GoogleContainerTools/skaffold · critical

error creating GCS Client: %w

Error message

error creating GCS Client: %w

What it means

getBucketManager wraps storage.NewClient failures when constructing the Google Cloud Storage client. It means no GCS client could be created, almost always because Application Default Credentials could not be found or the environment is misconfigured. Without this client no list/download/upload can proceed.

Source

Thrown at pkg/skaffold/gcs/client/native.go:287

	q := &storage.Query{Prefix: urinfo.ObjPath + "/"}
	// GCS doesn't support empty "folders".
	matches, err := bucket.ListObjects(ctx, q)
	if err != nil {
		return false, err
	}

	if len(matches) > 0 {
		return true, nil
	}

	return false, nil
}

func getBucketManager(ctx context.Context, bucketName string) (bucketHandler, error) {
	sc, err := storage.NewClient(ctx)
	if err != nil {
		return nil, fmt.Errorf("error creating GCS Client: %w", err)
	}

	return nativeBucketHandler{
		storageClient: sc,
		bucket:        sc.Bucket(bucketName),
	}, nil
}

// nativeBucketHandler implements a handler using the Cloud client libraries.
type nativeBucketHandler struct {
	storageClient *storage.Client
	bucket        *storage.BucketHandle
}

func (nb nativeBucketHandler) ListObjects(ctx context.Context, q *storage.Query) ([]string, error) {
	matches := []string{}
	it := nb.bucket.Objects(ctx, q)

View on GitHub (pinned to a1189de023)

Solutions

1. Run `gcloud auth application-default login` for local development
2. Set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key file
3. In GKE/GCE/Cloud Build, attach the proper service account or workload identity instead of file creds
4. Verify the wrapped error (default credentials / metadata / network) and fix connectivity to oauth2.googleapis.com

Example fix

// before
export GOOGLE_APPLICATION_CREDENTIALS=/old/deleted-key.json
// after
export GOOGLE_APPLICATION_CREDENTIALS=$HOME/keys/sa.json  # valid key file
# or, locally:
gcloud auth application-default login

func checkGCSCreds() error {
	if p := os.Getenv("GOOGLE_APPLICATION_CREDENTIALS"); p != "" {
		if _, err := os.Stat(p); err != nil {
			return fmt.Errorf("credentials file missing: %w", err)
		}
		return nil
	}
	if _, err := google.FindDefaultCredentials(context.Background(), storage.ScopeReadOnly); err != nil {
		return fmt.Errorf("no application default credentials: %w", err)
	}
	return nil
}
// run once at startup

if err := n.UploadFile(ctx, src, dst); err != nil {
	var ue *googleapi.Error
	if errors.As(err, &ue) {
		log.Fatalf("GCS API error: %v", ue)
	}
	if strings.Contains(err.Error(), "creating GCS Client") {
		log.Fatalf("credential problem, run 'gcloud auth application-default login': %v", err)
	}
	return err
}

When it happens

Trigger: Any call path (DownloadRecursive, UploadFile) on a machine with no credentials: GOOGLE_APPLICATION_CREDENTIALS unset and no gcloud ADC, metadata server unreachable (not on GCP), or an invalid credentials file path.

Common situations: Running skaffold locally without `gcloud auth application-default login`; CI job with GOOGLE_APPLICATION_CREDENTIALS pointing to a deleted/malformed key file; running in Docker without mounting credentials; network proxy blocking googleapis.com token endpoint.

Related errors

• StatusCode_DEPLOY_GET_CLOUD_RUN_CLIENT_ERR
• error getting google authenticator
• retrieving gcloud access token: %w
• failed to cache Google Cloud Storage objects from %q: %w
• no project id found in metrics credentials

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/c6fc66e19e68f612. Report an issue: GitHub.