GoogleContainerTools/skaffold · error

retrieving gcloud access token: %w

Error message

retrieving gcloud access token: %w

What it means

activeUserCredentialsOnce resolves user credentials once (sync.Once). If activeUserCredentials fails (gcloud token errors 375/376), it logs the problem, falls back to Application Default Credentials, and stores this wrapped error in credsErr. Callers receive the ADC result or this error.

Source

Thrown at pkg/skaffold/gcp/auth.go:93

	cmd.Stdout = &body
	err := util.RunCmd(context.TODO(), cmd)
	if err != nil {
		return nil, fmt.Errorf("failed to get access token %v", err)
	}
	var t token
	if err := json.Unmarshal(body.Bytes(), &t); err != nil {
		return nil, fmt.Errorf("failed to unmarshal gcloud command result into access token %v", err)
	}
	return &oauth2.Token{AccessToken: t.Token}, nil
}

func activeUserCredentialsOnce() (*google.Credentials, error) {
	credsOnce.Do(func() {
		c, err := activeUserCredentials()
		if err != nil {
			log.Entry(context.TODO()).Infof("unable to retrieve gcloud access token: %v", err)
			log.Entry(context.TODO()).Info("falling back to application default credentials")
			credsErr = fmt.Errorf("retrieving gcloud access token: %w", err)
			return
		}
		creds = c
	})

	return creds, credsErr
}

func activeUserCredentials() (*google.Credentials, error) {
	var ts tokenSource
	t, err := ts.Token()
	if err != nil {
		return nil, err
	}
	c := &google.Credentials{TokenSource: oauth2.ReuseTokenSource(t, ts)}
	return c, nil
}

View on GitHub (pinned to a1189de023)

Solutions

1. Fix the wrapped root cause: run `gcloud auth login` or `gcloud auth application-default login`.
2. Set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account key so ADC succeeds.
3. Ensure the workload uses a metadata server (GCE/GKE/Cloud Run) so ADC works without gcloud.
4. Check both the log line 'unable to retrieve gcloud access token' and the inner error for the real fix.

Example fix

// before (no creds anywhere)
// after (CI)
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json

// Pre-flight: can ADC resolve at all?
if _, err := google.FindDefaultCredentials(ctx); err != nil {
    return fmt.Errorf("no gcloud user credentials and no ADC: %w", err)
}

creds, credsErr := activeUserCredentials()
if credsErr != nil {
    log.Warnf("falling back to environment-provided credentials: %v", credsErr)
    creds, credsErr = google.FindDefaultCredentials(ctx)
    if credsErr != nil {
        return fmt.Errorf("no usable GCP credentials: %w", credsErr)
    }
}

When it happens

Trigger: Any call path that requests the active user's credentials when gcloud token retrieval failed — the error you actually observe is this wrapper around the 'failed to get access token'/'unmarshal' cause.

Common situations: No gcloud login AND no ADC available; CI environments with neither service-account keys nor gcloud auth; the fallback to application default credentials also failing.

Related errors

• error getting google authenticator
• failed to get access token %v
• StatusCode_DEPLOY_GET_CLOUD_RUN_CLIENT_ERR
• getting auth config: %w
• failed to create repository manager client: %w

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/e3b3a8a19072c68f. Report an issue: GitHub.