Open Ark-kun opened 3 years ago
Hi, I don't think this is an issue specific to the JS client. Did you try contacting GKE support for help with this issue?
I don't think this is an issue specific to the JS client.
Are you sure? The difference is in the token that gapi generates.
I suspect that the token generated by gapi is somehow tied to the project which contains clientId
and API_KEY
instead of a token associated with the authenticated user.
What do you think about my suspicion?
Is there a way to make gapi generate a token for the authenticated user? Similar to gcloud auth print-access-token
high-level scenario: I want to call Kubernetes APIs: list clusters in user's project.
I can do that successfully using the API explorer. However when I do it myself in Javascript using
gapi
, I receive error 403. I've verified that the URL thatgapi
calls is correct, but the auth token causes the issue. For some reason the server complains about the API not being available in a different project (the project where Client ID was created).I've verified the behavior using the command line:
The following command works correctly
However when I replace the token with the one obtained by
gapi
, I get the same error as before (notice that the URL is the same - only token is different)I've also tried the API explorer: https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.clusters/list It was able to call the API successfully. It accessed the same URL, just with a different token and got results successfully.
To sum it up:
What do I need to change in my code to make it work (to make it generate/use correct access token)?
My code:
Error (403):
As you see, the error complains about the
<OTHER PROJECT>
, nottarget-project
(where the billing is enabled).