在GitLab CI/CD中认证gcloud服务帐户

Question

我正在使用gcloud-service-key.json文件将一个服务部署到gcloud，通过gitlab-ci.yml文件进行。但是，我遇到了以下错误：

$ google-cloud-sdk/bin/gcloud auth activate-service-account --key-file ${HOME}/gcloud-service-key.json ERROR: gcloud crashed (ValueError): No key could be detected.

以下是代码片段的子集：

 - apk add --update make ca-certificates openssl python --repository https://alpine.global.ssl.fastly.net/alpine/v3.10/community --repository https://alpine.global.ssl.fastly.net/alpine/v3.10/main && rm -fR /var/cache/apk/*
  - update-ca-certificates
  # Write our GCP service account private key into a file
  - echo $GCLOUD_SERVICE_KEY > ${HOME}/gcloud-service-key.json
  # Download and install Google Cloud SDK
  - wget https://dl.google.com/dl/cloudsdk/release/google-cloud-sdk.tar.gz
  - tar zxvf google-cloud-sdk.tar.gz && ./google-cloud-sdk/install.sh --usage-reporting=false --path-update=true
  - google-cloud-sdk/bin/gcloud --quiet components update
  - google-cloud-sdk/bin/gcloud auth activate-service-account --key-file ${HOME}/gcloud-service-key.json

非常感谢您的帮助，我已经做了几天了。

- Isaac McSey

Answer 1

看起来您的密钥文件出现了问题。尝试使用gcloud生成新的密钥文件：

$ gcloud iam service-accounts keys create key1.json --iam-account=[e-mail]
created key [6ca5ffc929f31d1f1915d430887a7fa3689eb69d] of type [json] as [key1.json] for [[e-mail]]

还有一份官方文档说明如何生成密钥，如果有疑问，请随时查阅。

您的json密钥文件应该长这样：

{
  "type": "service_account",
  "project_id": "xxxxxx,
  "private_key_id": "6ca5ffc929f31d1f1915d430887a7fa3689eb69d",
  "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAAsdfsd234fesSiAgEAAoIBAQDKnmI67Aw3DgHM\n1b25LH1jRAV0pt6hjTEeJGH$
  "client_email": "[e-mail]",
  "client_id": "110107674812168412361",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/[e-mail]"
}

如果您的文件看起来不同，请检查echo $GCLOUD_SERVICE_KEY > ${HOME}/gcloud-service-key.json部分。这可能是由于$GCLOUD_SERVICE_KEY变量出现问题。

此外，如果您对激活帐户有任何疑问，还有另一篇文档介绍如何操作。 链接在此。

- Wojtek_B