samples for external-account: should acquire ADC for file-sourced creds failed #1328

Activity

1. flaky-bot

   added

   flakybot: issueAn issue filed by the Flaky Bot. Should not be added manually.An issue filed by the Flaky Bot. Should not be added manually.

   priority: p1Important issue which blocks shipping the next release. Will be fixed prior to next release.Important issue which blocks shipping the next release. Will be fixed prior to next release.

   type: bugError or flaw in code with unintended results or allowing sub-optimal usage patterns.Error or flaw in code with unintended results or allowing sub-optimal usage patterns.

   on Dec 3, 2021
2. product-auto-label

   added

   samplesIssues that are directly related to samples.Issues that are directly related to samples.

   on Dec 3, 2021
3. flaky-bot commented on Dec 3, 2021

   

   flaky-botBot

   on Dec 3, 2021

   Author

   More actions

   commit: 0552915
   buildURL: Build Status, Sponge
   status: failed

   Test output

   
   

   expected 'GaxiosError: The caller does not have permission\n    at Gaxios._request (/workspace/node_modules/gaxios/build/src/gaxios.js:129:23)\n    at processTicksAndRejections (internal/process/task_queues.js:97:5)\n    at async IdentityPoolClient.getImpersonatedAccessToken (/workspace/build/src/auth/baseexternalclient.js:369:26)\n    at async IdentityPoolClient.refreshAccessTokenAsync (/workspace/build/src/auth/baseexternalclient.js:298:38)\n    at async IdentityPoolClient.getAccessToken (/workspace/build/src/auth/baseexternalclient.js:149:13)\n    at async IdentityPoolClient.getRequestHeaders (/workspace/build/src/auth/baseexternalclient.js:166:37)\n    at async IdentityPoolClient.requestAsync (/workspace/build/src/auth/baseexternalclient.js:226:36)\n    at async main (/workspace/samples/adc.js:31:15) {\n  response: {\n    config: {\n      url: \'https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/[email protected]:generateAccessToken\',\n      method: \'POST\',\n      headers: [Object],\n      data: [Object],\n      responseType: \'json\',\n      paramsSerializer: [Function: paramsSerializer],\n      body: \'{"scope":["https://www.googleapis.com/auth/cloud-platform"]}\',\n      validateStatus: [Function: validateStatus]\n    },\n    data: { error: [Object] },\n    headers: {\n      \'cache-control\': \'private\',\n      connection: \'close\',\n      \'content-encoding\': \'gzip\',\n      \'content-type\': \'application/json; charset=UTF-8\',\n      date: \'Fri, 03 Dec 2021 22:31:57 GMT\',\n      server: \'scaffolding on HTTPServer2\',\n      \'transfer-encoding\': \'chunked\',\n      vary: \'Origin, X-Origin, Referer\',\n      \'x-content-type-options\': \'nosniff\',\n      \'x-frame-options\': \'SAMEORIGIN\',\n      \'x-xss-protection\': \'0\'\n    },\n    status: 403,\n    statusText: \'Forbidden\',\n    request: {\n      responseURL: \'https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/[email protected]:generateAccessToken\'\n    }\n  },\n  config: {\n    url: \'https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/[email protected]:generateAccessToken\',\n    method: \'POST\',\n    headers: {\n      \'Content-Type\': \'application/json\',\n      Authorization: \'Bearer ya29.d.KuIDGwgBi61NFjHEo6AF2JFoSJ8d92Am5Cra74uXgI1048hWPDRNaGfqt5p0t9L9S3yLE0MUscxaa-I52-hcl9F2RngQ1ZdvzdLTkzH9Azm4PBCqI9PXb4PLa1qMFGZJU5ntsKwkbgInLE0T3bPUfHg02YzNt-21TJNY8rNJOIZvdQJtUN6I30H7ztwB34zXHuS54ARBN_QdoNArnEvrDmKsoZ5UCAvcY4BnCbKzrw-rdM1GQpb_ndQND_LEMmt0Ti6UAX4fcdzNHEOa2e_-LV9Hrm5dqxsY9gY2osDlWvxHrK5fFRGgucOMlvBMBNILr69CtHy0C2v4xxtaEZFTwtxl4iB3uzlo4HGAzpElkXx-lr2xpNyrafhuoqntlodhF8MteZI2f4Q8J85eGsDDjZU2MGPH0UoQzQArZKVx3_p7thrNmwAPJ1CIGpCm4aMp7VDx__4_om8RVUg9gYcTrsF1a95kdP9IuzouYcwShcP-h1Qs5aUIf2iClIRzz7-6cASjWS73QMS3XM_kpoZ-2GDQo09gy3yw-8yxpPWTi7b9HGCcpNdsr522CRqg9UuNrUPHh2WeB85NntDxqEKbbjxeaP1e9irKilHGYn0ehR3ySj36scN5ek9H1db_FFKC8VVMeIA\',\n      \'User-Agent\': \'google-api-nodejs-client/7.10.3\',\n      \'x-goog-api-client\': \'gl-node/12.22.7 auth/7.10.3\',\n      Accept: \'application/json\'\n    },\n    data: { scope: [Array] },\n    responseType: \'json\',\n    paramsSerializer: [Function: paramsSerializer],\n    body: \'{"scope":["https://www.googleapis.com/auth/cloud-platform"]}\',\n    validateStatus: [Function: validateStatus]\n  },\n  code: 403,\n  errors: [\n    {\n      message: \'The caller does not have permission\',\n      domain: \'global\',\n      reason: \'forbidden\'\n    }\n  ]\n}\n' to match /DNS Info:/
   AssertionError: expected 'GaxiosError: The caller does not have permission\n    at Gaxios._request (/workspace/node_modules/gaxios/build/src/gaxios.js:129:23)\n    at processTicksAndRejections (internal/process/task_queues.js:97:5)\n    at async IdentityPoolClient.getImpersonatedAccessToken (/workspace/build/src/auth/baseexternalclient.js:369:26)\n    at async IdentityPoolClient.refreshAccessTokenAsync (/workspace/build/src/auth/baseexternalclient.js:298:38)\n    at async IdentityPoolClient.getAccessToken (/workspace/build/src/auth/baseexternalclient.js:149:13)\n    at async IdentityPoolClient.getRequestHeaders (/workspace/build/src/auth/baseexternalclient.js:166:37)\n    at async IdentityPoolClient.requestAsync (/workspace/build/src/auth/baseexternalclient.js:226:36)\n    at async main (/workspace/samples/adc.js:31:15) {\n  response: {\n    config: {\n      url: \'https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/[email protected]:generateAccessToken\',\n      method: \'POST\',\n      headers: [Object],\n      data: [Object],\n      responseType: \'json\',\n      paramsSerializer: [Function: paramsSerializer],\n      body: \'{"scope":["https://www.googleapis.com/auth/cloud-platform"]}\',\n      validateStatus: [Function: validateStatus]\n    },\n    data: { error: [Object] },\n    headers: {\n      \'cache-control\': \'private\',\n      connection: \'close\',\n      \'content-encoding\': \'gzip\',\n      \'content-type\': \'application/json; charset=UTF-8\',\n      date: \'Fri, 03 Dec 2021 22:31:57 GMT\',\n      server: \'scaffolding on HTTPServer2\',\n      \'transfer-encoding\': \'chunked\',\n      vary: \'Origin, X-Origin, Referer\',\n      \'x-content-type-options\': \'nosniff\',\n      \'x-frame-options\': \'SAMEORIGIN\',\n      \'x-xss-protection\': \'0\'\n    },\n    status: 403,\n    statusText: \'Forbidden\',\n    request: {\n      responseURL: \'https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/[email protected]:generateAccessToken\'\n    }\n  },\n  config: {\n    url: \'https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/[email protected]:generateAccessToken\',\n    method: \'POST\',\n    headers: {\n      \'Content-Type\': \'application/json\',\n      Authorization: \'Bearer ya29.d.KuIDGwgBi61NFjHEo6AF2JFoSJ8d92Am5Cra74uXgI1048hWPDRNaGfqt5p0t9L9S3yLE0MUscxaa-I52-hcl9F2RngQ1ZdvzdLTkzH9Azm4PBCqI9PXb4PLa1qMFGZJU5ntsKwkbgInLE0T3bPUfHg02YzNt-21TJNY8rNJOIZvdQJtUN6I30H7ztwB34zXHuS54ARBN_QdoNArnEvrDmKsoZ5UCAvcY4BnCbKzrw-rdM1GQpb_ndQND_LEMmt0Ti6UAX4fcdzNHEOa2e_-LV9Hrm5dqxsY9gY2osDlWvxHrK5fFRGgucOMlvBMBNILr69CtHy0C2v4xxtaEZFTwtxl4iB3uzlo4HGAzpElkXx-lr2xpNyrafhuoqntlodhF8MteZI2f4Q8J85eGsDDjZU2MGPH0UoQzQArZKVx3_p7thrNmwAPJ1CIGpCm4aMp7VDx__4_om8RVUg9gYcTrsF1a95kdP9IuzouYcwShcP-h1Qs5aUIf2iClIRzz7-6cASjWS73QMS3XM_kpoZ-2GDQo09gy3yw-8yxpPWTi7b9HGCcpNdsr522CRqg9UuNrUPHh2WeB85NntDxqEKbbjxeaP1e9irKilHGYn0ehR3ySj36scN5ek9H1db_FFKC8VVMeIA\',\n      \'User-Agent\': \'google-api-nodejs-client/7.10.3\',\n      \'x-goog-api-client\': \'gl-node/12.22.7 auth/7.10.3\',\n      Accept: \'application/json\'\n    },\n    data: { scope: [Array] },\n    responseType: \'json\',\n    paramsSerializer: [Function: paramsSerializer],\n    body: \'{"scope":["https://www.googleapis.com/auth/cloud-platform"]}\',\n    validateStatus: [Function: validateStatus]\n  },\n  code: 403,\n  errors: [\n    {\n      message: \'The caller does not have permission\',\n      domain: \'global\',\n      reason: \'forbidden\'\n    }\n  ]\n}\n' to match /DNS Info:/
       at Context. (test/externalclient.test.js:285:12)
       at processTicksAndRejections (internal/process/task_queues.js:97:5)
4. chingor13

   self-assigned this

   on Dec 6, 2021
5. chingor13 commented on Dec 6, 2021

   

   chingor13

   on Dec 6, 2021

   Contributor

   More actions

   Permissions fix to restore Workload Identity Federation being made internally.
6. chingor13

   closed this as completedon Dec 6, 2021
7. gcf-owl-bot

   added a commit that references this issue on Jan 18, 2022

   build(node): switch back to keystore for publication (#1328)

   ...

   2b479c4
8. gcf-merge-on-green

   added a commit that references this issue on Jan 19, 2022

   build(node): switch back to keystore for publication (#1328) (#1348)

   34ca2a0