How to get gcloud auth activate-service-account persist

gcloudgoogle-bigquery

I am using the bq command line tool to query from a Bigquery table. Is there a way to get the service account authentication to persist when I logged in and out of the box that the query process is running on?

Steps I did:

I logged into the linux box

Authenticate service account by running:

gcloud auth activate-service-account --key-file /somekeyFile.p12 someServiceAccount.gserviceaccount.com

Query from bigquery table, this works fine:

bq --project_id=formal-cascade-571 query "select * from dw_test.clokTest"

But then I logged out from the box, and logged back in. When I query the Bigquery table again:

bq --project_id=formal-cascade-571 query "select * from dw_test.clokTest"

It gives me the error:

Your current active account [someServiceAccount.gserviceaccount.com] does not have any valid credentials.

Even when I pass in the private key file:

bq --service_account=someServiceAccount.gserviceaccount.com --service_account_credential_file=~/clok_cred.txt --service_account_private_key_file=/somekeyFile.p12 --project_id=formal-cascade-571 query "select * from dw_test.clokTest"

It gives the same error:

Your current active account [someServiceAccount.gserviceaccount.com] does not have any valid credentials.

So every time I need to re-authenticate my service account by:

gcloud auth activate-service-account

Is there a way to have the authenticated service account credential persist?

Thank you for your help.

Best Answer

I asked the GCloud devs and they mention a known bug where service accounts don't show up unless the environment variable CLOUDSDK_PYTHON_SITEPACKAGES is set.

Hopefully this will be fixed soon, but in the meantime, when you log in again, can you try running

export CLOUDSDK_PYTHON_SITEPACKAGES=1

and seeing if it then works?

You can run

gcloud auth list

to see what accounts there are credentials for; it should list your service account.

Related Solutions

Java.lang.RuntimeException: Failed to invoke public com.example.syncapp.MessageBase() with no args

From GSON User Guide:

While deserializing an Object, Gson needs to create a default instance of the class [...] Well-behaved classes that are meant for serialization and deserialization should have a no-argument constructor

Your problem is that GSON's Instance Creator needs a no-argument constructor in the class in which you want to deserialize the JSON response, namely MessageBase.

Otherwise, you need to write your own Instance Creator, like this.

Authenticate gcloud cli using both service account and user credentials

As you point out gcloud command line tool (CLI) does not use application default credentials. It has separate system for managing its own credentials.

GOOGLE_APPLICATION_CREDENTIALS are designed for client libraries to simplify wiring in credentials, and gcloud CLI is not a library. Even in the client code best practice is not to depend on this environment variable but instead explicitly provide credentials.

To answer your second question, user credentials can be obtained via

gcloud auth login

command. (NOTE this is different from gcloud auth application-default login) This besides saving actual credentials will also set account property in current configuration:

 gcloud config list

gcloud can have many configurations, each with different credentials. See

gcloud config configurations list

You can create multiple configurations, one with user account another with service account and use it simultaneously by providing --configuration parameter, for example

gcloud compute instances list --configuration MY_USER_ACCOUNT_CONFIG

Similarly you can also switch which credentials are used by using --account flag, in which case it will use same configuration and will only swap out the account.

Best Answer

Related Solutions

Java.lang.RuntimeException: Failed to invoke public com.example.syncapp.MessageBase() with no args

Authenticate gcloud cli using both service account and user credentials

Related Topic