{"record":{"id":"2fee0cddd4e3b305","repo":"apache/druid","slug":"not-using-a-service-account","errorCode":null,"errorMessage":"Not using a service account","messagePattern":"Not using a service account","errorType":"exception","errorClass":"GceServiceException","httpStatus":null,"severity":"error","filePath":"extensions-contrib/gce-extensions/src/main/java/org/apache/druid/indexing/overlord/autoscaling/gce/GceAutoScaler.java","lineNumber":133,"sourceCode":"  @Nullable\n  Compute createComputeServiceImpl()\n      throws IOException, GeneralSecurityException, GceServiceException\n  {\n    HttpTransport httpTransport = GoogleNetHttpTransport.newTrustedTransport();\n    JsonFactory jsonFactory = JacksonFactory.getDefaultInstance();\n    GoogleCredential credential = GoogleCredential.getApplicationDefault(\n        httpTransport,\n        jsonFactory\n    );\n    if (credential.createScopedRequired()) {\n      List<String> scopes = new ArrayList<>();\n      scopes.add(ComputeScopes.CLOUD_PLATFORM);\n      scopes.add(ComputeScopes.COMPUTE);\n      credential = credential.createScoped(scopes);\n    }\n\n    if (credential.getClientAuthentication() != null) {\n      throw new GceServiceException(\"Not using a service account\");\n    }\n\n    return new Compute.Builder(httpTransport, jsonFactory, credential)\n        .setApplicationName(\"DruidAutoscaler\")\n        .build();\n  }\n\n  private Compute createComputeService()\n      throws IOException, GeneralSecurityException, InterruptedException, GceServiceException\n  {\n    final int maxRetries = 5;\n\n    int retries = 0;\n    // This retry loop is here to catch the cases in which the underlying call to\n    // Compute.Builder(...).build() returns null, case that has been experienced\n    // sporadically at start time\n    while (cachedComputeService == null && retries < maxRetries) {\n      if (retries > 0) {","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-contrib/gce-extensions/src/main/java/org/apache/druid/indexing/overlord/autoscaling/gce/GceAutoScaler.java#L115-L151","documentation":"Guard in GceAutoScaler.createComputeServiceImpl: GoogleCredential.getApplicationDefault did not yield a service-account credential (or the credential requires scoping that cannot be satisfied), so the autoscaler cannot authenticate to the GCE API. This typically means the host has no service-account key configured (no GOOGLE_APPLICATION_CREDENTIALS, no metadata-server credential).","triggerScenarios":"Thrown at extensions-contrib/gce-extensions/src/main/java/org/apache/druid/indexing/overlord/autoscaling/gce/GceAutoScaler.java:133 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set GOOGLE_APPLICATION_CREDENTIALS to a service-account JSON key file, or run on a GCE instance with a service account attached.","Grant the service account compute permissions (compute instance admin or similar) and enable the Compute Engine API.","If using user credentials locally, run `gcloud auth application-default login` so application-default credentials resolve."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}