PCDOE Building and implementing CI/CD pipelines Practice Question
A team uses Cloud Build with a Kaniko builder to containerize their application. The build fails with the error: 'failed to push to destination: failed to get credentials: failed to get credential from metadata service: failed to fetch metadata...' What is the most likely cause?
⚠ Common exam trap
Google Cloud often tests the misconception that Kaniko requires a Docker daemon (Option A), but the real issue is almost always a missing IAM permission on the target registry bucket.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Cloud Build service account does not have the storage.objectAdmin role on the Container Registry bucket.
The error indicates that Kaniko cannot authenticate to push the built image to Container Registry. Kaniko uses the Cloud Build service account's credentials to authenticate with the registry. By default, the Cloud Build service account has the storage.objectViewer role on the Container Registry bucket, which allows pulling images but not pushing. To push, the service account needs the storage.objectAdmin or storage.objectCreator role on the bucket. Option D correctly identifies this missing permission as the most likely cause.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Kaniko requires a running Docker daemon in the build step.
Why it's wrong here
Kaniko is daemonless; it does not need Docker.
- ✗
The base image specified in the Dockerfile is not accessible from the build environment.
Why it's wrong here
Pull errors are different; the error indicates push failure.
- ✗
The Dockerfile has an invalid instruction causing Kaniko to fail.
Why it's wrong here
Syntax errors produce different error messages.
- ✓
The Cloud Build service account does not have the storage.objectAdmin role on the Container Registry bucket.
Why this is correct
Missing push permissions cause credential failures.
Go deeper
Related to this question
About these practice questions
One of 486 original PCDOE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCDOE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCDOE exam.