尝试访问部署在 GKE 中的 Spring 中的 API 时出现 UNAUTHENTICATED 错误

Question

I have an API application deployed in Google Kube.netes Engine. The application is using firestore as its DB. When I try to call the API (both from Postman and browser), I got HTTP error 500. This is what it says in the log:

io.grpc.StatusRuntimeException: UNAUTHENTICATED: Request had invalid authentication 
credentials. Expected OAuth 2 access token, login cookie or other valid 
authentication credential. See https://developers.google.com/identity/sign- 
in/web/devconsole-project. at io.grpc.Status.asRuntimeException(Status.java:533) ~[grpc-
api-1.30.2.jar!/:1.30.2] at 
io.grpc.stub.ClientCalls$StreamObserverToCallListenerAdapter.onClose(ClientCalls.java:460
) ~[grpc-stub-1.30.2.jar!/:1.30.2] at 
io.grpc.internal.ClientCallImpl.closeObserver(ClientCallImpl.java:426) ~[grpc-core-
1.30.2.jar!/:1.30.2] at 
io.grpc.internal.ClientCallImpl.access$500(ClientCallImpl.java:66) ~[grpc-core-
1.30.2.jar!/:1.30.2] at 
io.grpc.internal.ClientCallImpl$ClientStreamListenerImpl.close(ClientCallImpl.java:689) ~
[grpc-core-1.30.2.jar!/:1.30.2] at 
io.grpc.internal.ClientCallImpl$ClientStreamListenerImpl.access$900(ClientCallImpl.java:5
77) ~[grpc-core-1.30.2.jar!/:1.30.2] at 
io.grpc.internal.ClientCallImpl$ClientStreamListenerImpl$1StreamClosed.runInternal(Client
CallImpl.java:751) ~[grpc-core-1.30.2.jar!/:1.30.2] at 
io.grpc.internal.ClientCallImpl$ClientStreamListenerImpl$1StreamClosed.runInContext(Clien
tCallImpl.java:740) ~[grpc-core-1.30.2.jar!/:1.30.2] at 
io.grpc.internal.ContextRunnable.run(ContextRunnable.java:37) ~[grpc-core-
1.30.2.jar!/:1.30.2] at 
io.grpc.internal.SerializingExecutor.run(SerializingExecutor.java:123) ~[grpc-core-
1.30.2.jar!/:1.30.2] at 
java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) 
~[na:na] at 
java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) 
~[na:na] at java.base/java.lang.Thread.run(Thread.java:829) ~[na:na]

This is how roughly my Spring application looks like:

MainApplication

@SpringBootApplication(scanBasePackages = { "package.name.here" })
@EnableReactiveFirestoreRepositories
public class UserApplication {

    public static void main(String[] args) {
        SpringApplication.run(UserApplication.class, args);
    }

}

RestController

@RestController
@RequestMapping("/users")
public class UserAPI {
    @Autowired
    UserService userService;

    @GetMapping("/all")
    public Flux<UserService> getAllUsers() {
        return userService.findAll();
    }
}

UserService

@Component
public class UserService {
    @Autowired
    UserRepository userRepository;

    public Flux<User> findAll() {
        return userRepository.findAll();
    }
}

UserRepository

public interface UserRepository extends FirestoreReactiveRepository<User> {
    Mono<User> findByUsername(String username);
    Mono<User> findByEmail(String email);
}

I have configured Postman Authorisation as guided here from the official documentation but it still gives the error above.

I'm using my google account, which is the owner of the project when requesting for access token on Postman.

Could anyone help me with this?

Thank you in advance.

Answer 1

When you run code on Google Cloud Platform, it needs to auth as an identity.

It is recommended that you use a Service Account as the identity for software.

The account will need to be configured with suitable IAM permissions. For example, to read from Firestore, the Service Account will neeed roles/datastore.viewer .

NOTE For historical reasons, Firestore IAM roles include the prefix datastore . This is because Cloud Datastore is one of Google Cloud Platform's original services and its functionality was expanded to include the functionality that Cloud Firestore provides.

In the case of Kube.netes Engine (GKE) , an extra step is needed to expose the (Cloud Platform Service Account) identity so that it is accessible to the Pods in the cluster.

There are 2 ways you can do this:

1. Mount GCP Service Account key as a Kube.netes Secret in a Pod. This approach will work across any Kube.netes distribution. See Authenticating to Google Cloud with Service Accounts
2. Google provides a more elegant albeit Google-only solution too that may better serve your needs called Workload Identity .