firestore: missing ca-certificates results in timeouts when running queries

[mvdan]

Client

Connecting to a Firestore database and running a simple query, like listing all the root collections.

ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
defer cancel()
client, err := firestore.NewClient(ctx, projectID)
if err != nil {
        panic(err)
}
refs, err := store.Collections(ctx).GetAll()
if err != nil {
        panic(err)
}
for _, ref := range refs {
        fmt.Println(ref.Path)
}

Describe Your Environment

Plain alpine:3.7 docker image running on a GKE pod. GOOGLE_APPLICATION_CREDENTIALS is set up to point to a service account via a secret, with the right permissions to access the Firestore project.

Expected Behavior

The program either lists the root collections, or errors in a meaningful way.

Actual Behavior

A context deadline exceeded error.

The "fix" here, after much debugging, was running apk add ca-certificates as part of the Dockerfile.

I presume that this isn't expected behavior. The timeout error confused me to the point that I was looking for networking and firestore setup issues for a few hours.

I can provide a small piece of code to reproduce the bug with a project ID and service account as input, if that would be helpful. Though it would be pretty much the same as what I described above.

[jeanbza]

Thanks for reporting this. This is a known issue to us, and unfortunately is a problem in grpc. Please see: #791 (comment).

This is being tracked in grpc. As such, I'll close this issue in the meantime.

[mvdan]

@jadekler so, after following a bunch of closed issues, I get to a pull request that supposedly fixed this and was merged all the way back in February. Does that mean that the Go packages are already fixed, or will this be shipped in a future release?

Thanks for the quick response, in any case!

[jeanbza]

grpc/grpc-go#1742 is the tracking issue