GoogleContainerTools/skaffold · error

error getting google authenticator

Error message

error getting google authenticator

What it means

Returned when google.NewEnvAuthenticator yields the Anonymous authenticator, meaning no Google Application Default Credentials are available. loadCredentials therefore cannot obtain GCR credentials for the registry.

Source

Thrown at pkg/skaffold/docker/auth.go:141

	if isGoogleRegistry(registry) {
		authCfg, err := h.getGoogleAuthConfig(ctx, registry)
		if err == nil {
			return authCfg, nil
		}
	}

	return cliTypesToAuthConfigType(auth), nil
}

func (h credsHelper) getGoogleAuthConfig(ctx context.Context, registry string) (types.AuthConfig, error) {
	auth, err := google.NewEnvAuthenticator(ctx)
	if err != nil {
		return types.AuthConfig{}, err
	}

	if auth == authn.Anonymous {
		return types.AuthConfig{}, fmt.Errorf("error getting google authenticator")
	}

	cfg, err := auth.Authorization()
	if err != nil {
		return types.AuthConfig{}, err
	}

	bCfg, err := cfg.MarshalJSON()
	if err != nil {
		return types.AuthConfig{}, err
	}

	var authCfg types.AuthConfig
	err = json.Unmarshal(bCfg, &authCfg)
	if err != nil {
		return types.AuthConfig{}, err
	}

View on GitHub (pinned to a1189de023)

Solutions

1. Run `gcloud auth application-default login`
2. Set GOOGLE_APPLICATION_CREDENTIALS to a service account JSON key
3. Run inside GCE/GKE/Cloud Build where the metadata server provides ADC
4. Use a credsStore/helper in the docker config instead of GCR env auth

Example fix

// before (shell)
skaffold run   # no ADC
// after
gcloud auth application-default login
export GOOGLE_APPLICATION_CREDENTIALS=$HOME/sa-key.json
skaffold run

if os.Getenv("GOOGLE_APPLICATION_CREDENTIALS") == "" && os.Getenv("GOOGLE_CLOUD_PROJECT") == "" {
  return fmt.Errorf("no GCP ADC configured; run gcloud auth application-default login")
}

ac, err := getGoogleAuthConfig(ctx)
if errors.Is(err, errNoGoogleAuth) || strings.Contains(err.Error(), "error getting google authenticator") {
  return fmt.Errorf("GCP auth missing: run 'gcloud auth application-default login'")
}

When it happens

Trigger: getGoogleAuthConfig runs and NewEnvAuthenticator returns authn.Anonymous because GOOGLE_APPLICATION_CREDENTIALS is unset and no metadata server / gcloud ADC credentials exist.

Common situations: Pulling/pushing to gcr.io or *.pkg.dev from a laptop without gcloud auth or a service account key; running outside GCP without GOOGLE_APPLICATION_CREDENTIALS; token-scopes or Cloud SDK misconfiguration.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• retrieving gcloud access token: %w
• StatusCode_DEPLOY_GET_CLOUD_RUN_CLIENT_ERR
• getting auth config: %w
• failed to create repository manager client: %w
• failed to get repository read access token for repo %v: %w

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/3f9745340b35a498. Report an issue: GitHub.