<p>I'm trying to report Node.js errors to Google Error Reporting, from one of our kubernetes deployments running on a GCP/GKE cluster with RBAC. (i.e. permissions defined in a service account associated to the cluster)</p>

<pre><code>const googleCloud = require('@google-cloud/error-reporting');
const googleCloudErrorReporting = new googleCloud.ErrorReporting();
googleCloudErrorReporting.report('[test] dummy error message');
</code></pre>

<p>This works only in certain environments:</p>

<ul>
<li>it works when run on my laptop, using a service account that has the "Errors Writer" role</li>
<li>it works when running in my cluster as a K8S job, after having added the "Errors Writer" role to that cluster's service account</li>
<li>it causes the following error when called from my Node.js application running in one of my K8S deployments:</li>
</ul>

<blockquote>
  <p>ERROR:@google-cloud/error-reporting: Encountered an error while attempting to transmit an error to the Stackdriver Error Reporting API.</p>
  
  <p>Error: Request had insufficient authentication scopes.</p>
</blockquote>

<p>It feels like the job did pick up the permission changes of the cluster's service account, whereas my deployment did not.</p>

<p>I did try to re-create the deployment to make it refresh its auth token, but the error is still happening... </p>

<p>Any ideas?</p>

<blockquote>
  <p><strong>UPDATE</strong>: I ended up following <a href="https://twitter.com/kamidude/status/1053175875519295488" rel="nofollow noreferrer">Jérémie Girault's suggestion</a>: create a service account and bind it to my deployment. It works!</p>
</blockquote>

Adrien Joly
<p>The error message has to do with the access scopes set on the cluster when using the default service account. You must enable access to the appropriate API.</p>

<p>As you mentioned, creating a separate service account, providing it the appropriate IAM permissions and linking it to your cluster or workload will bypass this error as well.</p>
