<p>I am developing a Spring application that uses the Spring Google PubSub library (spring-cloud-gcp-starter-pubsub 1.1.4) which will be deployed in my GKE cluster.</p>

<p>As mentionned in <a href="https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform?hl=fr#step_4_import_credentials_as_a_secret" rel="nofollow noreferrer">this page</a>, I created a service account with the suitable rights on PubSub functionalities.</p>

<p>I created the secret with this command:</p>

<pre><code>kubectl create secret generic pub-sub-key --from-file ~/Documents/kubernetes/gke/service\ accounts/pub-sub/D-Vine-d36104130624.json
</code></pre>

<p>Here is the yaml file used to deploy my application :</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: d-vine-machine-dev
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: d-vine-machine-dev
        version: dev
    spec:
      volumes:
        - name: pub-sub-service-account
          secret:
            secretName: pub-sub-key
      containers:
        - name: d-vine-machine
          image: gcr.io/........:0.0.47
          imagePullPolicy: Always
          env:
            - name: SPRING_PROFILES_ACTIVE
              value: dev
            - name: GOOGLE_APPLICATION_CREDENTIALS
              value: /var/secrets/google/D-Vine-d36104130624.json
          volumeMounts:
            - name: pub-sub-service-account
              mountPath: /var/secrets/google
          ports:
            - containerPort: 8080
</code></pre>

<p>But my container ends up not finding the file:</p>

<pre><code>Caused by: java.io.FileNotFoundException: Could not open ServletContext resource [/var/secrets/google/D-Vine-d36104130624.json] 
at org.springframework.web.context.support.ServletContextResource.getInputStream(ServletContextResource.java:158) ~[spring-web-5.1.3.RELEASE.jar:5.1.3.RELEASE] 
at org.springframework.cloud.gcp.core.DefaultCredentialsProvider.&lt;init&gt;(DefaultCredentialsProvider.java:94) ~[spring-cloud-gcp-core-1.1.0.RC2.jar:1.1.0.RC2] 
at org.springframework.cloud.gcp.autoconfigure.core.GcpContextAutoConfiguration.googleCredentials(GcpContextAutoConfiguration.java:57) ~[spring-cloud-gcp-autoconfigure-1.1.0.RC2.jar:1.1.0.RC2] 
at org.springframework.cloud.gcp.autoconfigure.core.GcpContextAutoConfiguration$$EnhancerBySpringCGLIB$$16f5032c.CGLIB$googleCredentials$0(&lt;generated&gt;) ~[spring-cloud-gcp-autoconfigure-1.1.0.RC2.jar:1.1.0.RC2] 
at org.springframework.cloud.gcp.autoconfigure.core.GcpContextAutoConfiguration$$EnhancerBySpringCGLIB$$16f5032c$$FastClassBySpringCGLIB$$ce730653.invoke(&lt;generated&gt;) ~[spring-cloud-gcp-autoconfigure-1.1.0.RC2.jar:1.1.0.RC2] 
at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:244) ~[spring-core-5.1.3.RELEASE.jar:5.1.3.RELEASE] 
at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:363) ~[spring-context-5.1.4.RELEASE.jar:5.1.4.RELEASE] 
at org.springframework.cloud.gcp.autoconfigure.core.GcpContextAutoConfiguration$$EnhancerBySpringCGLIB$$16f5032c.googleCredentials(&lt;generated&gt;) ~[spring-cloud-gcp-autoconfigure-1.1.0.RC2.jar:1.1.0.RC2] 
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_232] 
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_232] 
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_232] at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_232] 
at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:154) ~[spring-beans-5.1.3.RELEASE.jar:5.1.3.RELEASE]
</code></pre>

<p>Out of curiosity, I've modified my Go application deployment just to check if the file was correctly retrieved. And it was... So it seems to be related to the Spring application and not the deployment.</p>

<p>My image is built using the jib maven plugin if that makes any difference.</p>

<p>Has anyone encountered this issue (or sees any mistake) ?</p>

Jean-Baptiste Piraux
<p>Your program is looking for <code>/var/run/secret/google/D-Vine-d36104130624.json</code></p>

<p>But you are mounting secrets at: <code>/var/secrets/google</code></p>

<p>Since this stack trace is in <a href="https://github.com/spring-cloud/spring-cloud-gcp/blob/07f6ec337169457dcb3ae2c7ebfd75f2debdd1ac/spring-cloud-gcp-core/src/main/java/org/springframework/cloud/gcp/core/DefaultCredentialsProvider.java#L94" rel="nofollow noreferrer">spring code</a> related to fetching based on a property, I suspect that there might be something incorrect in your spring configuration.  Is it possible your <a href="https://docs.spring.io/spring-cloud-gcp/docs/1.0.0.RELEASE/reference/htmlsingle/#_credentials" rel="nofollow noreferrer">spring configuration</a> lists the <code>/var/run</code> location as <code>spring.cloud.gcp.credentials.location</code>?  (If not, spring <em>should</em> fall back to the <code>GOOGLE_APPLICAITON_CREDENTIALS</code> location -- but that wouldn't result in this stack trace).</p>

<p>Assuming this is the case, you should update the spring configuration to point at the <code>/var/secrets</code> location (or, as the docs recommend, omit it to fall back to the environment variable).</p>

<p>Alternatively, I suspect moving the mount point (and changing the environment variable) to the <code>/var/run</code> location will resolve this.</p>
