我正在嘗試在 GCP 中使用 Python 創建一個服務帳戶。當我將 env var GOOGLE_APPLICATION_CREDENTIALS 設定為 JSON 憑據檔案并使用以下代碼時，這可以正常作業：
GoogleCredentials.get_application_default()
但是，以下代碼在 CI - Github Actions using Workload Identity Federation 中失敗：
import google
import googleapiclient.discovery
import os
from util import get_service_name
environment = os.getenv('ENVIRONMENT')
def create_service_account(requested_project_id):
project_id = requested_project_id
credentials = google.auth.default()
service = googleapiclient.discovery.build(
'iam', 'v1', credentials=credentials)
service_account_name = f'svc-{get_service_name()}'
service_accounts = service.projects().serviceAccounts().list(
name='projects/' project_id).execute()
service_account_exists = False
for account in service_accounts['accounts']:
if (service_account_name in account['name']):
service_account_exists = True
service_account = account
break
if (service_account_exists == False):
service_account = service.projects().serviceAccounts().create(
name='projects/' project_id,
body={
'accountId': service_account_name,
'serviceAccount': {
'displayName': service_account_name
}
}).execute()
print(f'{"Already Exists" if service_account_exists else "Created"} service account: ' service_account['email'])
return service_account
失敗并出現錯誤：
File "/opt/hostedtoolcache/Python/3.9.0/x64/lib/python3.9/site-packages/googleapiclient/_helpers.py", line 131, in positional_wrapper
return wrapped(*args, **kwargs) File "/opt/hostedtoolcache/Python/3.9.0/x64/lib/python3.9/site-packages/googleapiclient/discovery.py", line 298, in build
service = build_from_document( File "/opt/hostedtoolcache/Python/3.9.0/x64/lib/python3.9/site-packages/googleapiclient/_helpers.py", line 131, in positional_wrapper
return wrapped(*args, **kwargs) File "/opt/hostedtoolcache/Python/3.9.0/x64/lib/python3.9/site-packages/googleapiclient/discovery.py", line 600, in build_from_document
http = _auth.authorized_http(credentials) File "/opt/hostedtoolcache/Python/3.9.0/x64/lib/python3.9/site-packages/googleapiclient/_auth.py", line 119, in authorized_http
return credentials.authorize(build_http()) AttributeError: 'tuple' object has no attribute 'authorize'
我正在使用以下 Github Action 向 Google 進行身份驗證
- name: Authenticate to Google Cloud To Create Service Account
uses: google-github-actions/[email protected]
with:
workload_identity_provider: 'projects/xxx/locations/global/workloadIdentityPools/github-actions-identity-pool/providers/github-provider'
service_account: '[email protected]'
任何人都可以幫忙嗎？
uj5u.com熱心網友回復：
你有兩個問題。這行代碼失敗了：
credentials = google.auth.default()
問題 1 - 生成 Google OAuth 訪問令牌
將 GitHub 操作步驟更改為：
- name: Authenticate to Google Cloud To Create Service Account
uses: google-github-actions/[email protected]
with:
token_format: 'access_token' # Your python code needs an access token
access_token_lifetime: '300s' # make this value small but long enough to complete the job
workload_identity_provider: 'projects/xxx/locations/global/workloadIdentityPools/github-actions-identity-pool/providers/github-provider'
service_account: '[email protected]'
問題 2 - 創建憑證
此行將不起作用，因為 ADC（應用程式默認憑據）不提供憑據。
credentials = google.auth.default()
將 Workload Identity Federation 生成的訪問令牌從 GitHub Actions 輸出傳遞到您的程式：
${{ steps.auth.outputs.access_token }}
從訪問令牌創建憑據：
credentials = google.oauth2.credentials.Credentials(access_token)
service = googleapiclient.discovery.build('iam', 'v1', credentials=credentials)
轉載請註明出處，本文鏈接：https://www.uj5u.com/qukuanlian/414997.html
標籤：