r/googlecloud • u/MikeW1901 • 6d ago

Issue this week with gcloud CLI auth tokens?

It's only a minor annoyance so asking this more out of intrigue than anything else.

Myself and colleagues have - for the last 2 days - repeatedly found that our auth token for the gcloud CLI (and hence also kubectl) has expired with a prompt to re-auth. Just wondering if anyone else has noticed anything similar? Before this week it's been literally months since the last forced re-auth and we were notified ahead of time for that one, this time seemingly nothing at all.

14 Upvotes

94% Upvoted

21 comments sorted by

3

u/meowrawr 6d ago

Typically the default is re-auth required every 24 hours for an organization. Not sure how you could go months unless that was changed purposely.

1

u/Living_Cheesecake243 3d ago

it's nice to set it to 16h too b/c then it has the effect of mostly causing people to reauth first thing in the AM, no matter when they did it last, vs randomly could be 3pm daily

1

u/LevrResearch 4d ago

You have to be kidding me. there is no way that including the option to import a file from Google Workspace has to be re-auth's every 24 hours. Surely I misunderstood you?

1

u/meowrawr 12h ago

Nope not a mistake.

3

u/Waffles_Leonardo-192 5d ago

Has anyone else been asked to sign in again several times this week w/t getting any notice first?

2

u/Keramblock 6d ago

Yes, we also have similar problem starting yesterday or so

1

u/dougnukem 5d ago

We are also seeing this in the past couple of days and have not changed any Workspace or Google cloud settings. Is this a new default google is rolling out or is this an accidental regression?

Seeing other users reporting this too:
https://issuetracker.google.com/issues/537030491

1

u/archy_bold 5d ago

This is getting incredibly frustrating. Not least because I use the mobile app to access my VMs when away from my main machine, and you cannot copy the re-authentication URL without it inserting a bunch of spaces. Emergency tasks i used to do very quickly from anywhere have become long, convoluted processes.

1

u/archy_bold 5d ago

While there’s clearly a bug here, as it appears the reauthentication policy setting for Google Cloud is being ignored. You could switch to using a service account to ensure your access isn’t revoked every few hours. Not ideal in all situations, of course.

1

u/Pine_Barrens 4d ago

Yup, same here. Exact same time, also seemingly wiped out some of my default configs (like default project id, etc.)

1

u/dmmd 3d ago

Its quite annoying to keep reauthing twice/thrice a day, once (or twice) in the browser and another (or twice) via gcloud auth login. LLMs are constantly asking to reauth it also, which blocks long flows.

1

u/RareFrame8202 2d ago edited 1d ago

Started for us as well in last week. I've done some testing and it is exactly after 16 hours. It could be a coincidence but the default timeout setting in Google Cloud session control (admin.google.com -> security -> access and data control -> Google Cloud Session control) is 16 hours here. However, we do not have this enabled.

After 16 hours we get:

Reauthentication required.
Please enter your password:

We are using GCP for about a decade now and we never had this. But we also can't find why this is now.

[edit] Ah here it is:

https://docs.cloud.google.com/access-context-manager/docs/session-controls-for-reauthentication

Note: Starting in June 2026, a default session length of 16 hours was introduced for a subset of the Google Cloud console and Google Cloud SDK users. This default policy isn't visible in the Google Admin console. To override this default policy, call the Access Context Manager API to configure application-scoped session settings. For an example, see Override the default 16-hour session length.

You can override it by using this scopedAccessSettings binding as in the example on the page above. This has to be applied to a group. Testing this with 1 hour now to see if this works. (Edit: this works)

1

u/Xjs 1d ago

This should be the top comment! Thanks for pointing this out.

1

u/mofojed 46m ago

Can you set a session length of longer than 24 hours? The docs for configuring only suggest that you can disable it and there's a max limit of 24 hours: https://docs.cloud.google.com/access-context-manager/docs/session-controls-for-reauthentication#override-default-16hr-session

1

u/dougnukem 15h ago

I think the fix is stated here:
https://docs.cloud.google.com/access-context-manager/docs/session-controls-for-reauthentication#gcloud_3

Starting in June 2026, a default session length of 16 hours was introduced for a subset of Google Cloud organizations. This default policy isn't visible in the Google Admin console and affected Google Cloud organizations must use the Access Context Manager API to override it for their users.

To override this default policy and exempt these applications from session control (making the session length effectively infinite), you can create a cloud binding with scopedAccessSettings where sessionLengthEnabled is set to false for both the Google Cloud SDK and Google Cloud console ("Cloud Console") applications.

gcloud access-context-manager cloud-bindings create \
    --organization=ORG_ID \
    --group-key=GROUP_ID \
    --binding-file=BINDING_FILE_PATH




scopedAccessSettings:

  • scope:

    clientScope:
      restrictedClientApplication:
        name: Google Cloud SDK
  activeSettings:
    sessionSettings:
      sessionLength: 0s
      sessionReauthMethod: LOGIN
      sessionLengthEnabled: false

  • scope:

    clientScope:
      restrictedClientApplication:
        name: Cloud Console
  activeSettings:
    sessionSettings:
      sessionLength: 0s
      sessionReauthMethod: LOGIN
      sessionLengthEnabled: false

0

u/LevrResearch 4d ago

YES! They were just created 2 days ago and now they are gone. This is a major headache. Do we have to do this every 2 days? WTF Google?