I'm getting gcloud/certificate_config.json: permission denied after updating to v0.178.0+, using NewAuthLibrary

[echarrod]

Description

google.golang.org/api v0.177.0 seems to work fine, but when I update to v0.178.0 and above, I get the following error:

error creating service: open /root/.config/gcloud/certificate_config.json: permission denied

when initialising an fcm service with:

svc, err := fcm.NewService(context.Background(), option.WithCredentialsFile(credentialsFile))

I'm guessing this is from the change in #2519 to use the new auth library:

What I've tried

1. Adding scopes:

option.WithScopes( 
			"https://www.googleapis.com/auth/devstorage.read_write",
			"https://www.googleapis.com/auth/cloud-identity.groups",
		))

2. Setting GOOGLE_API_USE_CLIENT_CERTIFICATE: true after reading this help article

Other Info

• We're running this from Kubernetes in a docker container
• And we don't have the gcloud cli available currently.

Any pointers would be much appreciated 🙏

[codyoss]

Thank you for the report. Just to confirm, did you test this with 0.187.0? I ask because I know that version had a fix in related to this auth flow.

cc @andyrzhao

[echarrod]

Thanks for the response @codyoss. Ah I think that wasn't released when I started investigating - we tried a few versions up to and including v0.186.0. We were using a credentials file though rather than an API Key, so not sure if that would have actually helped.

Just now I think we might have solved the issue though - I believe the problem arose with the default value of the certificate config being /root/.config/gcloud/certificate_config.json for our container. Upon investigation - we don't want to use the root user for security reason, and instead we use a different user, and so this is why we were getting permission denied.

I saw on https://github.com/googleapis/enterprise-certificate-proxy?tab=readme-ov-file#manual-certificate-configuration that setting the GOOGLE_API_CERTIFICATE_CONFIG to another value would override this, so I've set it to /home/myUser/.config/gcloud/certificate_config.json, and that seems to have worked.

I believe I can close the issue now, thanks though!

[codyoss]

Awesome glad you were able to figure it out!