{"record":{"id":"f80b1829c0a1c578","repo":"googleapis/mcp-toolbox","slug":"unable-to-create-instance-admin-client-w","errorCode":null,"errorMessage":"unable to create instance admin client: %w","messagePattern":"unable to create instance admin client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"internal/sources/bigtable/bigtable.go","lineNumber":69,"sourceCode":"\tType     string `yaml:\"type\" validate:\"required\"`\n\tProject  string `yaml:\"project\" validate:\"required\"`\n\tInstance string `yaml:\"instance\" validate:\"required\"`\n}\n\nfunc (r Config) SourceConfigType() string {\n\treturn SourceType\n}\n\nfunc (r Config) Initialize(ctx context.Context, tracer trace.Tracer) (sources.Source, error) {\n\tclient, err := initBigtableClient(ctx, tracer, r.Name, r.Project, r.Instance)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to create client: %w\", err)\n\t}\n\n\tinstanceAdminClient, err := initBigtableInstanceAdminClient(ctx, tracer, r.Name, r.Project)\n\tif err != nil {\n\t\tclient.Close()\n\t\treturn nil, fmt.Errorf(\"unable to create instance admin client: %w\", err)\n\t}\n\n\tadminClient, err := initBigtableAdminClient(ctx, tracer, r.Name, r.Project, r.Instance)\n\tif err != nil {\n\t\tclient.Close()\n\t\tinstanceAdminClient.Close()\n\t\treturn nil, fmt.Errorf(\"unable to create admin client: %w\", err)\n\t}\n\n\ts := &Source{\n\t\tConfig:        r,\n\t\tClient:        client,\n\t\tInstanceAdmin: instanceAdminClient,\n\t\tAdmin:         adminClient,\n\t}\n\treturn s, nil\n}\n","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/bigtable/bigtable.go#L51-L87","documentation":"Config.Initialize fails when initBigtableInstanceAdminClient cannot create the Bigtable InstanceAdmin client. The data client was already created successfully (and is Close()d before returning), so the failure is specific to the instance-admin client: credentials, project ID validity, or endpoint/network issues. Initialization aborts, leaving the source unusable.","triggerScenarios":"Source initialization when: bigtable.NewInstanceAdminClient fails due to missing ADC, invalid r.Project (empty or nonexistent project), IAM permission to query the project is absent, or network egress to bigtableadmin.googleapis.com / oauth2 endpoints is blocked.","commonSituations":"Service account valid for data access but lacking project-level Bigtable admin roles; typo'd project ID; local runs without credentials; proxy/firewall blocking bigtableadmin.googleapis.com while allowing the data endpoint; stale or revoked key files.","solutions":["Verify credentials exist and are valid (GOOGLE_APPLICATION_CREDENTIALS or gcloud auth application-default login); note the error fires after the data client succeeded, so check project-scoped permissions specifically","Confirm r.Project is correct and exists (gcloud projects describe)","Grant roles/bigtable.admin on the project to the service account","Check network access to bigtableadmin.googleapis.com and oauth2.googleapis.com","Inspect the wrapped error (%w) for the precise gRPC code (Unauthenticated, PermissionDenied, NotFound)"],"exampleFix":"// before: project field wrong, admin client creation fails\nkind: bigtable\nproject: my-projekt\ninstance: my-instance\n// after\nkind: bigtable\nproject: my-project\ninstance: my-instance","handlingStrategy":"validation","validationCode":"// validate project before Initialize; instance-admin client requires a valid project\nfunc precheckProject(ctx context.Context, project string) error {\n    if project == \"\" {\n        return errors.New(\"project must be set for the bigtable instance admin client\")\n    }\n    if _, err := crmService.Projects.Get(project).Context(ctx).Do(); err != nil {\n        return fmt.Errorf(\"project %q not reachable: %w\", project, err)\n    }\n    return nil\n}","typeGuard":"func isPermissionDenied(err error) bool {\n    return status.Code(errors.Unwrap(err)) == codes.PermissionDenied\n}","tryCatchPattern":"src, err := cfg.Initialize(ctx, tracer)\nif err != nil && strings.Contains(err.Error(), \"instance admin client\") {\n    if isPermissionDenied(err) {\n        return fmt.Errorf(\"grant roles/bigtable.admin on project %q to the service account: %w\", project, err)\n    }\n    return err\n}","preventionTips":["Grant roles/bigtable.admin on the project — data-plane access alone is not enough for the instance admin client","Verify the project ID in the config (typos here are the top cause since the data client may succeed while admin fails)","Ensure egress to bigtableadmin.googleapis.com is allowed; proxies often whitelist only data endpoints","Test credentials with 'gcloud bigtable instances list --project=<project>' before starting the toolbox"],"tags":["gcp","bigtable","authentication","iam","configuration"],"backgroundTag":"missing-gcp-credentials","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}