apache/druid · error · GceServiceException

Not using a service account

Error message

Not using a service account

What it means

Guard in GceAutoScaler.createComputeServiceImpl: GoogleCredential.getApplicationDefault did not yield a service-account credential (or the credential requires scoping that cannot be satisfied), so the autoscaler cannot authenticate to the GCE API. This typically means the host has no service-account key configured (no GOOGLE_APPLICATION_CREDENTIALS, no metadata-server credential).

Solutions

1. Set GOOGLE_APPLICATION_CREDENTIALS to a service-account JSON key file, or run on a GCE instance with a service account attached.
2. Grant the service account compute permissions (compute instance admin or similar) and enable the Compute Engine API.
3. If using user credentials locally, run `gcloud auth application-default login` so application-default credentials resolve.

When it happens

Trigger: Thrown at extensions-contrib/gce-extensions/src/main/java/org/apache/druid/indexing/overlord/autoscaling/gce/GceAutoScaler.java:133 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/2fee0cddd4e3b305. Report an issue: GitHub.

Appendix: source

Thrown at extensions-contrib/gce-extensions/src/main/java/org/apache/druid/indexing/overlord/autoscaling/gce/GceAutoScaler.java:133

  @Nullable
  Compute createComputeServiceImpl()
      throws IOException, GeneralSecurityException, GceServiceException
  {
    HttpTransport httpTransport = GoogleNetHttpTransport.newTrustedTransport();
    JsonFactory jsonFactory = JacksonFactory.getDefaultInstance();
    GoogleCredential credential = GoogleCredential.getApplicationDefault(
        httpTransport,
        jsonFactory
    );
    if (credential.createScopedRequired()) {
      List<String> scopes = new ArrayList<>();
      scopes.add(ComputeScopes.CLOUD_PLATFORM);
      scopes.add(ComputeScopes.COMPUTE);
      credential = credential.createScoped(scopes);
    }

    if (credential.getClientAuthentication() != null) {
      throw new GceServiceException("Not using a service account");
    }

    return new Compute.Builder(httpTransport, jsonFactory, credential)
        .setApplicationName("DruidAutoscaler")
        .build();
  }

  private Compute createComputeService()
      throws IOException, GeneralSecurityException, InterruptedException, GceServiceException
  {
    final int maxRetries = 5;

    int retries = 0;
    // This retry loop is here to catch the cases in which the underlying call to
    // Compute.Builder(...).build() returns null, case that has been experienced
    // sporadically at start time
    while (cachedComputeService == null && retries < maxRetries) {
      if (retries > 0) {

View on GitHub (pinned to 9b90983fd2)