The nightly export to Cloud Storage fails: “invalid_grant: Invalid JWT Signature”

Agrumes de l'Oriental, a citrus export cooperative near Oujda, uploads its delivery notes every night at 02:00 to the bucket gs://agrumes-oriental-bl-prod, read in the morning by the freight forwarder. The export-bl job runs on an on-site server, srv-export-oujda (outside Google Cloud): it authenticates with a JSON key of the service account sa-export-bl@agrumes-oriental-prod-2290.iam.gserviceaccount.com, stored in /etc/export-bl/sa-export.json.

This morning, no file was uploaded and the freight forwarder is holding three trucks in Nador. The server has not been touched. Yesterday afternoon, the IT department held an IAM console “cleanup day”.

You are connected over SSH to srv-export-oujda, where gcloud is authenticated with your administrator account (project agrumes-oriental-prod-2290, number 772104938561).