translate and vision API's seem to ignore ApplicationDefault credentials

[lesv]

When I was testing gh/gcp/java-docs-samples, by going to the root folder and setting GOOGLE_CLOUD_PROJECT=java-docs-samples-testing and being authenticated as me in the gcloud command line tool. Then doing mvn clean verify the first problem is on translate and it's fixed by setting GOOGLE_APPLICATION_CREDENTIALS.

This is wrong.
@gguuss FYI

[lesv]

This may be because we are just including google-cloud-translate & google-cloud-vision, not google-cloud

[gguuss]

Makes sense, I can check soon to see if updating the dependencies fixes this.

[gguuss]

For vision and translate, switching to google-cloud did not resolve the ADC issue.

[tcoffee-google]

Some integration tests on this repo appear to depend on using GOOGLE_CLOUD_PROJECT=java-docs-samples-testing --- can you give me permissions on this project?

[lesv]

Done

[tcoffee-google]

I've succeeded in reproducing the issue.

I was surprised to find that pointing GOOGLE_APPLICATION_CREDENTIALS to the file /usr/local/google/home/tcoffee/.config/gcloud/application_default_credentials.json created by gcloud auth application-default login does not resolve the problem.

Still investigating ...

[tcoffee-google]

Strangely, I can no longer reproduce the issue in the translate-related tests (as of this morning).

Previously, I observed consistently that the content of the key files was clearly implicated, as explicitly referencing the gcloud-generated file

export GOOGLE_APPLICATION_CREDENTIALS=~/.config/gcloud/application_default_credentials.json

did not resolve the issue, but replacing its content with that of the service account file

cat <...>/java-docs-samples-testing-66e7e8ce4415.json > ~/.config/gcloud/application_default_credentials.json

did resolve the issue.

The general issue persists, but nondeterministically, only in some of the vision-related tests (note that these tests also exhibit other failures). Here I am (sometimes) hitting the 'USER-100s' limit, which I infer to be the backend limit on administrative operations. This seems to have been observed in the wild (in Python):

https://stackoverflow.com/questions/43746016/google-vision-api-tatuscode-resource-exhausted

There is also a report of this occurring in pubsub (in Node.js):

googleapis/google-cloud-node#1756

I suspect we are just hitting backend limits that differ for the accounts associated to the respective credentials.

@lesv Are you still able to reproduce the issue in translate?

[tcoffee-google]

Update: after re-running tests several times, I now see the translate failures again, and am reminded that these were "daily limit exceeded" failures, which now makes sense.

I'm going to close this as WAI. I assume it would not be a persistent problem to run integration tests with a service account, but if so, let's open a separate issue.

[tcoffee-google]

Epilog: @lesv please review GoogleCloudPlatform/java-docs-samples#741 when you get a chance (I'm not able to assign reviewers).

[ericandrewschmidt]

I can hit this consistently: RESOURCE_EXHAUSTED: Insufficient tokens for quota 'DefaultGroup' and limit 'CLIENT_PROJECT-100s' of service 'language.googleapis.com'

Using: gcloud auth application-default login

What is the correct path to authenticate and not hit this error?

Needless to say this is super frustrating and a few externals are hitting this. Please advise - thanks!

[garrettjonesgoogle]

@ericandrewschmidt Could you please open a new issue? The present issue is already closed, and your problem might not be related.

[ericandrewschmidt]

Will do - thanks.