Incorrect use of google.CredentialsFromJSON?

[feliperyan]

google.CredentialsFromJSON is being called with the equivalent of

{
    "token": "some_token_value",
    "type": "authorized_user"
}

Although no error is returned, it's constructing an empty google.Credentials struct. I think this results on application default credentials always being called.

skaffold/pkg/skaffold/gcp/auth.go

Line 64 in e1f52f4

cmd := exec.Command("gcloud", "auth", "print-access-token", "--format=json")

[MarlonGamez]

hey @feliperyan , thanks for taking the time to open this. Do you have any more information into the issue here, e.g. debug logs/skaffold's output that's being caused by this issue?

[feliperyan]

Hey @marlon-gamez , using -vdebug I get:

NFO[0001] unable to retrieve token: oauth2: token expired and refresh token is not set  subtask=-1 task=DevLoop
INFO[0001] falling back to application default credentials  subtask=-1 task=DevLoop
DEBU[0001] project id set to fryan-secure-1              subtask=gcr.io/fryan-secure-1/cloudonar-deleteme task=Build
DEBU[0003] Running command: [tput colors]                subtask=-1 task=DevLoop
DEBU[0003] Command output: [256
]                        subtask=-1 task=DevLoop
creating bucket fryan-secure-1_cloudbuild in project fryan-secure-1 if not exists: googleapi: Error 400: User project specified in the request is invalid., invalid

I think the json value being passed to c, err := google.CredentialsFromJSON(context.Background(), body) on line 77 is not sufficient to create a valid google.Credentials struct.

Later when _, err = c.TokenSource.Token() is called, I believe it's always failing and falling back to ADC when it's later used at

skaffold/pkg/skaffold/build/gcb/cloud_build.go

Line 76 in e1f52f4

cbclient, err := cloudbuild.NewService(ctx, gcp.ClientOptions(ctx)...)

to create a new Cloud Build client

[feliperyan]

Hi @marlon-gamez I believe this issue is also causing #6743