我在 docker 镜像内部和外部发现了不同的行为,用于验证 google 服务帐户。
在外面。成功了。
C:\Users\Ben\AppData\Local\Google\Cloud SDK>gcloud auth activate-service-account 773889352370-compute@developer.gserviceaccount.com --key-file C:/Users/Ben/Dropbox/Google/MeerkatReader-d77c0d6aa04f.json --project api-project-773889352370
Activated service account credentials for: [773889352370-compute@developer.gserviceaccount.com]
运行 docker 容器,将 .json key 传递给 tmp 目录。
C:\Users\Ben\AppData\Local\Google\Cloud SDK>docker run -it -v C:/Users/Ben/Dropbox/Google/MeerkatReader-d77c0d6aa04f.json:/tmp/MeerkatReader-d77c0d6aa04f.json --rm -p "127.0.0.1:8080:8080" --entrypoint=/bin/bash gcr.io/cloud-datalab/datalab:local-20161227
在 docker 中,确认文件存在
root@4a4a9314f15c:/tmp# ls
MeerkatReader-d77c0d6aa04f.json npm-24-b7aa1bcf npm-45-fd13ef7c npm-7-22ec336e
运行与以前相同的命令。失败。
root@4a4a9314f15c:/tmp# gcloud auth activate-service-account 773889352370-compute@developer.gserviceaccoun
t.com --key-file MeerkatReader-d77c0d6aa04f.json --project api-project-773889352370
ERROR: (gcloud.auth.activate-service-account) Failed to activate the given service account. Please ensure provided key file is valid.
什么可能导致此错误?更广泛地说,suggested strategy 是什么?用于传递凭据。我已经尝试过了,它也失败了。我正在使用 cloudml API 和云视觉,我想避免在每次运行开始时手动 gcloud init。
编辑:显示 gcloud 信息
root@7ff49b26484f:/# gcloud info --run-diagnostics
Network diagnostic detects and fixes local network connection issues.
Checking network connection...done.
Reachability Check passed.
Network diagnostic (1/1 checks) passed.
确认相同的行为
root@7ff49b26484f:/tmp# gcloud auth activate-service-account 773889352370-compute@developer.gserviceaccount.com --key-file MeerkatReader-d77c0d6aa04f.json --project api-project-773889352370
ERROR: (gcloud.auth.activate-service-account) Failed to activate the given service account. Please ensure provided key file is valid.
最佳答案
这可能是由于 docker VM 的时钟偏差。我调试了google SDK的activate-service-account功能,得到如下错误信息:
There was a problem refreshing your current auth tokens: invalid_grant:
Invalid JWT: Token must be a short-lived token and in a reasonable timeframe
Please run:
$ gcloud auth login
to obtain new credentials, or if you have already logged in with a different account:
$ gcloud config set account ACCOUNT
to select an already authenticated account to use.
重新启动虚拟机后,它就像一个魅力。
关于docker - 在 docker 镜像上验证 Google Cloud 服务帐户,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/41605801/