Skip to content

GRPC+ALTS client connection exception with Workload Identity #9058

@wjohnst3

Description

@wjohnst3

What version of gRPC-Java are you using?

I am using the Google BOM in Maven.

            <dependency>
                <groupId>com.google.cloud</groupId>
                <artifactId>libraries-bom</artifactId>
                <version>25.1.0</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>

This contains GRPC 1.45.0

What is your environment?

Docker container running as GKE on GCP. Image from google/cloud-sdk:latest. Java 17.
Google Endpoints is on the classpath running in Jetty, fyi. Worth mentioning GCP is using
Workload Identity, so the service account is annotated so as to be managed by Google.

What did you expect to see?

I am testing the use of GRPC+ALTS for use in connecting an old service to another service. I would expect to see the call hit the server and return a result. I will add that if I use an unsecured ManagedChannelBuilder then the call works fine.

client (example):

 var channel =  AltsChannelBuilder.forAddress("my-service", 6565).addTargetServiceAccount("expected-service-account") .build();
 var myService = MyServiceGrpc.newBlockingStub(channel);
 var result = myService.getValue(MyServiceInput.newBuilder().setKey("key").build());

What did you see instead?

I see an "unknown" exception thrown by the client, "io.grpc.StatusRuntimeException: UNKNOWN: Channel Pipeline: [TsiHandshakeHandler#0, WriteBufferingAndExceptionHandler#0, DefaultChannelPipeline$TailContext#0]"

I spoke with "Eric Anderson" on Gitter. He suggested I file this as an issue.

Steps to reproduce the bug

Error:
"io.grpc.StatusRuntimeException: UNKNOWN: Channel Pipeline: [TsiHandshakeHandler#0, WriteBufferingAndExceptionHandler#0, DefaultChannelPipeline$TailContext#0]"

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions