Leasing app engine task in compute engine

Question

I'm trying to lease an app engine task from a pull queue in a compute engine instance but it keeps giving this error:

{
 "error": {
  "errors": [
   {
    "domain": "global",
    "reason": "forbidden",
    "message": "you are not allowed to make this api call"
   }
  ],
  "code": 403,
  "message": "you are not allowed to make this api call"
 }
}

This is the code I'm using:

import httplib2, json, urllib
from oauth2client.client import AccessTokenCredentials
from apiclient.discovery import build

def FetchToken():
    METADATA_SERVER = ('http://metadata/computeMetadata/v1/instance/service-accounts')
    SERVICE_ACCOUNT = 'default'

    http = httplib2.Http()

    token_uri = '%s/%s/token' % (METADATA_SERVER, SERVICE_ACCOUNT)
    resp, content = http.request(token_uri, method='GET',
                         body=None,
                         headers={'Metadata-Flavor': 'Google'})
    print token_uri
    print content
    if resp.status == 200:
        d = json.loads(content)
        access_token = d['access_token']  # Save the access token
        credentials = AccessTokenCredentials(d['access_token'],
                                        'my-user-agent/1.0')
        autho = credentials.authorize(http)
        print autho
        return autho
    else:
        print resp.status

task_api = build('taskqueue', 'v1beta2')

lease_req = task_api.tasks().lease(project='project-name',
                                    taskqueue='pull-queue',
                                    leaseSecs=30,
                                    numTasks=1)


result = lease_req.execute(http=FetchToken()) ####ERRORS HERE
item = result.items[0]
print item['payload']

It seems like an authentication issue but it gives me the exact same error if I do the same lease request using a bullshit made-up project name so I can't be sure.
I also launched the instance with taskqueue enabled.
Any help would be greatly appreciated

score 0 · Answer 1 · answered Oct 15 '14 at 09:56

In case anyone else is stuck on a problem like this I'll explain how it's working now. Firstly I'm using a different (shorter) method of authentication:

from oauth2client import gce

credentials = gce.AppAssertionCredentials('')
http = httplib2.Http()
http=credentials.authorize(http)
credentials.refresh(http)
service = build('taskqueue', 'v1beta2', http=http)

Secondly, the reason my lease request was being denied is that in queue.yaml my service account email was set as a writer email. In the documentation it's mentioned that an email ending with @gmail.com will not have the rights of a user email when set as a writer email. It's not mentioned that that extends to emails ending with @developer.gserviceaccount.com.

Leasing app engine task in compute engine

1 Answers1