googleapis / googleapis/google-cloud-node

secret-manager v6 + google-auth-library v10 + gaxios v7: Could not refresh access token in Cloud Build

Open
#8,354 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
3.2k
Forks
712
Avg merge
2d 3h
Merged PRs (30d)
99

Description

## Library Name

`google-auth-library`

## Environment

- **@google-cloud/secret-manager**: v6.1.2
- **google-gax**: v5.0.6
- **google-auth-library**: v10.6.2
- **gaxios**: v7.1.4 (uses node-fetch v3.3.2)
- **Node.js**: 20
- **Runtime**: Google Cloud Build with custom service account
- **Container image**: Custom Node 20 Docker image

## Description

After upgrading `@google-cloud/secret-manager` from v5 to v6, we get the following error when `SecretManagerServiceClient` attempts to access the GCE metadata server for token refresh inside a Cloud Build step:

```
2 UNKNOWN: Getting metadata from plugin failed with error: Could not refresh access token: Unexpected Gaxios Error
at callErrorFromStatus (node_modules/@grpc/grpc-js/src/call.ts:84:17)
at Object.onReceiveStatus (node_modules/@grpc/grpc-js/src/client.ts:360:55)
...
at node_modules/@google-cloud/secret-manager/build/src/v1/secret_manager_service_client.js:227:29
at node_modules/google-gax/build/src/normalCalls/timeout.js:44:16
at repeat (node_modules/google-gax/build/src/normalCalls/retries.js:114:25)
```

The key difference between the working (v5) and broken (v6) dependency chains:

- **v5 (works):** secret-manager → google-gax v4 → google-auth-library v9 → gaxios v6 → node-fetch **v2**
- **v6 (fails):** secret-manager → google-gax v5 → google-auth-library v10 → gaxios v7 → node-fetch **v3**

This is related to the previously reported #6276, which was closed without resolution.

## Workaround

Pinning `@google-cloud/secret-manager` to v5 (which pulls google-gax v4 → google-auth-library v9 → gaxios v6 → node-fetch v2) resolves the issue.

## Expected behavior

`google-auth-library` v10 should be able to reach the GCE metadata server and refresh tokens in Cloud Build environments, just as v9 does.

## Hypothesis

The core issue seems to be:

```
TypeError: A dynamic import callback was invoked without --experimental-vm-modules
Cause:
...
at Function.#getFetch (node_modules/gcp-metadata/node_modules/gaxios/src/gaxios.ts:675:10)
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.