Access Firestore from Google Functions - Getting metadata from plugin failed with error: Could not refresh access token

Question

I am deploying a google function that does some server computation and writes results in the Firestore DB in the same project.

I follow the how-tos and configure the function by

const functions = require('firebase-functions');
const admin = require('firebase-admin');
admin.initializeApp();

and access the Firestore db by using:

admin.firestore().collection('COLLECTION_NAME').add({data: value});

The IAM user...@gcf-admin-robot.iam.gserviceaccount.com has the role of the Google Cloud Functions Service Agent assigned.

I get the following error:

Error: 500 undefined: Getting metadata from plugin failed with error: Could not refresh access token: Unsuccessful response status code. Request failed with status code 500
     at Object.callErrorFromStatus (/workspace/node_modules/@grpc/grpc-js/build/src/call.js:30:26)
     at Object.onReceiveStatus (/workspace/node_modules/@grpc/grpc-js/build/src/client.js:175:52)
     at Object.onReceiveStatus (/workspace/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:341:141)
     at Object.onReceiveStatus (/workspace/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:304:181)
     at Http2CallStream.outputStatus (/workspace/node_modules/@grpc/grpc-js/build/src/call-stream.js:116:74)
     at Http2CallStream.maybeOutputStatus (/workspace/node_modules/@grpc/grpc-js/build/src/call-stream.js:155:22)
     at Http2CallStream.endCall (/workspace/node_modules/@grpc/grpc-js/build/src/call-stream.js:141:18)
     at Http2CallStream.cancelWithStatus (/workspace/node_modules/@grpc/grpc-js/build/src/call-stream.js:457:14)
     at callStream.filterStack.sendMetadata.then (/workspace/node_modules/@grpc/grpc-js/build/src/channel.js:225:36)
     at process._tickCallback (internal/process/next_tick.js:68:7)
 Caused by: Error
     at WriteBatch.commit (/workspace/node_modules/@google-cloud/firestore/build/src/write-batch.js:415:23)
     at DocumentReference.create (/workspace/node_modules/@google-cloud/firestore/build/src/reference.js:283:14)
     at CollectionReference.add (/workspace/node_modules/@google-cloud/firestore/build/src/reference.js:2011:28)
     at exports.parseProduct.functions.region.https.onRequest (/workspace/index.js:55:56)
     at process._tickCallback (internal/process/next_tick.js:68:7)
   code: '500',
   details:
    'Getting metadata from plugin failed with error: Could not refresh access token: Unsuccessful response status code. Request failed with status 
   metadata: Metadata { internalRepr: Map {}, options: {} },
   note:
    'Exception occurred in retry method that was not classified as transient'

What am I doing wrong?

Answer 1

For anyone seeing the above error message. It is connected (at least in this case) to permissions of service accounts. I was adjusting some permissions and deactivated some accounts that I thought I would not need.

Among them was "projectname"@appspot.gserviceaccount.com Reactivating it solved my problem.

It would be really good, if Google would show more meaningful error messages in such cases!

Answer 2

It seems to be an internal issue rather than maybe something you're doing. Making a quick search I found a very similar issue in GitHub and SO . From those links, I noticed that it was more about a library and I would suggest to reach Firebase Support since they can check the internals of the environment since it is possible some strange magic could be happening behind the scenes.