{"record":{"id":"3f9745340b35a498","repo":"GoogleContainerTools/skaffold","slug":"error-getting-google-authenticator","errorCode":null,"errorMessage":"error getting google authenticator","messagePattern":"error getting google authenticator","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/skaffold/docker/auth.go","lineNumber":141,"sourceCode":"\n\tif isGoogleRegistry(registry) {\n\t\tauthCfg, err := h.getGoogleAuthConfig(ctx, registry)\n\t\tif err == nil {\n\t\t\treturn authCfg, nil\n\t\t}\n\t}\n\n\treturn cliTypesToAuthConfigType(auth), nil\n}\n\nfunc (h credsHelper) getGoogleAuthConfig(ctx context.Context, registry string) (types.AuthConfig, error) {\n\tauth, err := google.NewEnvAuthenticator(ctx)\n\tif err != nil {\n\t\treturn types.AuthConfig{}, err\n\t}\n\n\tif auth == authn.Anonymous {\n\t\treturn types.AuthConfig{}, fmt.Errorf(\"error getting google authenticator\")\n\t}\n\n\tcfg, err := auth.Authorization()\n\tif err != nil {\n\t\treturn types.AuthConfig{}, err\n\t}\n\n\tbCfg, err := cfg.MarshalJSON()\n\tif err != nil {\n\t\treturn types.AuthConfig{}, err\n\t}\n\n\tvar authCfg types.AuthConfig\n\terr = json.Unmarshal(bCfg, &authCfg)\n\tif err != nil {\n\t\treturn types.AuthConfig{}, err\n\t}\n","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/GoogleContainerTools/skaffold/blob/a1189de023efc32d4b8e11f395acc678aa555011/pkg/skaffold/docker/auth.go#L123-L159","documentation":"Returned when google.NewEnvAuthenticator yields the Anonymous authenticator, meaning no Google Application Default Credentials are available. loadCredentials therefore cannot obtain GCR credentials for the registry.","triggerScenarios":"getGoogleAuthConfig runs and NewEnvAuthenticator returns authn.Anonymous because GOOGLE_APPLICATION_CREDENTIALS is unset and no metadata server / gcloud ADC credentials exist.","commonSituations":"Pulling/pushing to gcr.io or *.pkg.dev from a laptop without gcloud auth or a service account key; running outside GCP without GOOGLE_APPLICATION_CREDENTIALS; token-scopes or Cloud SDK misconfiguration.","solutions":["Run `gcloud auth application-default login`","Set GOOGLE_APPLICATION_CREDENTIALS to a service account JSON key","Run inside GCE/GKE/Cloud Build where the metadata server provides ADC","Use a credsStore/helper in the docker config instead of GCR env auth"],"exampleFix":"// before (shell)\nskaffold run   # no ADC\n// after\ngcloud auth application-default login\nexport GOOGLE_APPLICATION_CREDENTIALS=$HOME/sa-key.json\nskaffold run","handlingStrategy":"validation","validationCode":"if os.Getenv(\"GOOGLE_APPLICATION_CREDENTIALS\") == \"\" && os.Getenv(\"GOOGLE_CLOUD_PROJECT\") == \"\" {\n  return fmt.Errorf(\"no GCP ADC configured; run gcloud auth application-default login\")\n}","typeGuard":null,"tryCatchPattern":"ac, err := getGoogleAuthConfig(ctx)\nif errors.Is(err, errNoGoogleAuth) || strings.Contains(err.Error(), \"error getting google authenticator\") {\n  return fmt.Errorf(\"GCP auth missing: run 'gcloud auth application-default login'\")\n}","preventionTips":["Run gcloud auth application-default login in dev environments","Set GOOGLE_APPLICATION_CREDENTIALS in CI to a service-account key","Use workload identity/metadata server when running inside GCP","Periodically refresh service-account keys"],"tags":["gcp","auth","gcr","credentials"],"backgroundTag":"missing-application-default-credentials","analyzedSha":"a1189de023efc32d4b8e11f395acc678aa555011","analyzedAt":"2026-09-05T12:09:27.064Z","contentChangedAt":"2026-09-05T12:09:27.064Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}