GoogleContainerTools/skaffold · error

DEPLOY_GET_CLOUD_RUN_CLIENT_ERR

DEPLOY_GET_CLOUD_RUN_CLIENT_ERR

Error message

unable to create Cloud Run Client

What it means

In `deployToCloudRun`, skaffold constructs a Cloud Run API client with `run.NewService(ctx, cOptions...)`. If client construction fails, the error is wrapped as 'unable to create Cloud Run Client' with code DEPLOY_GET_CLOUD_RUN_CLIENT_ERR. This happens before any manifest is inspected or deployed.

Source

Thrown at pkg/skaffold/deploy/cloudrun/deploy.go:208

	endTrace()
	return nil
}

func (d *Deployer) getMonitor() *Monitor {
	if d.monitor == nil {
		d.monitor = NewMonitor(d.labeller, d.clientOptions, d.statusCheckDeadline, d.tolerateFailures)
	}
	return d.monitor
}
func (d *Deployer) deployToCloudRun(ctx context.Context, out io.Writer, manifest []byte) error {
	cOptions := d.clientOptions
	if d.useGcpOptions {
		cOptions = append(cOptions, option.WithEndpoint(fmt.Sprintf("%s-run.googleapis.com", d.Region)))
		cOptions = append(gcp.ClientOptions(ctx), cOptions...)
	}
	crclient, err := run.NewService(ctx, cOptions...)
	if err != nil {
		return sErrors.NewError(fmt.Errorf("unable to create Cloud Run Client"), &proto.ActionableErr{
			Message: err.Error(),
			ErrCode: proto.StatusCode_DEPLOY_GET_CLOUD_RUN_CLIENT_ERR,
		})
	}
	// figure out which type we have:
	resource := &unstructured.Unstructured{}
	if err = k8syaml.Unmarshal(manifest, resource); err != nil {
		return sErrors.NewError(fmt.Errorf("unable to unmarshal Cloud Run Service config: %w", err), &proto.ActionableErr{
			Message: err.Error(),
			ErrCode: proto.StatusCode_DEPLOY_READ_MANIFEST_ERR,
		})
	}
	var resName *RunResourceName
	switch {
	case resource.GetAPIVersion() == "serving.knative.dev/v1" && resource.GetKind() == "Service":
		resName, err = d.deployService(crclient, manifest, out)
		// the accessor only supports services. Jobs don't run by themselves so port forwarding doesn't make sense.
		if resName != nil {

View on GitHub (pinned to a1189de023)

Solutions

1. Authenticate: run `gcloud auth application-default login` locally, or set `GOOGLE_APPLICATION_CREDENTIALS` to a service-account key in CI
2. Verify network access to googleapis.com and (if using regional endpoints) that the region in skaffold config is valid
3. Run `gcloud auth list` / refresh credentials with `gcloud auth login` if tokens expired
4. Check the `Message` field of the ActionableErr — it carries the underlying error from `run.NewService`

Example fix

# before (CI): skaffold deploy -> unable to create Cloud Run Client
# after:
echo "$GCP_SA_KEY" > key.json
export GOOGLE_APPLICATION_CREDENTIALS=key.json
skaffold deploy --default-repo=gcr.io/my-project

func requireGCPCredentials() error {
	if os.Getenv("GOOGLE_APPLICATION_CREDENTIALS") == "" {
		if _, err := exec.LookPath("gcloud"); err != nil {
			return errors.New("no GOOGLE_APPLICATION_CREDENTIALS and no gcloud: cannot build Cloud Run client")
		}
		// ADC file check
		home, _ := os.UserHomeDir()
		if _, err := os.Stat(filepath.Join(home, ".config", "gcloud", "application_default_credentials.json")); err != nil {
			return errors.New("application-default credentials missing; run 'gcloud auth application-default login'")
		}
	}
	return nil
}

if err := deployToCloudRun(ctx, ...); err != nil {
	var sErr *sErrors.Error
	if errors.As(err, &sErr) && sErr.Status().ErrCode == proto.StatusCode_DEPLOY_GET_CLOUD_RUN_CLIENT_ERR {
		return fmt.Errorf("Cloud Run client setup failed (%s): authenticate with 'gcloud auth application-default login'", sErr.Status().Message)
	}
	return err
}

When it happens

Trigger: `run.NewService` fails — typically no Google credentials/ADC available in the environment, invalid endpoint option when `useGcpOptions` is set (custom region endpoint), failure building `gcp.ClientOptions(ctx)` (e.g. missing gcloud or token source), or a network error fetching the service discovery document.

Common situations: Running `skaffold deploy` in CI without `GOOGLE_APPLICATION_CREDENTIALS` or `gcloud auth application-default login`; wrong `--default-region` producing a bad regional endpoint; offline machine; stale gcloud credentials requiring re-login.

Related errors

• bucket name is empty
• skaffold apply called with both Cloud Run and Kubernetes dep
• INIT_CLOUD_RUN_LOCATION_ERROR
• PORT_FORWARD_RUN_GCLOUD_NOT_FOUND
• PORT_FORWARD_RUN_PROXY_START_ERROR

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/12911136711a0c5a. Report an issue: GitHub.