GoogleContainerTools / GoogleContainerTools/skaffold

skaffold build + GCE default service accounts is confusing!

Open
#4,565 4 comments 0 reactions 0 assignees View on GitHub
area/auth area/build area/errors build/gcb kind/friction needs-actionable-error priority/p1
Dominant language
Go
Stars
15.9k
Forks
1.7k
Avg merge
3d 9h
Merged PRs (30d)
10

Description

### Expected behavior

skaffold build works

### Actual behavior

```

couldn't build "tlogdb": creating bucket if not exists: googleapi: Error 403: Insufficient Permission, insufficientPermissions
```

### Information

- Skaffold version: v1.12.0
- Operating system: Ubuntu 20.04 on Google Cloud
- Contents of skaffold.yaml:

```

apiVersion: skaffold/v2beta5
kind: Config
metadata:
name: tlogdb
build:
artifacts:
- image: tlogdb
googleCloudBuild:
projectId: beta-binary-transparencylog
deploy:
kubectl:
manifests:
- tlogdb-*deployment.yaml
- tlogdb-*service.yaml
```

### Steps to reproduce the behavior

1. Use a google cloud machine
2. Try to use skaffold build without GOOGLE_APPLICATION_CREDENTIALS

The problem is you have no idea where skaffold is getting its credentials. I assumed it was from `gcloud` but on a Google Cloud VM it uses the default service account... gah! I am currently having to use a Google Cloud VM for development work as a shell machine so this is very very surprising!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.