{"record":{"id":"2fb6dc9b784c4b54","repo":"googleapis/mcp-toolbox","slug":"failed-to-create-dataplex-client-for-project-q","errorCode":null,"errorMessage":"failed to create Dataplex client for project %q: %w","messagePattern":"failed to create Dataplex client for project %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/bigquery/bigquery.go","lineNumber":963,"sourceCode":"\t\t\topts = []option.ClientOption{\n\t\t\t\toption.WithUserAgent(userAgent),\n\t\t\t\toption.WithTokenSource(ts),\n\t\t\t}\n\t\t} else {\n\t\t\t// Use default credentials\n\t\t\tcred, err := google.FindDefaultCredentials(ctx, credScopes...)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, nil, fmt.Errorf(\"failed to find default Google Cloud credentials: %w\", err)\n\t\t\t}\n\t\t\topts = []option.ClientOption{\n\t\t\t\toption.WithUserAgent(userAgent),\n\t\t\t\toption.WithCredentials(cred),\n\t\t\t}\n\t\t}\n\n\t\tclient, err = dataplexapi.NewCatalogClient(ctx, opts...)\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"failed to create Dataplex client for project %q: %w\", project, err)\n\t\t}\n\t}\n\n\treturn client, clientCreator, nil\n}\n\nfunc initDataplexConnectionWithOAuthToken(\n\tctx context.Context,\n\tproject string,\n\tuserAgent string,\n\ttokenString string,\n) (*dataplexapi.CatalogClient, error) {\n\t// Construct token source\n\ttoken := &oauth2.Token{\n\t\tAccessToken: string(tokenString),\n\t}\n\tts := oauth2.StaticTokenSource(token)\n","sourceCodeStart":945,"sourceCodeEnd":981,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/bigquery/bigquery.go#L945-L981","documentation":"This error wraps failure from dataplexapi.NewCatalogClient() when constructing the Dataplex Data Catalog client during source initialization. Unlike ADC lookup, this typically fails on option validation (gRPC dial options, endpoint, token source inconsistencies) rather than at request time, since the client constructor itself does not call the API.","triggerScenarios":"initDataplexConnection with server-side (non-client-OAuth) auth where NewCatalogClient rejects the constructed options: invalid token source from a failed impersonation setup that silently degraded, invalid `project`-derived endpoint, or a grpc dial error due to transport/security option conflicts.","commonSituations":"Corrupt or expired credentials whose token source fails lazily at client construction; proxy/firewall interfering with gRPC channel creation; version incompatibility between cloud.google.com/go/dataplex and google.golang.org/api; custom endpoints that aren't valid Dataplex API endpoints.","solutions":["Inspect the wrapped error (%w) — most causes mirror the credential errors above (477/478); fix the underlying credential problem first.","Verify the project ID is valid and the Dataplex API (dataplex.googleapis.com) is enabled: `gcloud services enable dataplex.googleapis.com`.","Test connectivity to the endpoint: `curl https://dataplex.googleapis.com` — configure HTTPS_PROXY for corporate networks.","Upgrade cloud.google.com/go/dataplex and related google.golang.org deps to consistent versions.","As a workaround, enable `useClientOAuth` so the client is created per-request with the caller's token instead of at startup."],"exampleFix":"// before\nclient, err = dataplexapi.NewCatalogClient(ctx, opts...) // stale token source\n// after\n// re-mint credentials before constructing the client\ncred, err := google.FindDefaultCredentials(ctx, credScopes...)\nif err != nil { return nil, nil, err }\nopts = append(opts, option.WithCredentials(cred))\nclient, err = dataplexapi.NewCatalogClient(ctx, opts...)","handlingStrategy":"try-catch","validationCode":"// pre-flight: ensure Dataplex API enabled and creds usable before constructing client\nif err := exec.Command(\"gcloud\", \"services\", \"list\", \"--enabled\", \"--filter=dataplex.googleapis.com\").Run(); err != nil {\n    return fmt.Errorf(\"dataplex API not enabled for project %s\", project)\n}\nif _, err := google.FindDefaultCredentials(context.Background(), CloudPlatformScope); err != nil { return err }","typeGuard":"func isDataplexClientErr(err error) bool { return err != nil && strings.Contains(err.Error(), \"failed to create Dataplex client\") }","tryCatchPattern":"client, creator, err := initDataplexConnection(ctx, tracer, name, project, useClientOAuth, sa, scopes)\nif err != nil {\n    if isDataplexClientErr(err) {\n        // non-retryable config/credential issue: surface actionable message\n        return fmt.Errorf(\"dataplex init for %q: %w\", project, err)\n    }\n    return err\n}","preventionTips":["Enable dataplex.googleapis.com on the target project before connecting.","Fix any ADC/impersonation errors (477/478) first — they are the usual root cause.","Keep cloud.google.com/go/dataplex and google.golang.org/api versions in sync.","Set HTTPS_PROXY for gRPC traffic in proxied networks; smoke-test client creation in CI."],"tags":["gcp","dataplex","grpc","client-initialization"],"backgroundTag":"gcp-credential-initialization-failed","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}