{"record":{"id":"c6fc66e19e68f612","repo":"GoogleContainerTools/skaffold","slug":"error-creating-gcs-client-w","errorCode":null,"errorMessage":"error creating GCS Client: %w","messagePattern":"error creating GCS Client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/skaffold/gcs/client/native.go","lineNumber":287,"sourceCode":"\n\tq := &storage.Query{Prefix: urinfo.ObjPath + \"/\"}\n\t// GCS doesn't support empty \"folders\".\n\tmatches, err := bucket.ListObjects(ctx, q)\n\tif err != nil {\n\t\treturn false, err\n\t}\n\n\tif len(matches) > 0 {\n\t\treturn true, nil\n\t}\n\n\treturn false, nil\n}\n\nfunc getBucketManager(ctx context.Context, bucketName string) (bucketHandler, error) {\n\tsc, err := storage.NewClient(ctx)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error creating GCS Client: %w\", err)\n\t}\n\n\treturn nativeBucketHandler{\n\t\tstorageClient: sc,\n\t\tbucket:        sc.Bucket(bucketName),\n\t}, nil\n}\n\n// nativeBucketHandler implements a handler using the Cloud client libraries.\ntype nativeBucketHandler struct {\n\tstorageClient *storage.Client\n\tbucket        *storage.BucketHandle\n}\n\nfunc (nb nativeBucketHandler) ListObjects(ctx context.Context, q *storage.Query) ([]string, error) {\n\tmatches := []string{}\n\tit := nb.bucket.Objects(ctx, q)\n","sourceCodeStart":269,"sourceCodeEnd":305,"githubUrl":"https://github.com/GoogleContainerTools/skaffold/blob/a1189de023efc32d4b8e11f395acc678aa555011/pkg/skaffold/gcs/client/native.go#L269-L305","documentation":"getBucketManager wraps storage.NewClient failures when constructing the Google Cloud Storage client. It means no GCS client could be created, almost always because Application Default Credentials could not be found or the environment is misconfigured. Without this client no list/download/upload can proceed.","triggerScenarios":"Any call path (DownloadRecursive, UploadFile) on a machine with no credentials: GOOGLE_APPLICATION_CREDENTIALS unset and no gcloud ADC, metadata server unreachable (not on GCP), or an invalid credentials file path.","commonSituations":"Running skaffold locally without `gcloud auth application-default login`; CI job with GOOGLE_APPLICATION_CREDENTIALS pointing to a deleted/malformed key file; running in Docker without mounting credentials; network proxy blocking googleapis.com token endpoint.","solutions":["Run `gcloud auth application-default login` for local development","Set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key file","In GKE/GCE/Cloud Build, attach the proper service account or workload identity instead of file creds","Verify the wrapped error (default credentials / metadata / network) and fix connectivity to oauth2.googleapis.com"],"exampleFix":"// before\nexport GOOGLE_APPLICATION_CREDENTIALS=/old/deleted-key.json\n// after\nexport GOOGLE_APPLICATION_CREDENTIALS=$HOME/keys/sa.json  # valid key file\n# or, locally:\ngcloud auth application-default login","handlingStrategy":"try-catch","validationCode":"func checkGCSCreds() error {\n\tif p := os.Getenv(\"GOOGLE_APPLICATION_CREDENTIALS\"); p != \"\" {\n\t\tif _, err := os.Stat(p); err != nil {\n\t\t\treturn fmt.Errorf(\"credentials file missing: %w\", err)\n\t\t}\n\t\treturn nil\n\t}\n\tif _, err := google.FindDefaultCredentials(context.Background(), storage.ScopeReadOnly); err != nil {\n\t\treturn fmt.Errorf(\"no application default credentials: %w\", err)\n\t}\n\treturn nil\n}\n// run once at startup","typeGuard":null,"tryCatchPattern":"if err := n.UploadFile(ctx, src, dst); err != nil {\n\tvar ue *googleapi.Error\n\tif errors.As(err, &ue) {\n\t\tlog.Fatalf(\"GCS API error: %v\", ue)\n\t}\n\tif strings.Contains(err.Error(), \"creating GCS Client\") {\n\t\tlog.Fatalf(\"credential problem, run 'gcloud auth application-default login': %v\", err)\n\t}\n\treturn err\n}","preventionTips":["Verify ADC availability at application startup, not at first GCS call","Mount valid key files into CI containers and set GOOGLE_APPLICATION_CREDENTIALS","Prefer workload identity / attached service accounts over exported keys","Keep network egress to oauth2.googleapis.com and storage.googleapis.com open"],"tags":["gcs","authentication","gcp","credentials"],"backgroundTag":"gcp-credentials-not-found","analyzedSha":"a1189de023efc32d4b8e11f395acc678aa555011","analyzedAt":"2026-09-05T12:09:27.064Z","contentChangedAt":"2026-09-05T12:09:27.064Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}