Default Credentials fail under GKE/Workload Identity #1396
Description
Environment details
- Auth Oauth2
- OS type and version: linux container in GKE with workload identity configured on the pod service account
- Java version: 7/8
- google-api-client version(s): latest
Steps to reproduce
- Invoke the application default credential
Code example
GoogleCredential credential = GoogleCredential.getApplicationDefault();Stack trace
WARNING: Failed to detect whether we are running on Google Compute Engine.
com.google.api.client.http.HttpResponseException: 403 Forbidden
GKE Metadata Server encountered an error: Missing required header "Metadata-Flavor": "Google"
at com.google.api.client.http.HttpRequest.execute(HttpRequest.java:1070)
at com.google.api.client.googleapis.auth.oauth2.OAuth2Utils.runningOnComputeEngine(OAuth2Utils.java:86)