GCP: Authorization has failed

[mickael]

Dear All,
I'm using Google Cloud (GCP) Template for Zabbix since a while now.
Unfortunalty, since few days, the Template failed to get data from GCP, this is the same issue for all our GCP Project :
- GCP: Authorization has failed
- Preprocessing failed for: {"error":{}} : Failed: Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential.

On GCP side, the service account is still valid and the permission are set the Projet Viewer. I tried to create a new service account key, but the error is still present.

I also try to upgrade to the last GCP Template, but the issue is still present.

Our Zabbix version is 7.0.7

I'm running out of idea now.

Thanks a lot for your help.

Mickaël

[AlexeySaff]

I've had exactly the same issue, and my idea was that this was due to an update from 7.2 to 7.2.1, but seems a reply from Zabbix was changed. I tried to update template from 7.0 to 7.0-1, but I had no luck
Would be great if someone can point what's the issue here

[AlexeySaff]

It seems like a reply was changed on GCP side as previously we had just empty string and now {} where trigger is checking length of the error code

[AlexeySaff]

so I bet it comes after 7.0.7 update for you and 7.2.1 for me. and the problem here is the authorization preprocessing $.error and next check where previously zabbix returned empty string and now {}

so the stupid and quick fix is to change the trigger from

length(last(/GCP by HTTP/gcp.auth.err.check)) > 0
to
last(/GCP by HTTP/gcp.auth.err.check) <> "{}"

but after that, we have more problems in getting states of the machines. Investigating

[AlexeySaff]

no, sorry, my bad. but something is broken in 7.2.1 for sure as when I test item it returns back proper auth token, but from the zabbix execution it returns

{"error":{}}

for auth

[AlexeySaff]

I'm out of ideas..... trst of the item returns valid token, zabbix_js returns valid token, but in zabbix execution it returns

{"error":{}}

this comes from that part of the code

try {
jwt = encodeJWT(headers, payload, script_params.private_key);
token = exchangeJwtForAccessToken(jwt);
return token;
}
catch (err) {
return JSON.stringify({ error: err });
}

[AlexeySaff]

Cannot execute script: Error: failed to import private key
at [anon] (global.c:381) internal
at [anon] () native strict preventsyield
at encodeJWT (function:30)
at [anon] (function:104) preventsyield


so the problem is with importing private key. so that is definitely something with the zabbix update

[AlexeySaff]

you need to delete all escape n from your private key. works for me now . not sure what was changes in checking escaping in java code

[ServicesIt]

Thank you, this worked for me. (Zabbix LTS 7.0)

[mickael]

Thanks a lot Alexey, after removing the escape n, it work again.

[doppler]

Thank you all for this thread. I had 4 zabbix instances monitoring 4 gcp enivronments with this exact problem, now all fixed thanks to this thread!