setup-gcloud docker-credential-gcloud + gcloud 298.0.0 + ubuntu-18.04: "OPENSSL_1_1

TL;DR

Using GoogleCloudPlatform/github-actions/setup-gcloud@master with ubuntu-latest. Builds suddenly started failing overnight due to docker-credential-gcloud throwing a version OPENSSL_1_1_1' not found error.

Expected behavior

docker-credentials-gcloud should allow me to pull an image from my gcp repo

Observed behavior

docker-credentials-gcloud fails complaining about version OPENSSL_1_1_1' not found and build fails.

https://github.com/austinpray/kaori/pull/134/checks?check_run_id=814820107#step:6:90

ERROR: gcloud failed to load: /tmp/_MEIhQjalI/libssl.so.1.1: version `OPENSSL_1_1_1' not found (required by /usr/lib/python3.6/lib-dynload/_ssl.cpython-36m-x86_64-linux-gnu.so)

:point_right: Reverting to version 297.0.1 as in https://github.com/austinpray/kaori/pull/133 makes the build pass again.

Reproduction

Here is me fixing it by pinning the gcloud version to an older one: https://github.com/austinpray/kaori/pull/133

Here is me reproducing the issue by unpinning the version: https://github.com/austinpray/kaori/pull/134 (https://github.com/austinpray/kaori/pull/134/checks?check_run_id=814820107#step:6:90)

Current runner version: '2.263.0'
Operating System
  Ubuntu
  18.04.4
  LTS
Virtual Environment
  Environment: ubuntu-18.04
  Version: 20200621.1
  Included Software: https://github.com/actions/virtual-environments/blob/ubuntu18/20200621.1/images/linux/Ubuntu1804-README.md

Action YAML

name: CI

on:
  push:
    branches: [ master ]
    paths-ignore:
      - workloads/**
      - fluxcd/**
  pull_request:

jobs:

  build:

    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v2
    - uses: GoogleCloudPlatform/github-actions/setup-gcloud@master
      with:
        project_id: ${{ secrets.GCLOUD_PROJECT_ID }}
        service_account_key: ${{secrets.GOOGLE_APPLICATION_CREDENTIALS}}
        export_default_credentials: true
    - run: gcloud auth configure-docker
    - name: Create a .env file
      env:
        SLACK_API_TOKEN: ${{secrets.SLACK_API_TOKEN}}
        SLACK_SIGNING_SECRET: ${{secrets.SLACK_SIGNING_SECRET}}
        SLACK_VERIFICATION_TOKEN: ${{secrets.SLACK_VERIFICATION_TOKEN}}
        GCLOUD_SERVICE_ACCOUNT_INFO: ${{secrets.GCLOUD_SERVICE_ACCOUNT_INFO}}
        IMAGES_BUCKET_GCLOUD: ${{secrets.IMAGES_BUCKET_GCLOUD}}
      run: ./scripts/create-dotenv-from.py .env.example > .env
    - name: Build the Docker image
      run: |
        docker pull $CACHE_FROM_IMAGE || true
        make
      env:
        CACHE_FROM_IMAGE: us.gcr.io/${{secrets.GCLOUD_PROJECT_ID}}/kaori/kaori:master
    - name: Run the tests
      run: ./tests/run.sh
    - name: Upload coverage to Codecov
      uses: codecov/codecov-action@v1
      with:
        token: ${{ secrets.CODECOV_TOKEN }}
    - name: Run the card sim
      run: make test-sims
    - name: Push to GCR
      if: github.ref == 'refs/heads/master'
      run: |
        docker tag austinpray/kaori/kaori us.gcr.io/${{secrets.GCLOUD_PROJECT_ID}}/kaori/kaori:master-${{github.sha}}
        docker tag austinpray/kaori/kaori us.gcr.io/${{secrets.GCLOUD_PROJECT_ID}}/kaori/kaori:master
        docker push us.gcr.io/${{secrets.GCLOUD_PROJECT_ID}}/kaori/kaori:master
        docker push us.gcr.io/${{secrets.GCLOUD_PROJECT_ID}}/kaori/kaori:master-${{github.sha}}

Repository

https://github.com/austinpray/kaori/pull/133

If you want temporary access to this repo for debugging and such: I can give it to you. This is just a silly side project.

Jun 27 '20 23:06 austinpray

Same here. When running docker-compose with latest google SDK, showing the similiar message when pulling base image from gcr. The workaround by using 297.0.1 got it work.

Jul 05 '20 06:07 aDisplayName

Hi @austinpray Looking at the runner env OPENSSL_1_1_1 seems to be installed. Does 299.0.0 work? I will try to see if something on the gcloud side may have changed. related https://github.com/actions/virtual-environments/issues/1106

Jul 06 '20 07:07 bharathkkb

I tried a minimal repro here based on https://github.com/actions/virtual-environments/issues/1106 which seemed to work with 298.

Jul 06 '20 07:07 bharathkkb

Same issue. 298 did not seem to work for me. 297.0.01 worked.

Jul 14 '20 15:07 YAmikep

Confirming that this issue also exists in Ubuntu 20.04 with gcloud version 301.0.0.

To fix:

sudo apt install google-cloud-sdk=297.0.1-0

Jul 14 '20 16:07 robbrit

Confirming that the original sighting of this still happens on the latest runner: https://github.com/austinpray/kaori/runs/869998041?check_suite_focus=true#step:6:84

# github actions runner
Current runner version: '2.267.1'

Run GoogleCloudPlatform/github-actions/setup-gcloud@master
  with:
    project_id: ***
    service_account_key: ***
    export_default_credentials: true
    version: latest

Results in gcloud version 301.0.0

Jul 14 '20 16:07 austinpray

Confirming that this issue also exists in Ubuntu 20.04 with gcloud version 301.0.0.

To fix:
sudo apt install google-cloud-sdk=297.0.1-0

This temporary workaround also works on Ubuntu Server 18.04.4.

Jul 20 '20 10:07 polaroidkidd

What worked for us was to use the env var:

CLOUDSDK_PYTHON: /usr/bin/python

Jul 22 '20 10:07 rgeraads

Ran into this error as well on Ubuntu 18.04.4 LTS

Jul 22 '20 17:07 mjhoffman65

I get this error when, for example, I execute docker-compose build, but if I exectue this command with sudo it works.

Jul 23 '20 09:07 seilagamo

I get this error when, for example, I execute docker-compose build

I also got the OPENSSL_1_1_1 error when executing docker-compose build with google-cloud-sdk Debian package version 302.0.0-0. Reverting to version 301.0.0-0 did not fix the problem, but reverting to 300.0.0-0 did.

System information:

OS:

# lsb_release --description
Description:  Ubuntu 20.04 LTS

Google Cloud SDK installed through apt-get.

Docker Compose:

# docker-compose version
docker-compose version 1.26.2, build eefe0d31
docker-py version: 4.2.2
CPython version: 3.7.7
OpenSSL version: OpenSSL 1.1.0l  10 Sep 2019

Jul 23 '20 16:07 jtrh

@jtrh getting the same error as you while doing docker-compose build. I tried prefixing it with CLOUDSDK_PYTHON=$(which python3) didn't work either, same error.

System info:

$ gcloud -v
Google Cloud SDK 302.0.0
alpha 2020.07.17
beta 2020.07.17
bq 2.0.58
cloud-build-local
core 2020.07.17
gsutil 4.52
kubectl 1.15.11
pubsub-emulator 0.1.0

$ lsb_release --all
No LSB modules are available.
Distributor ID: LinuxMint
Description:    Linux Mint 19.3 Tricia
Release:        19.3
Codename:       tricia

$ docker-compose version
docker-compose version 1.24.1, build 4667896b
docker-py version: 3.7.3
CPython version: 3.6.8
OpenSSL version: OpenSSL 1.1.0j  20 Nov 2018

EDIT: this fixed it for me https://github.com/openssl/openssl/issues/5845#issuecomment-378601109

Jul 23 '20 20:07 sorliem

I was having this problem using the google/cloud-sdk image on CircleCI.

My workaround was changing the docker-compose install method from the one recommended on the CircleCI docs to:

pip3 install docker-compose --upgrade

Jul 27 '20 20:07 lricoy

Hi @austinpray Could you add a gcloud info step with a build that errors out. I am unable to repro here with latest versions and 301.0.0. If you have any tips on a reproduction, that would also be great.

Jul 30 '20 06:07 bharathkkb

@bharathkkb sure thing! here is the output

gcloud info output

2020-07-30T14:25:23.0340993Z Google Cloud SDK [303.0.0]
2020-07-30T14:25:23.0341792Z 
2020-07-30T14:25:23.0343161Z Platform: [Linux, x86_64] uname_result(system='Linux', node='fv-az117', release='5.3.0-1032-azure', version='#33~18.04.1-Ubuntu SMP Fri Jun 26 15:01:15 UTC 2020', machine='x86_64', processor='x86_64')
2020-07-30T14:25:23.0343851Z Locale: ('en_US', 'UTF-8')
2020-07-30T14:25:23.0344499Z Python Version: [3.6.9 (default, Jul 17 2020, 12:50:27)  [GCC 8.4.0]]
2020-07-30T14:25:23.0344994Z Python Location: [/usr/bin/python3]
2020-07-30T14:25:23.0345562Z Site Packages: [Disabled]
2020-07-30T14:25:23.0345871Z 
2020-07-30T14:25:23.0346338Z Installation Root: [/opt/hostedtoolcache/gcloud/303.0.0/x64]
2020-07-30T14:25:23.0346770Z Installed Components:
2020-07-30T14:25:23.0347217Z   bq: [2.0.58]
2020-07-30T14:25:23.0347670Z   gsutil: [4.52]
2020-07-30T14:25:23.0348070Z   core: [2020.07.24]
2020-07-30T14:25:23.0348634Z System PATH: [/opt/hostedtoolcache/gcloud/303.0.0/x64/bin:/home/linuxbrew/.linuxbrew/bin:/home/linuxbrew/.linuxbrew/sbin:/usr/share/rust/.cargo/bin:/home/runner/.config/composer/vendor/bin:/home/runner/.dotnet/tools:/snap/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games]
2020-07-30T14:25:23.0349672Z Python PATH: [/opt/hostedtoolcache/gcloud/303.0.0/x64/lib/third_party:/opt/hostedtoolcache/gcloud/303.0.0/x64/lib:/usr/lib/python36.zip:/usr/lib/python3.6:/usr/lib/python3.6:/usr/lib/python3.6/lib-dynload]
2020-07-30T14:25:23.0350249Z Cloud SDK on PATH: [True]
2020-07-30T14:25:23.0350685Z Kubectl on PATH: [/usr/bin/kubectl]
2020-07-30T14:25:23.0351473Z 
2020-07-30T14:25:23.0352167Z WARNING: There are other instances of the Google Cloud Platform tools on your system PATH.
2020-07-30T14:25:23.0352927Z   /usr/lib/google-cloud-sdk/bin/git-credential-gcloud.sh
2020-07-30T14:25:23.0353332Z   /usr/lib/google-cloud-sdk/bin/bq
2020-07-30T14:25:23.0353746Z   /usr/lib/google-cloud-sdk/bin/docker-credential-gcloud
2020-07-30T14:25:23.0354120Z   /usr/lib/google-cloud-sdk/bin/anthoscli
2020-07-30T14:25:23.0354499Z   /usr/lib/google-cloud-sdk/bin/gcloud
2020-07-30T14:25:23.0354831Z   /usr/lib/google-cloud-sdk/bin/gsutil
2020-07-30T14:25:23.0354971Z 
2020-07-30T14:25:23.0355182Z Installation Properties: [/opt/hostedtoolcache/gcloud/303.0.0/x64/properties]
2020-07-30T14:25:23.0355416Z User Config Directory: [/home/runner/.config/gcloud]
2020-07-30T14:25:23.0355719Z Active Configuration Name: [default]
2020-07-30T14:25:23.0355946Z Active Configuration Path: [/home/runner/.config/gcloud/configurations/config_default]
2020-07-30T14:25:23.0356116Z 
2020-07-30T14:25:23.0357169Z Account: [github-actions@***.iam.gserviceaccount.com]
2020-07-30T14:25:23.0357605Z Project: [***]
2020-07-30T14:25:23.0357692Z 
2020-07-30T14:25:23.0357961Z Current Properties:
2020-07-30T14:25:23.0358150Z   [core]
2020-07-30T14:25:23.0358540Z     account: [github-actions@***.iam.gserviceaccount.com]
2020-07-30T14:25:23.0358811Z     disable_usage_reporting: [True]
2020-07-30T14:25:23.0359161Z     project: [***]
2020-07-30T14:25:23.0359352Z   [metrics]
2020-07-30T14:25:23.0359767Z     environment: [github-actions-setup-gcloud]
2020-07-30T14:25:23.0359866Z 
2020-07-30T14:25:23.0360107Z Logs Directory: [/home/runner/.config/gcloud/logs]
2020-07-30T14:25:23.0360335Z Last Log File: [/home/runner/.config/gcloud/logs/2020.07.30/14.25.16.618342.log]
2020-07-30T14:25:23.0360494Z 
2020-07-30T14:25:23.0360800Z git: [b'git version 2.27.0']
2020-07-30T14:25:23.0361171Z ssh: [b'OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL 1.0.2n  7 Dec 2017']
2020-07-30T14:25:23.0361335Z 
2020-07-30T14:25:23.0361688Z

@bharathkkb I did notice that you were using docker pull instead of docker-compose pull

Jul 30 '20 14:07 austinpray

Thanks @austinpray! I just saw the docker-compose commands in your run.sh :)

Jul 30 '20 16:07 bharathkkb

Thank you @sorliem. The solution you linked also worked for me (gcloud version 304).

Also remark that adding

LD_LIBRARY_PATH=/usr/local/lib;

in the command line didn't worked. Variable has to be exported.

Aug 05 '20 07:08 rodrigobb

I was able to reproduce this here. I was also able to fix it with the temporary workaround from https://github.com/openssl/openssl/issues/5845#issuecomment-378601109 suggest by @sorliem.

I will continue to look into a possible long term fix.

Aug 08 '20 00:08 bharathkkb

Thank you @sorliem. The solution you linked also worked for me (gcloud version 304).

Also remark that adding

LD_LIBRARY_PATH=/usr/local/lib;

in the command line didn't worked. Variable has to be exported. I have this very same problem after updating my Ubuntu 18.04 environment gcloud but when setting D_LIBRARY_PATH=/usr/local/lib I can run my docker-compose build commands OK. Thx!

Aug 11 '20 12:08 eino-makitalo

I do not know if this is helpful if not excuse me: the same just happened to me after upgrading to 305.0.0. I am not sure what version I was running before but it was certainly 30x. Running Ubuntu 20.04 LTS. Exact error message below:

ERROR: gcloud failed to load: /tmp/_MEI3WIF2B/libssl.so.1.1: version `OPENSSL_1_1_1' not found (required by /usr/lib/python3.8/lib-dynload/_ssl.cpython-38-x86_64-linux-gnu.so)

Aug 12 '20 21:08 julianrutten

I got the same error on Ubuntu 18.04 and gcloud 304.0.0

export CLOUDSDK_PYTHON=/usr/bin/python worked for me as well.

Aug 14 '20 03:08 jacksonwbrito

@jtrh getting the same error as you while doing docker-compose build. I tried prefixing it with CLOUDSDK_PYTHON=$(which python3) didn't work either, same error.

System info:
$ gcloud -v
Google Cloud SDK 302.0.0
alpha 2020.07.17
beta 2020.07.17
bq 2.0.58
cloud-build-local
core 2020.07.17
gsutil 4.52
kubectl 1.15.11
pubsub-emulator 0.1.0

$ lsb_release --all
No LSB modules are available.
Distributor ID: LinuxMint
Description:    Linux Mint 19.3 Tricia
Release:        19.3
Codename:       tricia

$ docker-compose version
docker-compose version 1.24.1, build 4667896b
docker-py version: 3.7.3
CPython version: 3.6.8
OpenSSL version: OpenSSL 1.1.0j  20 Nov 2018
EDIT: this fixed it for me openssl/openssl#5845 (comment)

Thanks @sorliem Confirmed Workaround fix mine with:

gcloud -v Google Cloud SDK 307.0.0 bq 2.0.59 core 2020.08.21 gsutil 4.53

lsb_release --all Distributor ID: Ubuntu Description: Ubuntu 20.04.1 LTS Release: 20.04 Codename: focal

docker-compose version docker-compose version 1.26.2, build eefe0d31 docker-py version: 4.2.2 CPython version: 3.7.7 OpenSSL version: OpenSSL 1.1.0l 10 Sep 2019

python --version Python 3.8.2

Aug 25 '20 23:08 mikzuit

Why is LD_LIBRARY_PATH set to /tmp/_MEI3WIF2B/? Is this a bug with vendored python dependencies in docker-compose?

Aug 26 '20 10:08 nikolaik

I can confirm that @bharathkkb workaround mentioned with the export LD_LIBRARY_PATH=/usr/local/lib works for me !

By the way, to make things a bit harder to debug,I am using https://github.com/asdf-vm/asdf to install my stuff. But the workaround works

$ asdf list

argocd
  1.5.4
docker-compose
  1.26.0
gcloud
  293.0.0
gohugo
  extended_0.72.0
helm
  3.2.0
kubectl
  1.15.11
  1.16.11
kubesec
  0.9.2
kustomize
  3.5.5
  3.8.1
sops
  v3.5.0
stern
  1.11.0
terraform
  0.12.16
  0.12.18

So with

docker-compose
  1.26.0
gcloud
  293.0.0

Aug 26 '20 13:08 xakraz

export LD_LIBRARY_PATH=/usr/local/lib worked for me too.

Sep 03 '20 08:09 utamas

Debian 10 Buster gcloud 308 export CLOUDSDK_PYTHON=/usr/bin/python Worked for me too!

Sep 04 '20 01:09 gastonsilva

Installing Docker Compose with Pip fixed the issue for me. More details in https://github.com/GoogleCloudPlatform/docker-credential-gcr/issues/83#issuecomment-695072817.

Oct 09 '20 18:10 jtrh

Ran into this issue today using docker-compose to pull an image from GCR from my Ubuntu 20.10 WSL 2 distro.

I already had Python 3 installed (3.8.6 to be exact), but export CLOUDSDK_PYTHON=/usr/bin/python3 didn't work for me. The workaround export LD_LIBRARY_PATH=/usr/local/lib worked for me.

Oct 29 '20 21:10 mattwelke

I ran into this problem using docker-compose on Ubuntu 20.10 WSL 2 distro.

This fixed it for me:

export CLOUDSDK_PYTHON=/usr/bin/python2

(That's a 2 not a 3)

Oct 31 '20 00:10 michaelr

@michaelr, that only works if you install python2 or add a symlink from /usr/bin/python2 to /usr/bin/python3 (the latter not being recommended since it can lead to programs expecting Python 2 to crash because they're actually running under Python 3).

Ideally, this problem should be solved within the current state of modern Linux distros, which do not include Python 2.

Oct 31 '20 01:10 borfast

Seeing this in Linux odin 4.19.0-9-amd64 #1 SMP Debian 4.19.118-2 (2020-04-29) x86_64 GNU/Linux

Forced to revert back to python2.

Nov 05 '20 10:11 henryse

I've started getting this after updating docker-compose on my machine. It happens if I run docker-compose pull.

I was previously on a much older version of docker-compose, which worked. I can't remember which version, but it might have been installed as long ago as 2017.

EDIT: LD_LIBRARY_PATH=/usr/lib docker-compose pull my_service works. I suppose I shall use that as a workaround for now. Why gcloud expects to find libssl in /tmp/... is... not something I understand.

Error:

ERROR: gcloud failed to load: /tmp/_MEIMOBjio/libssl.so.1.1: version `OPENSSL_1_1_1' not found (required by /usr/lib/python3.6/lib-dynload/_ssl.cpython-36m-x86_64-linux-gnu.so)
    gcloud_main = _import_gcloud_main()
    import googlecloudsdk.gcloud_main
    from googlecloudsdk.api_lib.iamcredentials import util as iamcred_util
    from googlecloudsdk.api_lib.util import apis_internal
    from googlecloudsdk.core import properties
    from googlecloudsdk.core import config
    from oauth2client import client
    from oauth2client import transport
    import httplib2
    from httplib2.python3.httplib2 import *
    import ssl
    import _ssl             # if we can't import it, let the error propagate

This usually indicates corruption in your gcloud installation or problems with your Python interpreter.

Please verify that the following is the path to a working Python 2.7 or 3.5+ executable:
    /usr/bin/python3

The above is truncated. Full error here.

Relevant versions:

/usr/bin/python3 --version Python 3.6.9

I assume the Python executable being used is the one in /usr/bin/python3, since that's what's in the error message. However, for completeness:

which python3 /home/thom/.pyenv/shims/python3

python3 --version Python 3.6.9

gcloud version Google Cloud SDK 319.0.0 alpha 2020.11.13 beta 2020.11.13 bq 2.0.62 core 2020.11.13 gsutil 4.55 kubectl 1.16.13

lsb_release -d Description: Ubuntu 18.04.5 LTS

docker-compose version docker-compose version 1.27.4, build 40524192 docker-py version: 4.3.1 CPython version: 3.7.7 OpenSSL version: OpenSSL 1.1.0l 10 Sep 2019

openssl version OpenSSL 1.1.1 11 Sep 2018

which openssl /usr/bin/openssl

locate libssl.so.1.1 /snap/core18/1885/usr/lib/x86_64-linux-gnu/libssl.so.1.1 /snap/core18/1932/usr/lib/x86_64-linux-gnu/libssl.so.1.1 /snap/gnome-3-28-1804/128/usr/lib/x86_64-linux-gnu/libssl.so.1.1 /snap/gnome-3-28-1804/145/usr/lib/x86_64-linux-gnu/libssl.so.1.1 /snap/gnome-3-34-1804/36/usr/lib/x86_64-linux-gnu/libssl.so.1.1 /snap/gnome-3-34-1804/60/usr/lib/x86_64-linux-gnu/libssl.so.1.1 /usr/lib/x86_64-linux-gnu/libssl.so.1.1

Nov 24 '20 14:11 ThomWright

The magical incantation

export LD_LIBRARY_PATH=/usr/local/lib

as described above, worked for me.

Dec 02 '20 23:12 davidmoshal

Same problem here. Is there any known fix for the gihub action as described by the OP ?

Dec 03 '20 00:12 vicpara

export LD_LIBRARY_PATH=/usr/local/lib worked for me too.

I had the exact same problem. The above mentioned export worked for me.

Ubuntu 20.04 Google Cloud SDK 322.0.0

Thanks

Jan 11 '21 18:01 martin-dmtrv

For docker-compose on GitHub Actions, I'm also working around this by using:

    - uses: GoogleCloudPlatform/github-actions/setup-gcloud@master
      with:
        version: '297.0.1' # https://github.com/google-github-actions/setup-gcloud/issues/128
        ...

It would be great to not be stuck on 297.0.1 forever, the latest version at the time of writing is 324.0.0, any chances of an upstream fix?

Jan 21 '21 19:01 dgpc

The magical incantation
export LD_LIBRARY_PATH=/usr/local/lib
as described above, worked for me.

With newest version of gcloud (326.0.0) this no longer works :(

Feb 05 '21 19:02 jacek-jablonski

Same problem here.
GoogleCloudPlatform/github-actions/setup-gcloud may have been deprecated but it actually works reliably.

Feb 06 '21 09:02 vicpara

Hi @vicpara There should not be any difference between GoogleCloudPlatform/github-actions/setup-gcloud and google-github-actions/setup-gcloud w.r.t this issue as it is related to gcloud + docker-compose.

@jacek-jablonski I ran a quick test with 327 which seemed to work with the workaround https://github.com/bharathkkb/test-setup-gcloud-128/runs/1876995207 Could you share how it failed in your case?

Feb 11 '21 05:02 bharathkkb

@bharathkkb The issue I have with this new version is that it breaks gcloud auth configure-docker.

Here is my use case below.

build-deploy:
    needs: bump-version
    name: "Build and Deploy"
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout
        uses: actions/checkout@v2
        with:
          fetch-depth: 0

      - name: Setup GCP credentials
        uses: google-github-actions/setup-gcloud@master
        with:
          project_id: ${{ secrets.GCLOUD_PROJECT_ID }}
          service_account_key: ${{ secrets.GCP_SA_KEY_JSON }}
          export_default_credentials: true

      - name: Docker pull
        run: |
          gcloud auth configure-docker
          docker-compose pull

The error I get is:

Run gcloud auth configure-docker
  gcloud auth configure-docker
  docker-compose pull
  shell: /bin/bash -e ***0***
  env:
    GKE_PROJECT_ID: ***
    GKE_EMAIL: ***
    GITHUB_SHA: 819aa0a83ff3641e84c2ce6676260186c4344330
    GITHUB_BRANCH: refs/heads/master
    GKE_ZONE: ***
    GKE_CLUSTER: ***
    REGISTRY_HOSTNAME: eu.gcr.io
    DEPLOYMENT_ENV: rc
    DEPLOYMENT_COMMIT_SHA: 819aa0a83ff3641e84c2ce6676260186c4344330
    SEM_VERSION: ***
    VERSION_TIMESTAMP: 1614099296
    BUILDHASH: 819aa0a83ff3641e8412de6676260186c4344330
    BUILDTAG: 0.16.75.0
    CLOUDSDK_METRICS_ENVIRONMENT: github-actions-setup-gcloud
    GCLOUD_PROJECT: ***
    GOOGLE_APPLICATION_CREDENTIALS: /home/runner/work/core/core/c7331fe3-c987-4291-9289-4b0ac681b435
Adding credentials for all GCR repositories.
WARNING: A long list of credential helpers may cause delays running 'docker build'. We recommend passing the registry name to configure only the registry you are using.
After update, the following will be written to your Docker config file
 located at [/home/runner/.docker/config.json]:
 ***
  "credHelpers": ***
    "gcr.io": "gcloud",
    "us.gcr.io": "gcloud",
    "eu.gcr.io": "gcloud",
    "asia.gcr.io": "gcloud",
    "staging-k8s.gcr.io": "gcloud",
    "marketplace.gcr.io": "gcloud"
  ***
***

Do you want to continue (Y/n)?  
Docker configuration file updated.
Pulling xxxxxxxxxx        ... 
Pulling xxxxxxxxxx    ... 
Pulling xxxxxxxxxx ... 
Pulling xxxxxxxxxx ... 
Pulling xxxxxxxxxx-service        ... 
Pulling xxxxxxxxxx-service        ... 
ERROR: gcloud failed to load: /tmp/_MEINIeVty/libssl.so.1.1: version `OPENSSL_1_1_1' not found (required by /usr/lib/python3.6/lib-dynload/_ssl.cpython-36m-x86_64-linux-gnu.so)
    gcloud_main = _import_gcloud_main()
    import googlecloudsdk.gcloud_main
    from googlecloudsdk.calliope import base
    from googlecloudsdk.calliope import arg_parsers
    from googlecloudsdk.core import log
ERROR: for artifacts-service  Credentials store error: StoreError('Credentials store docker-credential-gcloud exited with "".')
Traceback (most recent call last):
  File "docker/credentials/store.py", line 80, in _execute
  File "subprocess.py", line 411, in check_output
  File "subprocess.py", line 512, in run
subprocess.CalledProcessError: Command '['/opt/hostedtoolcache/gcloud/329.0.0/x64/bin/docker-credential-gcloud', 'get']' returned non-zero exit status 1.

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "docker/auth.py", line 264, in _resolve_authconfig_credstore
  File "docker/credentials/store.py", line 35, in get
  File "docker/credentials/store.py", line 93, in _execute
docker.credentials.errors.StoreError: Credentials store docker-credential-gcloud exited with "".

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "docker-compose", line 3, in <module>
  File "compose/cli/main.py", line 80, in main
  File "compose/cli/main.py", line 192, in perform_command
  File "compose/metrics/decorator.py", line 18, in wrapper
  File "compose/cli/main.py", line 828, in pull
  File "compose/project.py", line 763, in pull
  File "compose/project.py", line 813, in parallel_pull
  File "compose/parallel.py", line 106, in parallel_execute
  File "compose/parallel.py", line 204, in producer
  File "compose/project.py", line 795, in pull_service
  File "compose/service.py", line 1236, in _do_pull
  File "docker/api/image.py", line 411, in pull
  File "docker/auth.py", line 48, in get_config_header
  File "docker/auth.py", line 324, in resolve_authconfig
  File "docker/auth.py", line 235, in resolve_authconfig
  File "docker/auth.py", line 281, in _resolve_authconfig_credstore
docker.errors.DockerException: Credentials store error: StoreError('Credentials store docker-credential-gcloud exited with "".')
Error: Process completed with exit code 255.

Feb 23 '21 17:02 vicpara

The magical incantation
export LD_LIBRARY_PATH=/usr/local/lib
as described above, worked for me.
With newest version of gcloud (326.0.0) this no longer works :(

Linux Mint 20.10 This is the cure in combination with export CLOUDSDK_PYTHON=/usr/bin/python3

Apr 30 '21 22:04 guywilsonjr

297.0.1 for arm64 doesn't seem to be available via apt-get anymore...

340.0.0-0 works with

export LD_LIBRARY_PATH=/usr/local/lib

May 18 '21 05:05 hidai

None of the solutions mentioned above helped me.

Before finally finding my own workaround, I tried:

downgrading gcloud to v297
upgrading gcloud to v340 (it was 330 initially)
export CLOUDSDK_PYTHON=/usr/bin/python3 and export LD_LIBRARY_PATH=/usr/local/lib (both were already in my .zshrc)
pip3 install docker-compose --upgrade
changed my local version of Python using pyenv to 3.7.10 which is the same as CPython used by my docker-compose (inspired by this answer)

For anyone using WSL, and probably future me:

What eventually helped me was realizing that because my Ubuntu runs docker-compose through WSL and the entire Docker runs on Windows, I might have some luck setting up the same container in Windows, and then just getting it back up from my usual WSL console and Ubuntu filesystem.

I cloned my repo to Windows filesystem, installed gcloud for Windows, set up gcloud authentication, ran docker-compose up from cmd, and sure enough Docker pulled the images and the container built just fine. Now that my Docker for Windows has all the dependency images, I don't have any trouble running the container from inside WSL.

Jun 02 '21 16:06 JoannaFalkowska

Debian 10 here, with gcloud v346 and python 3.7.3 (from debian packages). the export workaround didn't worked: gcloud still tries to find libraries in /tmp/something

Jul 05 '21 08:07 SimoneLazzaris

https://github.com/google-github-actions/setup-gcloud/issues/128#issuecomment-673864153 CLOUDSDK_PYTHON=/usr/bin/python worked for me while export CLOUDSDK_PYTHON=$(which python3) didn't work.

Jul 10 '21 06:07 dthanhtuan

I ran into this issue when running docker-compose in a GCP VM instance running Debian 10. Downgrading to Debian 9 resolved the issue.

Jul 29 '21 03:07 LiamAttClarke

FYI Today I removed the v297.0.1 workaround mentioned here, and things are once again working on the latest version of ubuntu & glcoud; I also moved to the new google-github-actions/setup-gcloud@master repository instead of uses: GoogleCloudPlatform/github-actions/setup-gcloud@master

Aug 07 '21 18:08 dgpc

Just happened with github actions ubuntu:latest and command gcloud auth configure-docker -q

Sep 06 '21 14:09 zeppelinen

Everyone here put their lucky number with this sdk. i will start from the most like answer

Sep 17 '21 17:09 aridjemana

Sep 17 '21 18:09 mattwelke

Thanks for the solutions posted in the comments.

In my case, what worked (gcloud sdk version from ~1st of October 2021) with Ubuntu 20.04 that had Python 3.8 installed, was:

installing app-engine-python (if I'm correct, installs Python 2.7)
export CLOUDSDK_PYTHON=/usr/bin/python2.7

Tried with to python 3 path but was still giving me the OPENSSL_1_1_1 not found error, but pinning/forcing to Python 2 is so far working without issues.

Oct 04 '21 17:10 Kartones

gcloud --version

Google Cloud SDK 362.0.0
alpha 2021.10.21
beta 2021.10.21
bq 2.0.71
core 2021.10.21
gsutil 5.4

I tried with export CLOUDSDK_PYTHON=/usr/bin/python3 export LD_LIBRARY_PATH=/usr/local/lib but neither of them worked for me. I'm facing this error when i do sudo docker-compose pull my_image, but if I try withoud sudo, i got:

ERROR: for web  unauthorized: You don't have the needed permissions to perform this operation, and you may have invalid credentials. To authenticate your request, follow the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication

ERROR: unauthorized: You don't have the needed permissions to perform this operation, and you may have invalid credentials. To authenticate your request, follow the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication

I fixed with authentication in gcloud withoud sudo:

gcloud auth login
gcloud config set project my_project_id
gcloud auth configure-docker

Then, I could do: docker-compose pull my_image

Nov 03 '21 17:11 LegolasVzla

It also happened to me with Linux (Ubuntu 20.04) and it was related with sudo configuration.

I solved with sudo docker-compose xxxx

Even if I make a groupadd configuration, it continues showing this error 😭

Nov 11 '21 22:11 lorainegarutti

Just ran into this today and the previously suggested fixes didn't work for me. I ended up re-installing docker-compose which sorted out this issue (pip install docker-compose)

Config:

GH Action runner 2.287.1
Ubuntu v20.04.3
google-github-actions/[email protected]
Google Cloud SDK 370.0.0
Python 3.8.10

Jan 31 '22 23:01 lcampos

setup-gcloud
setup-gcloud copied to clipboard

docker-credential-gcloud + gcloud 298.0.0 + ubuntu-18.04: "OPENSSL_1_1_1 not found" error

TL;DR

Reproduction

setup-gcloud setup-gcloud copied to clipboard

docker-credential-gcloud + gcloud 298.0.0 + ubuntu-18.04: "OPENSSL_1_1_1 not found" error

TL;DR

Reproduction

setup-gcloud
setup-gcloud copied to clipboard