K
Q

How to solve insufficient authentication scopes when use Pubsub on GCP

3/21/2020

I'm trying to build 2 microservices (in Java Spring Boot) to communicate with each other using GCP Pub/Sub.

First, I tested the programs(in Eclipse) working as epxected in my local laptop(http://localhost), i.e. one microservice published the message and the other received it successfully using the Topic/Subscriber created in GCP (as well as the credential private key: mypubsub.json).

Then, I deployed the same programs to run GCP, and got following errors:

- 2020-03-21 15:53:16.831 WARN 1 --- [bsub-publisher2] o.s.c.g.p.c.p.PubSubPublisherTemplate : Publishing to json-payload-sample-topic topic failed
- com.google.api.gax.rpc.PermissionDeniedException: io.grpc.StatusRuntimeException: PERMISSION_DENIED: Request had insufficient authentication scopes. at com.google.api.gax.rpc.ApiExceptionFactory

What I did to deploy the programs(in container) to run on GCP/Kubernetes Engine:

  1. Login the Cloud Shell after switch to my project for the Pubsub testing
  2. Git clone my programs which being tested in Eclipse
  3. Move the mypubsub.json file to under /home/my_user_id
  4. export GOOGLE_APPLICATION_CREDENTIALS="/home/my_user_id/mp6key.json"
  5. Run 'mvn clean package' to build the miscroservice programs
  6. Run 'docker build' to create the image files
  7. Run 'docker push' to push the image files to gcr.io repo
  8. Run 'kubectl create' to create the deployments and expose the services

Once the 2 microservices deployed and exposed, when I tried to access them in browser, the one to publish a message worked fine to retrieve data from database and processed the data, then failed with the above errors when trying to access the GCP Pubsub API to publish the message

Could anyone provide a hint for what to check to solve the issue?

-- Roy Hu
google-cloud-platform
google-kubernetes-engine
publish-subscribe

Similar Questions

How do I use a running che 7
Kubernetes : Pod scheduling/eviction relationship with requests/limits
Java Kubernetes client SSLHandshakeException extension (5) should not be presented in certificate_request
ACE Nodejs framework with sqlite running in Kubernetes pod

1 Answer

3/22/2020

The issue has been resolved by following the guide:

https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform

Briefly the solution is to add following lines in the deployment.yaml to load the credential key:

        - name: google-cloud-key
          secret:
            secretName: pubsub-key
        containers:
        - name: my_container
          image: gcr.io/my_image_file
          volumeMounts:
          - name: google-cloud-key
            mountPath: /var/secrets/google
          env:
          - name: GOOGLE_APPLICATION_CREDENTIALS
            value: /var/secrets/google/key.json
-- Roy Hu
Source: StackOverflow