GoogleContainerTools/skaffold · error

retrieving gcloud access token

Error message

retrieving gcloud access token: %w

What it means

activeUserCredentialsOnce resolves user credentials once (sync.Once). If activeUserCredentials fails (gcloud token errors 375/376), it logs the problem, falls back to Application Default Credentials, and stores this wrapped error in credsErr. Callers receive the ADC result or this error.

Solutions

1. Fix the wrapped root cause: run `gcloud auth login` or `gcloud auth application-default login`.
2. Set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account key so ADC succeeds.
3. Ensure the workload uses a metadata server (GCE/GKE/Cloud Run) so ADC works without gcloud.
4. Check both the log line 'unable to retrieve gcloud access token' and the inner error for the real fix.

Example fix

// before (no creds anywhere)
// after (CI)
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json

// Pre-flight: can ADC resolve at all?
if _, err := google.FindDefaultCredentials(ctx); err != nil {
    return fmt.Errorf("no gcloud user credentials and no ADC: %w", err)
}

creds, credsErr := activeUserCredentials()
if credsErr != nil {
    log.Warnf("falling back to environment-provided credentials: %v", credsErr)
    creds, credsErr = google.FindDefaultCredentials(ctx)
    if credsErr != nil {
        return fmt.Errorf("no usable GCP credentials: %w", credsErr)
    }
}

When it happens

Trigger: Any call path that requests the active user's credentials when gcloud token retrieval failed — the error you actually observe is this wrapper around the 'failed to get access token'/'unmarshal' cause.

Common situations: No gcloud login AND no ADC available; CI environments with neither service-account keys nor gcloud auth; the fallback to application default credentials also failing.

Related errors

• error getting google authenticator
• failed to get access token
• error creating GCS Client
• failed to create repository manager client
• failed to get repository read access token for repo

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/e3b3a8a19072c68f. Report an issue: GitHub.

Appendix: source

Thrown at pkg/skaffold/gcp/auth.go:93

	cmd.Stdout = &body
	err := util.RunCmd(context.TODO(), cmd)
	if err != nil {
		return nil, fmt.Errorf("failed to get access token %v", err)
	}
	var t token
	if err := json.Unmarshal(body.Bytes(), &t); err != nil {
		return nil, fmt.Errorf("failed to unmarshal gcloud command result into access token %v", err)
	}
	return &oauth2.Token{AccessToken: t.Token}, nil
}

func activeUserCredentialsOnce() (*google.Credentials, error) {
	credsOnce.Do(func() {
		c, err := activeUserCredentials()
		if err != nil {
			log.Entry(context.TODO()).Infof("unable to retrieve gcloud access token: %v", err)
			log.Entry(context.TODO()).Info("falling back to application default credentials")
			credsErr = fmt.Errorf("retrieving gcloud access token: %w", err)
			return
		}
		creds = c
	})

	return creds, credsErr
}

func activeUserCredentials() (*google.Credentials, error) {
	var ts tokenSource
	t, err := ts.Token()
	if err != nil {
		return nil, err
	}
	c := &google.Credentials{TokenSource: oauth2.ReuseTokenSource(t, ts)}
	return c, nil
}

View on GitHub (pinned to a1189de023)