{"record":{"id":"e3b3a8a19072c68f","repo":"GoogleContainerTools/skaffold","slug":"retrieving-gcloud-access-token-w","errorCode":null,"errorMessage":"retrieving gcloud access token: %w","messagePattern":"retrieving gcloud access token: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/skaffold/gcp/auth.go","lineNumber":93,"sourceCode":"\tcmd.Stdout = &body\n\terr := util.RunCmd(context.TODO(), cmd)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get access token %v\", err)\n\t}\n\tvar t token\n\tif err := json.Unmarshal(body.Bytes(), &t); err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to unmarshal gcloud command result into access token %v\", err)\n\t}\n\treturn &oauth2.Token{AccessToken: t.Token}, nil\n}\n\nfunc activeUserCredentialsOnce() (*google.Credentials, error) {\n\tcredsOnce.Do(func() {\n\t\tc, err := activeUserCredentials()\n\t\tif err != nil {\n\t\t\tlog.Entry(context.TODO()).Infof(\"unable to retrieve gcloud access token: %v\", err)\n\t\t\tlog.Entry(context.TODO()).Info(\"falling back to application default credentials\")\n\t\t\tcredsErr = fmt.Errorf(\"retrieving gcloud access token: %w\", err)\n\t\t\treturn\n\t\t}\n\t\tcreds = c\n\t})\n\n\treturn creds, credsErr\n}\n\nfunc activeUserCredentials() (*google.Credentials, error) {\n\tvar ts tokenSource\n\tt, err := ts.Token()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tc := &google.Credentials{TokenSource: oauth2.ReuseTokenSource(t, ts)}\n\treturn c, nil\n}\n","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/GoogleContainerTools/skaffold/blob/a1189de023efc32d4b8e11f395acc678aa555011/pkg/skaffold/gcp/auth.go#L75-L111","documentation":"activeUserCredentialsOnce resolves user credentials once (sync.Once). If activeUserCredentials fails (gcloud token errors 375/376), it logs the problem, falls back to Application Default Credentials, and stores this wrapped error in credsErr. Callers receive the ADC result or this error.","triggerScenarios":"Any call path that requests the active user's credentials when gcloud token retrieval failed — the error you actually observe is this wrapper around the 'failed to get access token'/'unmarshal' cause.","commonSituations":"No gcloud login AND no ADC available; CI environments with neither service-account keys nor gcloud auth; the fallback to application default credentials also failing.","solutions":["Fix the wrapped root cause: run `gcloud auth login` or `gcloud auth application-default login`.","Set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account key so ADC succeeds.","Ensure the workload uses a metadata server (GCE/GKE/Cloud Run) so ADC works without gcloud.","Check both the log line 'unable to retrieve gcloud access token' and the inner error for the real fix."],"exampleFix":"// before (no creds anywhere)\n// after (CI)\nexport GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json","handlingStrategy":"fallback","validationCode":"// Pre-flight: can ADC resolve at all?\nif _, err := google.FindDefaultCredentials(ctx); err != nil {\n    return fmt.Errorf(\"no gcloud user credentials and no ADC: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"creds, credsErr := activeUserCredentials()\nif credsErr != nil {\n    log.Warnf(\"falling back to environment-provided credentials: %v\", credsErr)\n    creds, credsErr = google.FindDefaultCredentials(ctx)\n    if credsErr != nil {\n        return fmt.Errorf(\"no usable GCP credentials: %w\", credsErr)\n    }\n}","preventionTips":["Set up exactly one reliable credential source: gcloud login, GOOGLE_APPLICATION_CREDENTIALS, or a metadata server.","Note the sync.Once: a failed first attempt caches the error for the process lifetime — fix creds before restart.","Read the log line 'unable to retrieve gcloud access token' for the underlying cause.","In CI, always provide a service-account key or workload identity federation."],"tags":["gcp","gcloud","auth","credentials","fallback"],"backgroundTag":"gcloud-auth-failed","analyzedSha":"a1189de023efc32d4b8e11f395acc678aa555011","analyzedAt":"2026-09-05T12:09:27.064Z","contentChangedAt":"2026-09-05T12:09:27.064Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}