{"record":{"id":"1cf1aaadb7e9a43e","repo":"getsops/sops","slug":"credentials-failed-to-obtain-credentials-from-q","errorCode":null,"errorMessage":"credentials: failed to obtain credentials from %q: %w","messagePattern":"credentials: failed to obtain credentials from %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"gcpkms/keysource.go","lineNumber":306,"sourceCode":"// It returns an error if the ResourceID is invalid, or if the setup of the\n// client fails.\nfunc (key *MasterKey) newKMSClient(ctx context.Context) (*kms.KeyManagementClient, error) {\n\tre := regexp.MustCompile(`^projects/[^/]+/locations/[^/]+/keyRings/[^/]+/cryptoKeys/[^/]+$`)\n\tmatches := re.FindStringSubmatch(key.ResourceID)\n\tif matches == nil {\n\t\treturn nil, fmt.Errorf(\"no valid resource ID found in %q\", key.ResourceID)\n\t}\n\n\tvar opts []option.ClientOption\n\tswitch {\n\tcase key.tokenSource != nil:\n\t\topts = append(opts, option.WithTokenSource(key.tokenSource))\n\tcase key.credentialJSON != nil:\n\t\topts = append(opts, option.WithCredentialsJSON(key.credentialJSON))\n\tdefault:\n\t\tcredentials, err := getGoogleCredentials()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"credentials: failed to obtain credentials from %q: %w\", SopsGoogleCredentialsEnv, err)\n\t\t}\n\t\tif credentials != nil {\n\t\t\topts = append(opts, option.WithCredentialsJSON(credentials))\n\t\t\tbreak\n\t\t}\n\n\t\tif atCredentials := getGoogleOAuthTokenFromEnv(); atCredentials != nil {\n\t\t\topts = append(opts, option.WithTokenSource(atCredentials))\n\t\t\tbreak\n\t\t}\n\t}\n\n\tswitch {\n\tcase key.grpcConn != nil:\n\t\topts = append(opts, option.WithGRPCConn(key.grpcConn))\n\tcase len(key.grpcDialOpts) > 0:\n\t\tfor _, opt := range key.grpcDialOpts {\n\t\t\topts = append(opts, option.WithGRPCDialOption(opt))","sourceCodeStart":288,"sourceCodeEnd":324,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/gcpkms/keysource.go#L288-L324","documentation":"When no token source or credential JSON is configured, newKMSClient falls back to fetching Google credentials from the environment (SOPS_GCP_CREDENTIALS, then ADC). This error wraps the failure of that lookup, meaning SOPS found no usable Google credentials at all.","triggerScenarios":"newKMSClient's default branch: key.tokenSource == nil, key.credentialJSON == nil, and getGoogleCredentials() returns an error (no SopsGoogleCredentialsEnv value parseable, and google.FindDefaultCredentials fails).","commonSituations":"Running sops in CI containers with no GOOGLE_APPLICATION_CREDENTIALS and no metadata server; SOPS_GCP_CREDENTIALS set but pointing to unreadable file or invalid JSON; gcloud user credentials never authorized via `gcloud auth application-default login`.","solutions":["Run `gcloud auth application-default login` for local development.","Set GOOGLE_APPLICATION_CREDENTIALS to a valid, readable service-account JSON file.","If using SOPS_GCP_CREDENTIALS, ensure it contains the full service-account JSON, not a file path.","In GKE/Cloud Run/CI-on-GCP, attach a service account via Workload Identity instead of key files."],"exampleFix":"// before\n// (no credentials configured)\n// after\nexport GOOGLE_APPLICATION_CREDENTIALS=\"$HOME/.config/gcloud/sops-sa.json\"","handlingStrategy":"validation","validationCode":"hasCreds := os.Getenv(\"GOOGLE_APPLICATION_CREDENTIALS\") != \"\" || os.Getenv(\"SOPS_GCP_CREDENTIALS\") != \"\"\nif !hasCreds {\n    // optionally check ~/.config/gcloud/application_default_credentials.json exists\n    return errors.New(\"no GCP credentials configured for sops\")\n}","typeGuard":"null","tryCatchPattern":"null","preventionTips":["Standardize on Workload Identity in GCP environments to avoid key files entirely.","Document required env vars (GOOGLE_APPLICATION_CREDENTIALS or SOPS_GCP_CREDENTIALS) in CI templates.","Validate credential JSON parses as JSON in a preflight step."],"tags":["gcp","credentials","env-var","adc"],"backgroundTag":"missing-google-credentials","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}