NodeJS Managed VM receiving 403 on datastore writes (after using gcloud ...deploy --remote)

[camilosilva]

Dear Google Team:

I just tried deploying my NodeJS app to my project with the new remote dockerless option:
"gcloud preview app deploy app.yaml --set-default --remote"
The deployment process seemed to be fine -- meaning no errors occurred while deploying.

After the deployment was performed, Interestingly all my GET requests that read data from the datastore are successful.

However, when I try to POST where the data is supposed to be written to the datastore, I keep receiving the 'Forbidden' 403.

This is very weird and awckard since when I run my node app on my localhost, I am able to read/store to my datastore cloud instance without issues.

Please let me know if this might not be the proper place to address this issue.
I'm about to submit on the Google Groups App Engine as well as in the code.google.com

Thanks for your help.
Camilo.

[stephenplusplus]

We can close here in favor of the progress tracked over at https://github.com/GoogleCloudPlatform/gcloud/issues/31. I don't believe this to be an issue with our library, as it works locally. However, if something needs to be changed on our part, please come back and re-open.

Please post a link here to the Google Groups post you make.

[camilosilva]

Thanks for getting back to me so promptly.
Here's the Google Groups post:
https://groups.google.com/forum/#!topic/google-appengine/xDmDUy4ora0

I'll keep you posted if anything. Thanks!

[camilosilva]

An important follow up. See below for the stack printout of the error:

{
"status": "ERROR",
"error": {
"code": 403,
"message": "Forbidden",
"stack": "Error: Forbidden\n at Object.parseApiResp (/app/node_modules/gcloud/lib/common/util.js:168:22)\n at Object.handleResp (/app/node_modules/gcloud/lib/common/util.js:139:25)\n at IncomingMessage. (/app/node_modules/gcloud/lib/datastore/request.js:785:16)\n at IncomingMessage.emit (events.js:129:20)\n at _stream_readable.js:908:16\n at process._tickCallback (node.js:355:11)"
}
}

The above is the custom JSON response I have in place.
Just in case, I have on my local docker version 1.5.0 (in case this matters)
All of my deployments are now being done with the dockerless option (local testing has been done in the same fashion as well).

BTW, after going through these instructions again:
https://googlecloudplatform.github.io/gcloud-node/#/authorization

I retried with the Service Account authentication and it worked.
I am not sure why the normal suggested method by using just the Scopes did not work in my case for the Managed VM.

Anyways, I am good for now. I'm just wondering what the performance implications are by using the service account auth instead of the smoother alternative of using the scopes only.

Let me know your thoughts. Thanks.

[jgeewax]

It's possible that when the Managed VM was created, it wasn't getting the access it needed to talk to Datastore (ie, when you create a Compute Engine instance, you need to specifically say "this should be able to talk to Datastore).

If so, that's an error on our side... @ajessup any thoughts?

[jgeewax]

/cc @JustinBeckwith