Google-cloud-go: pubsub: Unauthenticated error

[dragan-cikic-shortcut]

Client

PubSub

Describe Your Environment

Cloud function

Expected Behavior

Message published to the topic

Actual Behavior

Getting error:

rpc error: code = Unauthenticated desc = transport: compute: Received 500 `Could not fetch URI /computeMetadata/v1/instance/service-accounts/default/token?scopes=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fcloud-platform%2Chttps%3A%2F%2Fwww.googleapis.com%2Fauth%2Fpubsub

I used this code to test:

package testfcn

import (
    "log"
    "net/http"

    "cloud.google.com/go/pubsub"
)

func TestFcn(w http.ResponseWriter, r *http.Request) {

    ctx := r.Context()

    client, err := pubsub.NewClient(ctx, "min-fotball-staging")
    if err != nil {
        log.Print(err)
        return
    }

    topic := client.Topic("TestTopic")

    result := topic.Publish(ctx, &pubsub.Message{
        Data: []byte("TestMessage"),
    })

    _, err = result.Get(ctx)
    if err != nil {
        log.Print(err)
        return
    }
}

Having made topic named _TestTopic_ manually on platform.
It brakes on line _, err = result.Get(ctx).

[hongalex]

Thanks for filing this issue. Can you tell me what your invocation trigger is (http, pubsub, storage, etc)? And if it's HTTP, can you mention which service is hitting that endpoint?

Edit: in addition, can you check which permissions your Cloud Functions service account has? The default service account used is [email protected], but not sure if you changed it.

[dragan-cikic-shortcut]

The cloud function is triggered by HTTP request.
I'm hitting it by Postman.
The cloud function is using a default service account having a _Owner_ role. Also, our Cloud Architect @pkhamre and I tested it with a dedicated service account having just _Pub/Sub Publisher_ role and we got the same error.

[hongalex]

I was talking to my colleague who was answering your stack overflow question. I was able to reproduce the issue (and see the same error message), when the Cloud Functions Service Agent does not have the proper permissions. From the linked stack overflow post, this can be fixed by adding the proper role to [e-mail] using gcloud when authenticated.

gcloud projects add-iam-policy-binding <project_name> --role=roles/cloudfunctions.serviceAgent --member=serviceAccount:service-<project_number>@gcf-admin-robot.iam.gserviceaccount.com

Closing for now since this likely isn't related to the client library, but I'll continue to monitor from the stack overflow side in case it doesn't work.