Invalid resource field value in the request

Question

I'm using the Go SDK @ cloud.google.com/go/firestore GoDoc here to call Firestore. It works great on App Engine, but I recently added a new service to Cloud Run. This new service calls into the same code used by the old service, but that code - which works on App Engine - is throwing an error on Cloud Run: rpc error: code = InvalidArgument desc = Invalid resource field value in the request

The particular line of code throwing the error is:

snap, err := client.Collection(queryable.CollectionName()).Doc(queryable.GetFirestoreID()).Get(ctx)
if err != nil {
    return fmt.Errorf("couldn't read document with id: %v error: %w", queryable.GetFirestoreID(), err)
}

Where queryable is an interface and CollectionName() returns a constant string so can't be the problem (besides if that was the problem it would return a different error).

I wrap error messages with more text, so the full error message can give you a sense of the stack: DoTaxDog: allDB.UpdateData: firestoreCRUD.ReadSchema: error in Firestore's ReadSchema: couldn't read document with id: AGPFiyoJdMAmurVNqHYxvKHEb error: rpc error: code = InvalidArgument desc = Invalid resource field value in the request. The allDB.UpdateData function is shared between this code and the code which is running in App Engine, so for all intents and purposes the code I'm running on App Engine and the code I'm running on Cloud Run is identical.

Deployment Information

I deploy with this in Gitlab:

deploy_run:
  image: google/cloud-sdk
  stage: deploy
  only:
    - master
  script:
    - echo $DEPLOY_KEY > /tmp/$CI_PIPELINE_ID.json
    - gcloud auth activate-service-account --key-file /tmp/$CI_PIPELINE_ID.json
    - gcloud builds submit --tag gcr.io/project-name/project-name --project project-name
    - gcloud run deploy project-name --image gcr.io/project-name/project-name --platform managed --project project-name --region=us-central1 --allow-unauthenticated

Attempts to solve the problem

1. I tried re-running the request. No dice.
2. I checked that the same request was working on localhost. It is working on localhost.
3. I checked that I'm able to make requests (not the same request, but an almost identical request) on App Engine. It is still working on App Engine.
4. I checked the GoDoc. It does not reference this error.
5. I checked Google Cloud docs. They seem to say this is a generic error message. I couldn't find a specific reference to this error message for Firestore.
6. I searched for an answer online. No dice.

Infrastructure Checks

• App Engine and Cloud Run are in the same region.
• I think that both are using the default app engine service account to service requests, because on the Cloud Run service page it is giving me a security warning: "Cloud Run service [censored] in us-central1 is using the default Compute Engine service account. By default, this service account has broad IAM permissions."
• I tried re-deploying with different service accounts (Edit & Deploy New Revision > Security Tab > Change Service Account > click "Deploy"). I tried the default app engine service account and the compute engine service account. In both cases, invoking the service resulted in the error in this post.

I've had this problem before, but I can't remember how I solved it last time so I'm making this post.

Answer 1

Fixed! Cloud Run does not set the GOOGLE_CLOUD_PROJECT environment variable. When I initialized the Firestore client via this Go code: firestore.NewClient(ctx, projectID, option.WithCredentials(credentials)) the projectID variable's value was the empty string. Firestore's Go SDK's function NewClient does NOT throw an error if the projectID variable is not set. Instead, the first time you make a request it returns the rpc error from the underlying service, which is what I originally saw: rpc error: code = InvalidArgument desc = Invalid resource field value in the request

To fix this, I added this code to my gcloud run deploy command: --set-env-vars=GOOGLE_CLOUD_PROJECT=project-name

Thanks to the commenters who asked me for more details about the code itself!

[Update] I opened an Issue in Github and fixed it in a PR which was accepted. This issue has been closed and should not occur again.

[Update] FYI only a single instance of the problem was fixed so this problem can still occur with other SDK func calls.