Use

    gcloud auth application-default login

to login for application default creadentials ([docs](https://cloud.google.com/sdk/gcloud/reference/auth/application-default/login)). The behavior for application default credentials has [changed](https://cloud.google.com/sdk/release_notes#12800_20160928) in `gcloud` since version 128.

Note that changing credentials via `gcloud auth login` or `gcloud init` or `gcloud config set account MY_ACCOUNT` will NOT affect application default credentials, they managed separately from gcloud credentials.

I am used from Pycharm to be able to press ctrl + click on a function definition and see the uses. Is there an equivalent in VSC?

How to show uses of function in Visual Studio Code?

What is the proper way to annotate a function argument that expects a class object instead of an instance of that class?

In the example below, `some_class` argument is expected to be a type instance (which is a class), but the problem here is that `type` is too broad:

    def construct(some_class: type, related_data:Dict[str, Any]) -&gt; Any:
        ...

In the case where `some_class` expects a specific set of types objects, using `type` does not help at all. The `typing` module might be in need of a Class generic that does this:

    def construct(some_class: Class[Union[Foo, Bar, Baz]], related_data:Dict[str, Any]) -&gt; Union[Foo, Bar, Baz]:
        ...

In the example above, `some_class` is the `Foo`, `Bar` or `Faz` class, not an instance of it. It should not matter their positions in the class tree because `some_class: Class[Foo]` should also be a valid case. Therefore,

    # classes are callable, so it is OK
    inst = some_class(**related_data)

or

    # instances does not have __name__
    clsname = some_class.__name__

or

    # an operation that only Foo, Bar and Baz can perform.
    some_class.a_common_classmethod()

should be OK to mypy, pytype, PyCharm, etc.

How can this be done with current implementation (Python 3.6 or earlier)?

How to annotate a type that&#39;s a class object (instead of a class instance)?

I&#39;m playing with Google container engine on gcloud. So after successfully finished `gloud init` I followed instructions and did:

    gcloud container clusters get-credentials cluster-1 --zone europe-west1-c --project whatever

And then:

    kubectl proxy

But I got the following error message:

    error: google: could not find default credentials. See https://developers.google.com/accounts/docs/application-default-credentials for more information.

I do see stuff in `~/.kube/config` file so I&#39;m not sure what went wrong. I have `minikube` also installed on the machine but I don&#39;t think that&#39;s a problem.


Could not find default credentials

I'm playing with Google container engine on gcloud. So after successfully finished <code>gloud init</code> I followed instructions and did:
<pre><code class="hljs language-css">gcloud container clusters get-credentials cluster-1 --zone europe-west1-c --project whatever
</code></pre>
And then:
<pre><code class="hljs">kubectl proxy
</code></pre>
But I got the following error message:
<pre><code class="hljs language-arduino">error: google: could not find default credentials. See https://developers.google.com/accounts/docs/application-default-credentials for more information.
</code></pre>
I do see stuff in <code>~/.kube/config</code> file so I'm not sure what went wrong. I have <code>minikube</code> also installed on the machine but I don't think that's a problem.

**Question 1** - I&#39;m reading the documentation and I&#39;m slightly confused with the wording. It says:

&gt; **ClusterIP**: Exposes the service on a cluster-internal IP. Choosing this value makes the service only reachable from within the cluster. This is the default ServiceType
&gt; 
&gt; **NodePort**: Exposes the service on each Node’s IP at a static port (the NodePort). A ClusterIP service, to which the NodePort service will route, is automatically created. You’ll be able to contact the NodePort service, from outside the cluster, by requesting `&lt;NodeIP&gt;:&lt;NodePort&gt;`.
&gt; 
&gt; **LoadBalancer**: Exposes the service externally using a cloud provider’s load balancer. NodePort and ClusterIP services, to which the external load balancer will route, are automatically created.

Does the NodePort service type still use the `ClusterIP` but just at a different port, which is open to external clients? So in this case is `&lt;NodeIP&gt;:&lt;NodePort&gt;` the same as `&lt;ClusterIP&gt;:&lt;NodePort&gt;`?

Or is the `NodeIP` actually the IP found when you run `kubectl get nodes` and not the virtual IP used for the ClusterIP service type?

**Question 2** - Also in the diagram from the link below:

[![enter image description here][1]][1]

Is there any particular reason why the `Client` is inside the `Node`? I assumed it would need to be inside a `Cluster`in the case of a ClusterIP service type?

If the same diagram was drawn for NodePort, would it be valid to draw the client completely outside both the `Node` and`Cluster` or am I completely missing the point?


  [1]: https://i.stack.imgur.com/P36yL.png

What&#39;s the difference between ClusterIP, NodePort and LoadBalancer service types in Kubernetes?

I&#39;ve been doing a lot of digging on Kubernetes, and I&#39;m liking what I see a lot! One thing I&#39;ve been unable to get a clear idea about is what the exact distinctions are between the Deployment and StatefulSet resources and in which scenarios would you use each (or is one generally preferred over the other).

Kubernetes Deployments vs StatefulSets

This is what I keep getting:

    [root@centos-master ~]# kubectl get pods
    NAME               READY     STATUS             RESTARTS   AGE
    nfs-server-h6nw8   1/1       Running            0          1h
    nfs-web-07rxz      0/1       CrashLoopBackOff   8          16m
    nfs-web-fdr9h      0/1       CrashLoopBackOff   8          16m

Below is output from `describe pods`
[kubectl describe pods][2]

    Events:
      FirstSeen	LastSeen	Count	From				SubobjectPath		Type		Reason		Message
      ---------	--------	-----	----				-------------		--------	------		-------
      16m		16m		1	{default-scheduler }					Normal		Scheduled	Successfully assigned nfs-web-fdr9h to centos-minion-2
      16m		16m		1	{kubelet centos-minion-2}	spec.containers{web}	Normal		Created		Created container with docker id 495fcbb06836
      16m		16m		1	{kubelet centos-minion-2}	spec.containers{web}	Normal		Started		Started container with docker id 495fcbb06836
      16m		16m		1	{kubelet centos-minion-2}	spec.containers{web}	Normal		Started		Started container with docker id d56f34ae4e8f
      16m		16m		1	{kubelet centos-minion-2}	spec.containers{web}	Normal		Created		Created container with docker id d56f34ae4e8f
      16m		16m		2	{kubelet centos-minion-2}				Warning		FailedSync	Error syncing pod, skipping: failed to &quot;StartContainer&quot; for &quot;web&quot; with CrashLoopBackOff: &quot;Back-off 10s restarting failed container=web pod=nfs-web-fdr9h_default(461c937d-d870-11e6-98de-005056040cc2)&quot;

I have two pods: `nfs-web-07rxz`, `nfs-web-fdr9h`, but if I do `kubectl logs nfs-web-07rxz` or with `-p` option I don&#39;t see any log in both pods.

    [root@centos-master ~]# kubectl logs nfs-web-07rxz -p
    [root@centos-master ~]# kubectl logs nfs-web-07rxz

This is my replicationController yaml file:
[replicationController yaml file][3]


    apiVersion: v1 kind: ReplicationController metadata:   name: nfs-web spec:   replicas: 2   selector:
        role: web-frontend   template:
        metadata:
          labels:
            role: web-frontend
        spec:
          containers:
          - name: web
            image: eso-cmbu-docker.artifactory.eng.vmware.com/demo-container:demo-version3.0
            ports:
              - name: web
                containerPort: 80
            securityContext:
              privileged: true


My Docker image was made from this simple docker file:


    FROM ubuntu
    RUN apt-get update
    RUN apt-get install -y nginx
    RUN apt-get install -y nfs-common

I am running my kubernetes cluster on CentOs-1611, kube version:

 

    [root@centos-master ~]# kubectl version
    Client Version: version.Info{Major:&quot;1&quot;, Minor:&quot;3&quot;, GitVersion:&quot;v1.3.0&quot;, GitCommit:&quot;86dc49aa137175378ac7fba7751c3d3e7f18e5fc&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2016-12-15T16:57:18Z&quot;, GoVersion:&quot;go1.6.3&quot;, Compiler:&quot;gc&quot;, Platform:&quot;linux/amd64&quot;}
    Server Version: version.Info{Major:&quot;1&quot;, Minor:&quot;3&quot;, GitVersion:&quot;v1.3.0&quot;, GitCommit:&quot;86dc49aa137175378ac7fba7751c3d3e7f18e5fc&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2016-12-15T16:57:18Z&quot;, GoVersion:&quot;go1.6.3&quot;, Compiler:&quot;gc&quot;, Platform:&quot;linux/amd64&quot;}

If I run the docker image by `docker run` I was able to run the image without any issue, only through kubernetes I got the crash. 

Can someone help me out, how can I debug without seeing any log?

  [2]: https://i.stack.imgur.com/qUtPV.png
  [3]: https://i.stack.imgur.com/kSbnv.png


My kubernetes pods keep crashing with &quot;CrashLoopBackOff&quot; but I can&#39;t find any log

I am trying to understand [Stateful Sets][0].  How does their use differ from the use of &quot;stateless&quot; Pods with Persistent Volumes?  That is, assuming that a &quot;normal&quot; Pod may lay claim to persistent storage, what obvious thing am I missing that requires this new construct (with ordered start/stop and so on)?

[0]: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/

Why StatefulSets? Can&#39;t a stateless Pod use persistent volumes?

I am becoming more familiar with Kubernetes by the day, but am still at a basic level.  I am also not a networking guy.

I am staring at the following snippet of a Service definition, and I can&#39;t form the right picture in my mind of what is being declared:

    spec:
      type: NodePort
      ports:
      - port: 27018
        targetPort: 27017
        protocol: TCP

Referencing the [ServicePort documentation](https://kubernetes.io/docs/resources-reference/v1.5/#serviceport-v1), which reads in part:

    nodePort     The port on each node on which this service is exposed when type=NodePort or LoadBalancer. Usually
    integer      assigned by the system. If specified, it will be allocated to the service if unused or else creation of the
                 service will fail. Default is to auto-allocate a port if the ServiceType of this Service requires one. More info: 
                 http://kubernetes.io/docs/user-guide/services#type--nodeport

    port         The port that will be exposed by this service.
    integer
    
    targetPort   Number or name of the port to access on the pods targeted by the service. Number must be in the range 1
    IntOrString  to 65535. Name must be an IANA_SVC_NAME. If this is a string, it will be looked up as a named port in the
                 target Pod&#39;s container ports. If this is not specified, the value of the &#39;port&#39; field is used (an identity map).
                 This field is ignored for services with clusterIP=None, and should be omitted or set equal to the &#39;port&#39; field.
                 More info: http://kubernetes.io/docs/user-guide/services#defining-a-service

My understanding is that the port that a client outside of the cluster will &quot;see&quot; will be the dynamically assigned one in the range of `30000`-`32767`, as defined [in the documentation](https://kubernetes.io/docs/user-guide/services/#type-nodeport).  This will, using some black magic that I do not yet understand, flow to the `targetPort` on a given node (`27017` in this case).

So what is the `port` used for here?  

What does it mean for a Service to be of type NodePort, and have both port and targetPort specified?

I am trying to install several GCP components from the [gcloud command-line tool](https://cloud.google.com/sdk/gcloud) and always get the same error:

    $ gcloud components list
    
    Your current Cloud SDK version is: 146.0.0
    The latest available version is: 146.0.0
    
    ┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
    │                                                  Components                                                 │
    ├───────────────┬──────────────────────────────────────────────────────┬──────────────────────────┬───────────┤
    │     Status    │                         Name                         │            ID            │    Size   │
    ├───────────────┼──────────────────────────────────────────────────────┼──────────────────────────┼───────────┤
    │ Not Installed │ App Engine Go Extensions                             │ app-engine-go            │  47.9 MiB │
    │ Not Installed │ Bigtable Command Line Tool                           │ cbt                      │   3.8 MiB │
    │ Not Installed │ Cloud Datalab Command Line Tool                      │ datalab                  │   &lt; 1 MiB │
    │ Not Installed │ Cloud Datastore Emulator                             │ cloud-datastore-emulator │  15.4 MiB │
    │ Not Installed │ Cloud Datastore Emulator (Legacy)                    │ gcd-emulator             │  38.1 MiB │
    │ Not Installed │ Cloud Pub/Sub Emulator                               │ pubsub-emulator          │  21.0 MiB │
    │ Not Installed │ Google Container Registry&#39;s Docker credential helper │ docker-credential-gcr    │   3.3 MiB │
    │ Not Installed │ gcloud app Java Extensions                           │ app-engine-java          │ 128.3 MiB │
    │ Not Installed │ gcloud app Python Extensions                         │ app-engine-python        │   7.2 MiB │
    │ Not Installed │ kubectl                                              │ kubectl                  │  11.5 MiB │
    │ Installed     │ BigQuery Command Line Tool                           │ bq                       │   &lt; 1 MiB │
    │ Installed     │ Cloud SDK Core Libraries                             │ core                     │   5.7 MiB │
    │ Installed     │ Cloud Storage Command Line Tool                      │ gsutil                   │   2.8 MiB │
    │ Installed     │ Default set of gcloud commands                       │ gcloud                   │           │
    │ Installed     │ gcloud Alpha Commands                                │ alpha                    │   &lt; 1 MiB │
    │ Installed     │ gcloud Beta Commands                                 │ beta                     │   &lt; 1 MiB │
    └───────────────┴──────────────────────────────────────────────────────┴──────────────────────────┴───────────┘
    
Then attempting to install [kubectl](https://kubernetes.io/docs/reference/kubectl/overview/)

    $ gcloud components install kubectl

    You cannot perform this action because this Cloud SDK installation is 
    managed by an external package manager.  If you would like to get the 
    latest version, please see our main download page at:
    https://cloud.google.com/sdk/
    ERROR: (gcloud.components.install) The component manager is disabled for this installation

Any idea why is this error raised?

Install Google Cloud components error from gcloud command

How can I change the current running project to another project in GCP (*Google Cloud Platform*) account using **cli commands** other than using **`gcloud init`** manually?

 **`gcloud projects list`** will list the projects running on my account. I want to change the current project to any other project from the list using a cli command. 

How to change the project in GCP using CLI commands

In the google cloud gui console I went to &quot;IAM &amp; admin&quot; &gt; &quot;Service accounts&quot; and created a service account named &quot;my-service-account&quot; with the viewer role.

I then ran this command:

    gcloud iam service-accounts get-iam-policy my-service-account@mydomain.iam.gserviceaccount.com

and saw this output:

    etag: ACAB

According to the docs this means this service account has no policy associated with it. So I assigned it a &quot;role&quot; which is not included in its &quot;policy&quot;.

How do I list the roles associated with a service account?

EDIT:
Thanks to the excellent answer to this question I can now loop over all projects and get what I want. so, depending on your version of these cmd tools, this should list all role bindings of a single service account across all projects:

    gcloud projects list | \
      awk &#39;{print $1}&#39; | \
      xargs -I % sh -c &quot;echo &quot;&quot;; echo project:% &amp;&amp; \
      gcloud projects get-iam-policy % \
      --flatten=&#39;bindings[].members&#39; \
      --format=&#39;table(bindings.role)&#39; \
      --filter=&#39;bindings.members:YOU-SERVICE-ACCOUNT@blah.com&#39; \
      ;&quot; 

How do I list the roles associated with a gcp service account?

I am trying to create an internal app to upload files to google cloud. I don&#39;t want each individual user or this app to log in so I&#39;m using a service account. I login into the service account and everything is ok, but when I try to upload it gives me this error:
ServiceException: 401 Anonymous caller does not have storage.objects.list access to bucket

[![This is the error that I get][1]][1]


  [1]: https://i.stack.imgur.com/ELTTA.png



As you can see I am logged in with a service account and my account and(neither service or personal) works

gsutil ServiceException: 401 Anonymous caller does not have storage.objects.list access to bucket even though I&#39;m loggedin in gcloud

After the latest updates to gcloud and docker I&#39;m unable to access images on my google container repository.  Locally when I run: `gcloud auth configure-docker` as per the instructions after updating gcloud, I get the following message:

    WARNING: `docker-credential-gcloud` not in system PATH.
    gcloud&#39;s Docker credential helper can be configured but it will not work until this is corrected.
    gcloud credential helpers already registered correctly.

Running `which docker-credential-gcloud` returns `docker-credential-gcloud not found`.

I have no other gcloud-related path issues and for the life of me can&#39;t figure out how to install/add docker-credential-gcloud to path. Here&#39;s what I have installed (shown via `gcloud version`):

    Google Cloud SDK 197.0.0
    beta 2017.09.15
    bq 2.0.31
    container-builder-local
    core 2018.04.06
    docker-credential-gcr
    gsutil 4.30

I also have Docker CE Version 18.03.0-ce-mac60 (23751).

Here&#39;s my $PATH:`/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin`

I also ran `source /usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/path.zsh.inc` on original gcloud install.



Content Type	Original Author	Original Content on Stackoverflow
Question	lang2	View Question on Stackoverflow
Solution 1 - Kubernetes	cherba	View Answer on Stackoverflow

Could not find default credentials

Kubernetes Problem Overview

Kubernetes Solutions

Solution 1 - Kubernetes

How to annotate a type that's a class object (instead of a class instance)?

How to show uses of function in Visual Studio Code?

Attributions