{"record":{"id":"12911136711a0c5a","repo":"GoogleContainerTools/skaffold","slug":"deploy-get-cloud-run-client-err","errorCode":"DEPLOY_GET_CLOUD_RUN_CLIENT_ERR","errorMessage":"unable to create Cloud Run Client","messagePattern":"unable to create Cloud Run Client","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/skaffold/deploy/cloudrun/deploy.go","lineNumber":208,"sourceCode":"\tendTrace()\n\treturn nil\n}\n\nfunc (d *Deployer) getMonitor() *Monitor {\n\tif d.monitor == nil {\n\t\td.monitor = NewMonitor(d.labeller, d.clientOptions, d.statusCheckDeadline, d.tolerateFailures)\n\t}\n\treturn d.monitor\n}\nfunc (d *Deployer) deployToCloudRun(ctx context.Context, out io.Writer, manifest []byte) error {\n\tcOptions := d.clientOptions\n\tif d.useGcpOptions {\n\t\tcOptions = append(cOptions, option.WithEndpoint(fmt.Sprintf(\"%s-run.googleapis.com\", d.Region)))\n\t\tcOptions = append(gcp.ClientOptions(ctx), cOptions...)\n\t}\n\tcrclient, err := run.NewService(ctx, cOptions...)\n\tif err != nil {\n\t\treturn sErrors.NewError(fmt.Errorf(\"unable to create Cloud Run Client\"), &proto.ActionableErr{\n\t\t\tMessage: err.Error(),\n\t\t\tErrCode: proto.StatusCode_DEPLOY_GET_CLOUD_RUN_CLIENT_ERR,\n\t\t})\n\t}\n\t// figure out which type we have:\n\tresource := &unstructured.Unstructured{}\n\tif err = k8syaml.Unmarshal(manifest, resource); err != nil {\n\t\treturn sErrors.NewError(fmt.Errorf(\"unable to unmarshal Cloud Run Service config: %w\", err), &proto.ActionableErr{\n\t\t\tMessage: err.Error(),\n\t\t\tErrCode: proto.StatusCode_DEPLOY_READ_MANIFEST_ERR,\n\t\t})\n\t}\n\tvar resName *RunResourceName\n\tswitch {\n\tcase resource.GetAPIVersion() == \"serving.knative.dev/v1\" && resource.GetKind() == \"Service\":\n\t\tresName, err = d.deployService(crclient, manifest, out)\n\t\t// the accessor only supports services. Jobs don't run by themselves so port forwarding doesn't make sense.\n\t\tif resName != nil {","sourceCodeStart":190,"sourceCodeEnd":226,"githubUrl":"https://github.com/GoogleContainerTools/skaffold/blob/a1189de023efc32d4b8e11f395acc678aa555011/pkg/skaffold/deploy/cloudrun/deploy.go#L190-L226","documentation":"In `deployToCloudRun`, skaffold constructs a Cloud Run API client with `run.NewService(ctx, cOptions...)`. If client construction fails, the error is wrapped as 'unable to create Cloud Run Client' with code DEPLOY_GET_CLOUD_RUN_CLIENT_ERR. This happens before any manifest is inspected or deployed.","triggerScenarios":"`run.NewService` fails — typically no Google credentials/ADC available in the environment, invalid endpoint option when `useGcpOptions` is set (custom region endpoint), failure building `gcp.ClientOptions(ctx)` (e.g. missing gcloud or token source), or a network error fetching the service discovery document.","commonSituations":"Running `skaffold deploy` in CI without `GOOGLE_APPLICATION_CREDENTIALS` or `gcloud auth application-default login`; wrong `--default-region` producing a bad regional endpoint; offline machine; stale gcloud credentials requiring re-login.","solutions":["Authenticate: run `gcloud auth application-default login` locally, or set `GOOGLE_APPLICATION_CREDENTIALS` to a service-account key in CI","Verify network access to googleapis.com and (if using regional endpoints) that the region in skaffold config is valid","Run `gcloud auth list` / refresh credentials with `gcloud auth login` if tokens expired","Check the `Message` field of the ActionableErr — it carries the underlying error from `run.NewService`"],"exampleFix":"# before (CI): skaffold deploy -> unable to create Cloud Run Client\n# after:\necho \"$GCP_SA_KEY\" > key.json\nexport GOOGLE_APPLICATION_CREDENTIALS=key.json\nskaffold deploy --default-repo=gcr.io/my-project","handlingStrategy":"validation","validationCode":"func requireGCPCredentials() error {\n\tif os.Getenv(\"GOOGLE_APPLICATION_CREDENTIALS\") == \"\" {\n\t\tif _, err := exec.LookPath(\"gcloud\"); err != nil {\n\t\t\treturn errors.New(\"no GOOGLE_APPLICATION_CREDENTIALS and no gcloud: cannot build Cloud Run client\")\n\t\t}\n\t\t// ADC file check\n\t\thome, _ := os.UserHomeDir()\n\t\tif _, err := os.Stat(filepath.Join(home, \".config\", \"gcloud\", \"application_default_credentials.json\")); err != nil {\n\t\t\treturn errors.New(\"application-default credentials missing; run 'gcloud auth application-default login'\")\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if err := deployToCloudRun(ctx, ...); err != nil {\n\tvar sErr *sErrors.Error\n\tif errors.As(err, &sErr) && sErr.Status().ErrCode == proto.StatusCode_DEPLOY_GET_CLOUD_RUN_CLIENT_ERR {\n\t\treturn fmt.Errorf(\"Cloud Run client setup failed (%s): authenticate with 'gcloud auth application-default login'\", sErr.Status().Message)\n\t}\n\treturn err\n}","preventionTips":["Always run `gcloud auth application-default login` (or set GOOGLE_APPLICATION_CREDENTIALS) before deploying","In CI, create a service-account key secret and export GOOGLE_APPLICATION_CREDENTIALS at job start","Verify the configured region produces a valid endpoint (<region>-run.googleapis.com)","Test connectivity to googleapis.com from your deploy environment"],"tags":["cloud-run","authentication","google-cloud","api-client"],"backgroundTag":"missing-gcp-credentials","analyzedSha":"a1189de023efc32d4b8e11f395acc678aa555011","analyzedAt":"2026-09-05T12:09:27.064Z","contentChangedAt":"2026-09-05T12:09:27.064Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}