A couple of days ago my Google Cloud APIs started to return 403 error.
rpc error: code = PermissionDenied desc = unexpected HTTP status code received from server: 403 (Forbidden); transport: received unexpected content-type "text/html; charset=UTF-8"
I use Logging API and Vertex API with official Go clients.
The wired part is when I run it without Docker on the same server it works fine. Also when I run it on other server in Docker it also works fine.
I don’t know whats the problem in my current server.
I created minimal program to reproduce the bug:
package main
import (
"context"
"fmt"
"log"
"os"
"cloud.google.com/go/logging"
)
func main() {
projectID := os.Getenv("GOOGLE_LOGGING_PROJECT_ID")
logName := os.Getenv("GOOGLE_LOGGING_LOG_NAME")
ctx := context.Background()
client, err := logging.NewClient(ctx, projectID)
if err != nil {
log.Fatalf("Failed to create client: %v", err)
}
logInfo := client.Logger(logName)
err = logInfo.LogSync(ctx, logging.Entry{
Payload: "This is a test log message",
})
if err != nil {
log.Fatalf("Failed to log message: %v", err)
}
fmt.Println("Logged message to Google Cloud Logging")
}
and with sh file works fine:
#!/bin/sh
export GOOGLE_APPLICATION_CREDENTIALS=google-credentials.json
export GOOGLE_LOGGING_PROJECT_ID=summ-435417
export GOOGLE_LOGGING_LOG_NAME=main
./gce_log_test
but in Docker not
version: "3.8"
services:
gce-test:
image: golang:alpine
container_name: gce-test
environment:
- GOOGLE_APPLICATION_CREDENTIALS=/home/app/google-credentials.json
- GOOGLE_LOGGING_PROJECT_ID=summ-435417
- GOOGLE_LOGGING_LOG_NAME=main
volumes:
- /home/summ/gce-test:/home/app
working_dir: /home/app
command: ["./gce_log_test"]
2
Answers
It seems the issue with IPv6
error 403: Your client does not have permission to get URL in python google cloud module
https://www.googlecloudcommunity.com/gc/General-Misc-Q-A/How-do-I-unblock-my-server-s-IP/m-p/649978
Maybe your 403 error in docker could be due to incorrect permissions for your service account or issues with the environment variables not being set correctly. Try to double check that the service account has the ‘Logging Writer’ role and that the credentials file is properly mounted inside your docker container.