notice that we renamed both our groupId and our base package to com.google.cloud. Maven dependency is now:

<dependency>
  <groupId>com.google.cloud</groupId>
  <artifactId>gcloud-java</artifactId>
  <version>0.2.0</version>
</dependency>

Can this issue be closed?

[saturnism]

thnx!