firebase / firebase/firebase-tools

METADATA_SERVER_DETECTION override ignored in the emulator by _checkIsGCE() in google-auth-library calling gcpMetadata.getGCPResidency or gcpMetadata.isAvailable

Open
#7,566 5 comments 2 reactions 1 assignee Assigned to @Berlioz View on GitHub
emulators: functions type: bug
Dominant language
TypeScript
Stars
4.5k
Forks
1.3k
Avg merge
1d 12h
Merged PRs (30d)
84

Description

### [REQUIRED] Environment info

**firebase-tools:** 13.15.2

**Platform:** Windows 11

### [REQUIRED] Test case

- Using the emulator with functions, firestore, hosting
- .env.local contains METADATA_SERVER_DETECTION=none (see #6765 )
- http://169.254.169.254/computeMetadata/v1/universe/universe_domain is called and times out the function

### [REQUIRED] Steps to reproduce

- Load local environment variables with functions.config() -this appears to trigger a call to the metadata endpoint, despite the override in the env configuration
- Use firestore functions - this appears to trigger calls to the metadata endpoint through google-auth-library, despite the override in the env configuration

### [REQUIRED] Expected behavior

Emulator functions should not attempt to connect to or time out while trying to reach "http://169.254.169.254/computeMetadata/v1/universe/universe_domain".

### [REQUIRED] Actual behavior

The emulator functions attempt to reach 169.254.169.254, which times out after 60 seconds, causing an internal error.

`i functions: Loaded environment variables from .env.local.
! External network resource requested!
- URL: "http://169.254.169.254/computeMetadata/v1/universe/universe_domain"`

then a little while later:
`i Your function timed out after ~60s. To configure this timeout, see
https://firebase.google.com/docs/functions/manage-functions#set_timeout_and_memory_allocation.
i Request to function failed: Error: socket hang up
i Your function timed out after ~60s.`

I have temporarily resolved this by:
- Not loading local environment variables with functions.config(), the metadata endpoint wasn't accessed.
- Editing _checkIsGCE() in google-auth-library to return false, tthe metadata endpoint wasn't accessed.

According to the comments, _checkGCE() determines whether the auth layer is running on Google Compute Engine. It calls gcpMetadata.getGCPResidency or gcpMetadata.isAvailable, which triggers the call to the endpoint, apparently ignoring METADATA_SERVER_DETECTION=none

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.