{"record":{"id":"fbe456652de0dea7","repo":"apache/beam","slug":"failed-to-create-client-for-v","errorCode":null,"errorMessage":"Failed to create client for %v","messagePattern":"Failed to create client for (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sdks/go/pkg/beam/artifact/gcsproxy/retrieval.go","lineNumber":94,"sourceCode":"// GetManifest returns the manifest for all artifacts.\nfunc (s *RetrievalServer) GetManifest(ctx context.Context, req *jobpb.GetManifestRequest) (*jobpb.GetManifestResponse, error) {\n\treturn &jobpb.GetManifestResponse{Manifest: s.md}, nil\n}\n\n// GetArtifact returns a given artifact.\nfunc (s *RetrievalServer) GetArtifact(req *jobpb.LegacyGetArtifactRequest, stream jobpb.LegacyArtifactRetrievalService_GetArtifactServer) error {\n\tkey := req.GetName()\n\tblob, ok := s.blobs[key]\n\tif !ok {\n\t\treturn errors.Errorf(\"artifact %v not found\", key)\n\t}\n\n\tbucket, object := parseObject(blob)\n\n\tctx := stream.Context()\n\tclient, err := gcsx.NewClient(ctx, storage.ScopeReadOnly)\n\tif err != nil {\n\t\treturn errors.Wrapf(err, \"Failed to create client for %v\", key)\n\t}\n\n\t// Stream artifact in up to 1MB chunks.\n\tr, err := client.Bucket(bucket).Object(object).NewReader(ctx)\n\tif err != nil {\n\t\treturn errors.Wrapf(err, \"Failed to read object for %v\", key)\n\t}\n\tdefer r.Close()\n\n\tdata := make([]byte, 1<<20)\n\tfor {\n\t\tn, err := r.Read(data)\n\t\tif n > 0 {\n\t\t\tif err := stream.Send(&jobpb.ArtifactChunk{Data: data[:n]}); err != nil {\n\t\t\t\treturn errors.Wrap(err, \"chunk send failed\")\n\t\t\t}\n\t\t}\n\t\tif err == io.EOF {","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/go/pkg/beam/artifact/gcsproxy/retrieval.go#L76-L112","documentation":"GetArtifact creates a read-only GCS client to stream the artifact blob. This wrapped error is returned when gcsx.NewClient fails during artifact retrieval, i.e. client/auth initialization failed for the given artifact request.","triggerScenarios":"Calling GetArtifact when credentials are missing or invalid in the retrieval server's environment: no Application Default Credentials, bad GOOGLE_APPLICATION_CREDENTIALS, or library init failure.","commonSituations":"Running the retrieval service outside GCP without attached service accounts, revoked or expired key files, or Storage API disabled.","solutions":["Attach a service account with Storage Object Viewer to the retrieval service or set GOOGLE_APPLICATION_CREDENTIALS to a valid key file.","Run gcloud auth application-default login in local/dev environments.","Verify network access to storage.googleapis.com and that Cloud Storage API is enabled."],"exampleFix":"// before: deployment without a storage role\n// after: grant roles/storage.objectViewer to the service account, then redeploy","handlingStrategy":"retry","validationCode":"if os.Getenv(\"GOOGLE_APPLICATION_CREDENTIALS\") == \"\" {\n    if _, err := gcp.DefaultCredentials(ctx); err != nil { return fmt.Errorf(\"GCS credentials required before artifact retrieval\") }\n}","typeGuard":null,"tryCatchPattern":"err := streamArtifact(ctx, key)\nif err != nil && strings.Contains(err.Error(), \"Failed to create client\") { return retryable(err) }","preventionTips":["Verify GCS client creation at service startup, not per-request.","Attach storage read credentials to the retrieval service deployment."],"tags":["gcs","authentication","network","beam"],"backgroundTag":"missing-credentials","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}