在 gitlab CI/CD 中验证 gcloud 服务帐户

Question

我正在使用 gcloud-service-key.json 从 gitlab-ci.yml 文件将服务部署到 gcloud。我收到这个错误

$ google-cloud-sdk/bin/gcloud auth activate-service-account --key-file ${HOME}/gcloud-service-key.json 错误：gcloud 崩溃（ValueError）：无法检测到密钥。

在下面找到代码片段的子集

 - apk add --update make ca-certificates openssl python --repository https://alpine.global.ssl.fastly.net/alpine/v3.10/community --repository https://alpine.global.ssl.fastly.net/alpine/v3.10/main && rm -fR /var/cache/apk/*
  - update-ca-certificates
  # Write our GCP service account private key into a file
  - echo $GCLOUD_SERVICE_KEY > ${HOME}/gcloud-service-key.json
  # Download and install Google Cloud SDK
  - wget https://dl.google.com/dl/cloudsdk/release/google-cloud-sdk.tar.gz
  - tar zxvf google-cloud-sdk.tar.gz && ./google-cloud-sdk/install.sh --usage-reporting=false --path-update=true
  - google-cloud-sdk/bin/gcloud --quiet components update
  - google-cloud-sdk/bin/gcloud auth activate-service-account --key-file ${HOME}/gcloud-service-key.json

任何帮助将不胜感激，我已经这样做好几天了。

Answer 1

您的密钥文件似乎有问题。尝试使用 gcloud 生成新的：

$ gcloud iam service-accounts keys create key1.json --iam-account=test123@xxxxx.iam.gserviceaccount.com
created key [6ca5ffc929f31d1f1915d430887a7fa3689eb69d] of type [json] as [key1.json] for [test123@xxxxx.iam.gserviceaccount.com]

还有一个如何生成密钥的官方文档- 如果有疑问，请随时查看。

您的json密钥文件应如下所示：

{
  "type": "service_account",
  "project_id": "xxxxxx,
  "private_key_id": "6ca5ffc929f31d1f1915d430887a7fa3689eb69d",
  "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAAsdfsd234fesSiAgEAAoIBAQDKnmI67Aw3DgHM\n1b25LH1jRAV0pt6hjTEeJGH$
  "client_email": "test123@xxxxx.iam.gserviceaccount.com",
  "client_id": "110107674812168412361",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/test123@xxxxx.iam.gserviceaccount.com"
}

如果您的文件看起来不同，请检查该echo $GCLOUD_SERVICE_KEY > ${HOME}/gcloud-service-key.json部分。可能是变量的问题$GCLOUD_SERVICE_KEY。

此外，如果您对激活帐户有任何疑问，还有另一份有关如何激活帐户的文档。