We are using a Jenkins project to run "gcloud logging read ..." from a shell to get logs from a gcloud container and we occasionally see a permission error in the script:
ERROR: (gcloud.logging.read) PERMISSION_DENIED: Request had insufficient authentication scopes.
Our Jenkins servers runs as a Google Kubernetes Engine.
I did not find anything specific for authentication using Kubernetes Engine and I assumed that it is like a Google Cloud for which https://cloud.google.com/storage/docs/authentication#libauth says that, for authentication,
the environment already provides a service account's authentication information, so no further setup is required
Maybe my assumption is wrong? I assumed it because it often works.
When it works, gcloud info
returns the expected user while when it does not work it reports the default service account.
Does anybody know why the user changes between project's builds and how it could be avoided?
Other observation:
- Modifying the shell script for the project in Jenkins seems to fix the problem for a while.
Thanks!