Why does my Cloud Run Node.js app fail to find the gcloud CLI when activating a service account?

When running on Cloud Run, the gcloud CLI isn’t installed in your container by default. Instead of trying to execute gcloud commands within your application, the recommended approach is to use one of the Google Cloud client libraries (such as the google-auth-library for Node.js) to obtain access tokens and interact with Google Cloud services.

Below is an example of how you can obtain an access token using the google-auth-library:

JSCopied
const { GoogleAuth } = require('google-auth-library');

async function getAccessToken() {
  // Initialize Google Auth with the required scopes.
  const auth = new GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  });

  // Get the client, which by default takes advantage of the Cloud Run service account credentials.
  const client = await auth.getClient();

  // Retrieve the access token.
  const tokenResponse = await client.getAccessToken();
  console.log('Access token:', tokenResponse.token);
}

getAccessToken().catch(err => {
  console.error('Error retrieving access token:', err);
});

Recommendations

• Leverage Cloud Run Service Identity:
  When you deploy your service, specify the service account (or rely on the default) so that Cloud Run automatically provides the credentials. This means you won’t need to activate credentials manually inside your container.

• Avoid Hard-Coding Keys:
  Instead of using service account key files (/src/keys.json), it’s generally more secure and easier to manage credentials by allowing Cloud Run to provide them via its built-in authentication.

• Local vs. Production:
  For local development, you might still use the gcloud CLI to authenticate (for example, with gcloud auth application-default login). However, in production on Cloud Run, the recommended approach is to use the credentials made available by the environment and configured service account.

By relying on the client libraries, you eliminate the need for the gcloud CLI and can safely obtain tokens as needed in a production environment.