Stackdriver Spring Boot valid key missing

0
votes

I am setting up a spring boot application where the logs are sent to google cloud stackdriver. I am using the logback appender for Stackdriver Logging and the logback file from their documentation https://cloud.google.com/logging/docs/setup/java.

I added GOOGLE_CLOUD_PROJECT and GOOGLE_APPLICATION_CREDENTIALS in Intellij to the environment variables. Further, I set them as environment variables in windows as well. When I start the application I always get: PERMISSION_DENIED: The request is missing a valid API key.

I installed the gcloud and there I can use the cred file as a service account with admin permissions to write and read logs. So the file should work as well as the permissions.

I tried to set the key as an environment variable as well but that didn't help either. What am I missing that it doesn't work?

2
javaspringgoogle-cloud-stackdrivergoogle-cloud-logging

2 Answers

2
votes

I added GOOGLE_CLOUD_PROJECT and GOOGLE_APPLICATION_CREDENTIALS in Intellij to the environment variables.

Are you sure the environment variables are being picked up from IntelliJ? Did you cross check if environment variables are set using CLI?

If you are using spring-cloud-gcp-starter-logging library for Stackdriver integration, then setting environment variables should work fine.

From docs:

Due to the way logging is set up, the GCP project ID and credentials defined in application.properties are ignored.

Instead, you should set the GOOGLE_CLOUD_PROJECT and GOOGLE_APPLICATION_CREDENTIALS environment variables to the project ID and credentials private key location, respectively. You can do this easily if you’re using the Google Cloud SDK, using the gcloud config set project [YOUR_PROJECT_ID] and gcloud auth application-default login commands, respectively.

To make Spring Boot application work with Stackdriver logging, you can set GOOGLE_CLOUD_PROJECT and GOOGLE_APPLICATION_CREDENTIALS environment variables as:

export GOOGLE_CLOUD_PROJECT=`gcloud config get-value core.project`
export GOOGLE_APPLICATION_CREDENTIALS=`gcloud auth application-default login`

I installed the gcloud and there I can use the cred file as a service account with admin permissions to write and read logs.

You should not use admin permissions. You should use a service account with roles/logging.logWriter and (if needed) roles/logging.viewer roles.

1
votes

I found the problem. The GOOGLE_APPLICATION_CREDENTIALS file needs to be set via the logback.xml with the credentialsFile tag.