Jx: GKE Cluster Create Fails

[ajsandham]

When running "jx create cluster gke" to create a fresh cluster on GKE the command ignores any pre-configured gcloud projects(which I don't think is expected behavior), but that aside does not provide an interactive prompt to insert the GKE authentication access key before erroring on authentication. I've tried this on two machines and can't seem to find the route cause.

The output is as follows:

Go to the following link in your browser:
https://accounts.google.com/o/oauth2/auth?redirect_uri=urn%3Aietf%3Awg%3Aoauth%3A2.0%3Aoob&prompt=select_account&response_type=code&client_id=32555940559.apps.googleusercontent.com&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fcloud-platform+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fappengine.admin+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fcompute+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Faccounts.reauth&access_type=offline

ERROR: There was a problem with web authentication.
ERROR: (gcloud.auth.login) EOF when reading a line
Enter verification code: Error: Command failed gcloud auth login --brief
error creating cluster exit status 1
error: exit status 1

This issue is occuring on a Centos 7, full version being: centos-release-7-4.1708.el7.centos.x86_64

More information can be provided on request.

[rawlingsj]

Have you tried opening that URL in a browser? The CLI is supposed to launch a browser so you can authenticate with Google and then the CLI continues. The error ERROR: (gcloud.auth.login) EOF when reading a line suggests something went wrong in opening up a browser, is one installed?

[ajsandham]

Firstly, thanks for the prompt reply.

So I'm running this from a CLI, but compared to say the gcloud init command there is no wait period to copy and past the URL into a separate browser in order to retrieve the code if that makes sense. All the output above appears in a split second, which means there's no opportunity to insert.

Should I look to do this from a full desktop install of Centos instead of just the base?

Thanks.

[jstrachan]

@ajsandham I wonder if authenticating with gcloud first on the CLI as you usually do helps; then use something like:

jx create cluster gke --skip-login=true --project-id my-project-name

[ajsandham]

Perfect, that did the trick and picked up my credentials in the background.

Just as a heads up, I had the default credentials setup for all API calls in the background as well. I imagine this would have to be the case if you want to document it anywhere.

Thanks

[michaelneale]

@ajsandham is there a way for that to be detected as an error condition and then prompted on command line? (or perhaps can just PR to the docs page for installation so people can find it in future?)

[ajsandham]

I don't know at the moment as I am new to the solution, I can look into it further though and I'll look around when I have the opportunity.

If I had to guess there should be either the --skip-login=true like above to use the configured gcloud environment and if it fails, then the end-user should be prompted for the environment access code through the URL generated.

One other thing that jumps into memory was that it was trying to use a browser to fetch URLs that wasn't in the base image from what I can gather. I'll see if I can reproduce that error though.

[jfyne]

I came across this error because I was running jx inside a headless VM. Usually I just open up those links manually in a browser and then paste in the code. Since this is a CLI tool is it a mistake to assume that a browser will be able to be opened?

[BrainCell23]

I am having this same problem trying to follow the terraform tutorial from the jenkins X site: https://jenkins-x.io/getting-started/tutorials/

I cannot run:

jx create terraform \
--gke-service-account \
~/tutorial.key.json

[jstrachan]

does using --headless help?

[ghost]

I am having this same problem trying to follow the terraform tutorial from the jenkins X site: https://jenkins-x.io/getting-started/tutorials/

I cannot run:

jx create terraform
--gke-service-account
~/tutorial.key.json

I am running into this issue as well. I am using the Google Cloud Shell. I think the --skip-login=true parameter is just missing there.

[BrainCell23]

Hi, I have tried using headless, but with no success.

`jx create gke-service-account --headless --skip-login --name tutorial
? Google Cloud Project: cloudjx
Unable to find service account tutorial, checking if we have enough permission to create
Creating service account tutorial
Assigning role roles/compute.instanceAdmin.v1
Assigning role roles/iam.serviceAccountActor
Assigning role roles/container.clusterAdmin
Assigning role roles/container.admin
Assigning role roles/container.developer
Assigning role roles/storage.objectAdmin
Assigning role roles/editor
Downloading service account key
Created service account key /home//tutorial.key.json
@cloudshell:~/jx-tutorial (cloudjx)$ jx create terraform --headless \

--gke-service-account \
~/tutorial.key.json

? Missing required dependencies, deselect to avoid auto installing: terraform, helm
Installing terraform
Downloading https://releases.hashicorp.com/terraform/0.11.11/terraform_0.11.11_linux_amd64.zip to /home//.jx/bin/terraform.zip...
Downloaded /home//.jx/bin/terraform.zip
Installing helm
Downloading https://storage.googleapis.com/kubernetes-helm/helm-v2.12.3-linux-amd64.tar.gz to /home//.jx/bin/helm.tgz...
Downloaded /home//.jx/bin/helm.tgz
Installing helm secrets plugin
Failed to retrieve team settings: failed to create the jx client: unable to load in-cluster configuration, KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT must be defined - falling back to default settings...

You are already authenticated with gcloud when running
inside the Cloud Shell and so do not need to run this
command. Do you wish to proceed anyway?
Do you want to continue (Y/n)?
Go to the following link in your browser:
https://accounts.google.com/o/oauth2/auth?redirect_uri=urn%3Aietf%3Awg%3Aoauth%3A2.0%3Aoob&prompt=select_account
&response_type=code&client_id=32555940559.apps.googleusercontent.com&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2
Fuserinfo.email+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fcloud-platform+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fa
ppengine.admin+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fcompute+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Faccounts.
reauth&access_type=offline
ERROR: There was a problem with web authentication.
ERROR: (gcloud.auth.login) EOF when reading a line
Enter verification code: Error: Command failed gcloud auth login --brief
error: exit status 1
@cloudshell:~/jx-tutorial (cloudjx)$`

[ccojocar]

@ajsandham I am going to close this issue. The original issue seems to be fixed in the meantime. Please feel free to open other issues for the other problems mentioned here. Thanks

[feczo]

I encountered the same issue today with the same workaround ( --skip-login=true)
when running 'jx create cluster gke —tekton'

CLI packages kubectl, git, helm seem to be setup correctly
NAME VERSION
jx 2.1.38
Kubernetes cluster v1.15.11-gke.13
kubectl v1.13.2
git 2.17.1