Following the google cloud guide getting Cloud Run Admin API has not been used in project error

[celest solstice]

Following this guide https://docs.dagger.io/620941/github-google-cloud/ at the publish stage getting: 'Cloud Run Admin API has not been used in the project before or it is disabled" error Guide sets up Editor and Service account token creator roles for the service account, but doesn't seem to have enough. I tried even setting the Owner role to the service account but had the same issue. Gloud Run API is already enabled. I was able to create and deploy a dummy service earlier. Any ideas about what I might be missing? Thanks!

[weary star]

cc @ember wren 🙏

[ember wren]

Did you also do this? Repeat the previous two steps for the IAM Service Account Credentials API.

It seems to be a Google Cloud roles/credentials issue tbh, can you double-check that the roles created are set for the specific project you are using?

[celest solstice]

yes IAM Service Account Credentials API is also enabled,
yes part related to building goes just fine, so dagger is working as expected.

error logs suggest adding missing permissions prints a link, clicking the link takes me to a page which says;

Missing permissions:
resourcemanager.projects.get

[celest solstice]

spotted one interesting that error coming from
await gcrClient.updateService
has a different project number than mine
have no idea where it gets that project number
dagger publishes the image to correct project registry though

[celest solstice]

I tried setting up a fresh gcp project on a different computer, signed into gcloud init using a incognito browser window even.
getting the same error with the same wrong project id which I never configured

can it be some internal gcp project id somehow and the error is misleading? I'm out if ideas what to try

[ember wren]

Can you try adding the Project IAM Admin role as well to the service account? See https://cloud.google.com/resource-manager/docs/access-control-proj

[ember wren]

I'm not sure about this but it might be a red herring if the image is being published to the expected place anyway

[celest solstice]

image is published correctly yes, I can switch traffic to it on the gcp console manually
so this is not about dagger really.

but strange that gcp sdk command picks up a non existent project id

yes tried admin role to service account as well

[ember wren]

Is the image being published and also deployed to cloud run?

Or is the deploy part failing?

Do you want to hop in a Discord call? I can try to help debug it if you share your screen.

[celest solstice]

Would love to, thanks so much for ofering help. not available at the moment but I can make time whenever works for you. Would weekdays ok im on eastern european time zone

Image gets deployed to registry yes. But the gcp sdk command after fails so it can’t switch traffic to the new image.

[ember wren]

Weekdays are fine. @ me when you want to collab and we can go from there. Have a good weekend!

[celest solstice]

I think I figured it out,
https://cloud.google.com/docs/authentication/troubleshoot-adc

don't really know gcp well but there seems to be a concept called ADC, "application default credentials" and mine was somehow misconfigured I think.

running this
gcloud auth application-default set-quota-project YOUR_PROJECT
or this
gcloud auth application-default login
fixed it

still using the service account as you instructed in the tutorial.

unfortunately I didin't test which one of the commands fixed it, I ran them back to back then tried running my dagger script

also I deleted some old gcp projects before running this command. then saw this on stack overflow

"Note that there is a limit of about 10 projects that by default a given account can have. You might have to request an increase in quota through support if you need more than that. "

so my new project might have been missing some quota as well

so strange that gcp js client library error was misleading.

[ember wren]

Glad you got it working. Did you check if the Google ADC variable was properly configured on your local host before running the pipeline? It's discussed in Step 4 of the guide. The Google SDK needs those to run Gcloud operations.

The gcloud auth application-default login command would have set this up for you afaik, but you can also set it manually.