0

I had previously authenticated with Google Cloud Platform and everything was working correctly, however all of a sudden, today I started receiving errors mentioning google-gax in a Node app:

2023-09-07T18:13:41: Error: 13 INTERNAL: Received RST_STREAM with code 0
2023-09-07T18:13:41:     at callErrorFromStatus (/path/to/app/node_modules/.pnpm/@[email protected]/node_modules/@grpc/grpc-js/build/src/call.js:31:19)
2023-09-07T18:13:41:     at Object.onReceiveStatus (/path/to/app/node_modules/.pnpm/@[email protected]/node_modules/@grpc/grpc-js/build/src/client.js:192:76)
2023-09-07T18:13:41:     at Object.onReceiveStatus (/path/to/app/node_modules/.pnpm/@[email protected]/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:360:141)
2023-09-07T18:13:41:     at Object.onReceiveStatus (/path/to/app/node_modules/.pnpm/@[email protected]/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:323:181)
2023-09-07T18:13:41:     at /path/to/app/node_modules/.pnpm/@[email protected]/node_modules/@grpc/grpc-js/build/src/resolving-call.js:94:78
2023-09-07T18:13:41:     at process.processTicksAndRejections (node:internal/process/task_queues:77:11)
2023-09-07T18:13:41: for call at
2023-09-07T18:13:41:     at ServiceClientImpl.makeUnaryRequest (/path/to/app/node_modules/.pnpm/@[email protected]/node_modules/@grpc/grpc-js/build/src/client.js:160:32)
2023-09-07T18:13:41:     at ServiceClientImpl.<anonymous> (/path/to/app/node_modules/.pnpm/@[email protected]/node_modules/@grpc/grpc-js/build/src/make-client.js:105:19)
2023-09-07T18:13:41:     at /path/to/app/node_modules/.pnpm/@[email protected]/node_modules/@google-cloud/kms/build/src/v1/key_management_service_client.js:241:29
2023-09-07T18:13:41:     at /path/to/app/node_modules/.pnpm/[email protected]/node_modules/google-gax/build/src/normalCalls/timeout.js:44:16
2023-09-07T18:13:41:     at repeat (/path/to/app/node_modules/.pnpm/[email protected]/node_modules/google-gax/build/src/normalCalls/retries.js:80:25)
2023-09-07T18:13:41:     at /path/to/app/node_modules/.pnpm/[email protected]/node_modules/google-gax/build/src/normalCalls/retries.js:118:13
2023-09-07T18:13:41:     at OngoingCallPromise.call (/path/to/app/node_modules/.pnpm/[email protected]/node_modules/google-gax/build/src/call.js:67:27)
2023-09-07T18:13:41:     at NormalApiCaller.call (/path/to/app/node_modules/.pnpm/[email protected]/node_modules/google-gax/build/src/normalCalls/normalApiCaller.js:34:19)
2023-09-07T18:13:41:     at /path/to/app/node_modules/.pnpm/[email protected]/node_modules/google-gax/build/src/createApiCall.js:84:30 {
2023-09-07T18:13:41:   code: 13,
2023-09-07T18:13:41:   details: 'Received RST_STREAM with code 0',
2023-09-07T18:13:41:   metadata: Metadata { internalRepr: Map(0) {}, options: {} },
2023-09-07T18:13:41:   note: 'Exception occurred in retry method that was not classified as transient'
2023-09-07T18:13:41: }

And executing gcloud auth list returned No credentialed accounts., so I assumed that somehow the auth got removed/expired.

I deleted my ~/.config/gcloud and tried to re-authenticate:

$ gcloud auth login
Go to the following link in your browser:

    https://accounts.google.com/o/oauth2/auth?response_type=code...

Enter authorization code: [...]

You are now logged in as [[email protected]].
Your current project is [None].  You can change this setting by running:
  $ gcloud config set project PROJECT_ID

So far, so good. It appears like I have been authenticated successfully:

$ gcloud auth list
    Credentialed Accounts
ACTIVE  ACCOUNT
*       [email protected]

To set the active account, run:
    $ gcloud config set account `ACCOUNT`

However, I am unable to list the projects:

$ gcloud projects list
ERROR: (gcloud.projects.list) HTTPError 403: <!DOCTYPE html>
<html lang=en>
  <meta charset=utf-8>
  <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">
  <title>Error 403 (Forbidden)!!1</title>
  <style>
    *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}
  </style>
  <a href=//www.google.com/><span id=logo aria-label=Google></span></a>
  <p><b>403.</b> <ins>That’s an error.</ins>
  <p>Your client does not have permission to get URL <code>/v1/projects</code> from this server.  <ins>That’s all we know.</ins>

If I manually set the project ID, it says:

$ gcloud config set project my_project_id
WARNING: You do not appear to have access to project [my_project_id] or it does not exist.
Are you sure you wish to set property [core/project] to my_project_id?

Do you want to continue (Y/n)?  y

Updated property [core/project].

If I choose y, I then get the following error in my Nodejs app:

Error: Could not load the default credentials. Browse to https://cloud.google.com/docs/authentication/getting-started for more information.

On a different computer, logging in with the same user and executing gcloud projects list works correctly:

$ gcloud projects list
PROJECT_ID                 NAME       PROJECT_NUMBER
aaa                        aaa        123456789012
bbb                        bbb        123456789012
ccc                        ccc        123456789012
ddd                        ddd        123456789012
eee                        eee        123456789012
fff                        fff        123456789012
ggg                        ggg        123456789012
hhh                        hhh        123456789012

Edit:

I have also tried the following:

  • Updating gcloud to latest version
  • Creating a fresh user
  • Disabling firewall
  • Disabling apparmor
Improve this question
2
  • we are in the same situation. What have you done to fix the issue?
    – Raphael Theriault
    Oct 11 at 20:06
  • @RaphaelTheriault In my case, my IP was blacklisted by Google, so I needed to change the server's IP. If that is not the case, you will need to try something else.
    – Mike
    Oct 12 at 16:14

2 Answers 2

Reset to default
1

If you try to access an API endpoint that isn't supported by the Restricted VIP, then you will get a 403 Forbidden error.

The response content for blocked VIP is a distinct HTML formatted error then the issue is a Restricted VIP integration issue.

The IP address range for restricted.googleapis.com and private.googleapis.com are 199.36.153.4/30 and 199.36.153.8/30 respectively. Restricted Google APIs should only be used for Services supported by the restricted VIP.

If restricted.googleapis.com are being used, you can use DNS configuration as a solution , depending on your needs, either update DNS CNAME record for www.googleapis.com to private.googleapis.com where private.googleapis.com is 199.36.153.8/30 and ensure Private Google API Access is enabled for the Subnet or if the VM has External IP Default domains can be used as well.

Improve this answer
1
  • Thank you for your answer. However, I wasn't using a blocked VIP. The problem was that my server's IP was being blocked by Google, as I mentioned in my answer.
    – Mike
    Sep 8 at 21:09
0

It looks like the problem is that my server's IP somehow got blocked from Google Cloud. I tried to download https://packages.cloud.google.com/apt/doc/apt-key.gpg and it produces a 403 status with the following output:

<!DOCTYPE html>
<html lang=en>
  <meta charset=utf-8>
  <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">
  <title>Error 403 (Forbidden)!!1</title>
  <style>
    *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}
  </style>
  <a href=//www.google.com/><span id=logo aria-label=Google></span></a>
  <p><b>403.</b> <ins>That’s an error.</ins>
  <p>Your client does not have permission to get URL <code>/apt/doc/apt-key.gpg</code> from this server.  <ins>That’s all we know.</ins>
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .