Can't get GCP working

[mikefarwell]

I simply cannot figure out how to get GCP to work. I keep getting an authentication error and I don't know what's causing it. I can't find anything wrong with my configuration and it is being read in properly.

The credentials in the config file are pasted straight from the file provided by Google for my service account.

The service account is a DNS Administrator and has full read/write access to all DNS resources. For testing purposes, I even made the service account a member of the Owner role group to give it access to everything, in case a permission I wasn't expecting was needed and that didn't work either.

My docker compose file is below, followed by my redacted debug log, including the settings read in from the config file.

Could anyone point me towards what I'm missing?

docker-compose.yml:

version: '3.3'

services:
  ddns:
    image: qmcgaw/ddns-updater
    environment:
      - LOG_LEVEL=debug
      - TZ=America/Chicago
    ports:
       - 8000:8000/tcp
    volumes:
      - /dockervolumes/ddns/data:/updater/data

Debug log:

========================================
========================================
============= ddns-updater =============
========================================
=========== Made with ❤️ by ============
======= https://github.com/qdm12 =======
========================================
========================================

Running version latest built on 2022-11-03T09:49:13Z (commit d8de9d2)

🔧 Need help? https://github.com/qdm12/ddns-updater/discussions/new
🐛 Bug? https://github.com/qdm12/ddns-updater/issues/new
✨ New feature? https://github.com/qdm12/ddns-updater/issues/new
☕ Discussion? https://github.com/qdm12/ddns-updater/discussions/new
💻 Email? [email protected]
💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12
2022/11/17 12:30:42 INFO reading JSON config from file /updater/data/config.json
2022/11/17 12:30:42 DEBUG config read: {
  "settings": [
    {
      "provider": "gcp",
      "project": "<redacted>",
      "zone": "<redacted>",
      "credentials": {
        "type": "service_account",
        "project_id": "<redacted>",
        "private_key_id": "<redacted>",
        "private_key": "-----BEGIN PRIVATE KEY-----<redacted>-----END PRIVATE KEY-----\n",
        "client_email": "<redacted>.iam.gserviceaccount.com",
        "client_id": "<redacted>",
        "auth_uri": "https://accounts.google.com/o/oauth2/auth",
        "token_uri": "https://oauth2.googleapis.com/token",
        "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
        "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/<redacted>.iam.gserviceaccount.com"
      },
      "domain": "<redacted>",
      "host": "@,*",
      "ip_version": "ipv4"
    }
  ]
}
2022/11/17 12:30:42 INFO Found 2 settings to update records
2022/11/17 12:30:43 INFO Reading history from database: domain <redacted> host @
2022/11/17 12:30:43 INFO Reading history from database: domain <redacted> host *
2022/11/17 12:30:43 DEBUG configured to fetch IP: v4 or v6: false, v4: true, v6: false
2022/11/17 12:30:43 INFO healthcheck server: listening on 127.0.0.1:9999
2022/11/17 12:30:43 INFO backup: disabled
2022/11/17 12:30:43 INFO http server: listening on :8000
2022/11/17 12:30:43 DEBUG your public IP address are: v4 or v6: <nil>, v4: <redacted>, v6: <nil>
2022/11/17 12:30:43 INFO IPv4 address of <redacted> is <redacted> and your IPv4 address is <redacted>
2022/11/17 12:30:43 INFO IPv4 address of any.<redacted> is <redacted> and your IPv4 address is <redacted>
2022/11/17 12:30:44 INFO Updating record [domain: <redacted> | host: @ | provider: gcp | ip: ipv4] to use <redacted>
2022/11/17 12:30:44 DEBUG GET https://dns.googleapis.com/dns/v1/projects/<redacted>/managedZones/<redacted>/rrsets/%40.<redacted>./A?alt=json&prettyPrint=false | headers: X-Goog-Api-Client: gl-go/1.19.3 gdcl/0.96.0; User-Agent: google-api-go-client/0.5
2022/11/17 12:30:44 DEBUG 401 Unauthorized | headers: Content-Type: application/json; charset=UTF-8; Server: ESF; Www-Authenticate: Bearer realm="https://accounts.google.com/"; Vary: Origin,X-Origin,Referer; X-Frame-Options: SAMEORIGIN; Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"; Cache-Control: private; X-Xss-Protection: 0; Date: Thu, 17 Nov 2022 18:30:44 GMT; X-Content-Type-Options: nosniff | body: { "error": { "code": 401, "message": "Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.", "errors": [  {  "message": "Login Required.",  "domain": "global",  "reason": "required",  "location": "Authorization",  "locationType": "header"  } ], "status": "UNAUTHENTICATED", "details": [  {  "@type": "type.googleapis.com/google.rpc.ErrorInfo",  "reason": "CREDENTIALS_MISSING",  "domain": "googleapis.com",  "metadata": {   "method": "cloud.dns.api.v1.ResourceRecordSetsService.Get",   "service": "dns.googleapis.com"  }  } ] }}
2022/11/17 12:30:44 ERROR getting record resource set: googleapi: Error 401: Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.
Details:
[
  {
    "@type": "type.googleapis.com/google.rpc.ErrorInfo",
    "domain": "googleapis.com",
    "metadata": {
      "method": "cloud.dns.api.v1.ResourceRecordSetsService.Get",
      "service": "dns.googleapis.com"
    },
    "reason": "CREDENTIALS_MISSING"
  }
]

More details:
Reason: required, Message: Login Required.
2022/11/17 12:30:44 INFO Updating record [domain: <redacted> | host: * | provider: gcp | ip: ipv4] to use <redacted>
2022/11/17 12:30:44 DEBUG GET https://dns.googleapis.com/dns/v1/projects/<redacted>/managedZones/<redacted>/rrsets/%2A.<redacted>./A?alt=json&prettyPrint=false | headers: X-Goog-Api-Client: gl-go/1.19.3 gdcl/0.96.0; User-Agent: google-api-go-client/0.5
2022/11/17 12:30:44 DEBUG 401 Unauthorized | headers: Content-Type: application/json; charset=UTF-8; Cache-Control: private; X-Content-Type-Options: nosniff; Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"; Www-Authenticate: Bearer realm="https://accounts.google.com/"; Vary: Origin,X-Origin,Referer; Server: ESF; X-Xss-Protection: 0; Date: Thu, 17 Nov 2022 18:30:44 GMT; X-Frame-Options: SAMEORIGIN | body: { "error": { "code": 401, "message": "Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.", "errors": [  {  "message": "Login Required.",  "domain": "global",  "reason": "required",  "location": "Authorization",  "locationType": "header"  } ], "status": "UNAUTHENTICATED", "details": [  {  "@type": "type.googleapis.com/google.rpc.ErrorInfo",  "reason": "CREDENTIALS_MISSING",  "domain": "googleapis.com",  "metadata": {   "service": "dns.googleapis.com",   "method": "cloud.dns.api.v1.ResourceRecordSetsService.Get"  }  } ] }}
2022/11/17 12:30:44 ERROR getting record resource set: googleapi: Error 401: Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.
Details:
[
  {
    "@type": "type.googleapis.com/google.rpc.ErrorInfo",
    "domain": "googleapis.com",
    "metadata": {
      "method": "cloud.dns.api.v1.ResourceRecordSetsService.Get",
      "service": "dns.googleapis.com"
    },
    "reason": "CREDENTIALS_MISSING"
  }
]

More details:
Reason: required, Message: Login Required.

[qdm12]

Sorry that was a BUG, which should be fixed in the latest version (repull the latest image). Please let me know if it works if you have time to try it, thanks!

[mikefarwell]

Thank you for the update, but unfortunately, Google stopped supporting my domain, so I had to switch to Cloudflare and I no longer have any way to test it. It's working great with Cloudflare, though. 😁

[qdm12]

No worry, thanks for letting me know 👍