Usando chaves JSON com o google cloud gsutil

Question

Eu tenho uma chave privada ssh em um arquivo key.json e quero usar essa credencial para acessar um intervalo de armazenamento usando gsutil.

Não consigo encontrar nada sobre como incluir as chaves json como um método de autenticação, apenas campos "privados" e "secretos".

A estrutura do arquivo é:

{ "private_key_id": "private_key": "-----BEGIN PRIVATE KEY-- ... "client_email": "client_id": "type": "service_account" }

Como eu uso esse arquivo?

Obrigado

    

Answer 1

A versão curta é executar o seguinte comando e seguir as instruções:

gsutil config -e

A ferramenta gsutil tem ajuda integrada que pode ser consultada para todos os tipos de opções e modos de operação. Ao executar gsutil help creds , uma das opções de ajuda recomendadas ao executar gsutil sozinho, podemos ler a seção " OAuth2 Service Account " para ver as instruções para usar o arquivo de chave json de uma conta de serviço:

OAuth2 Service Account:

This is the preferred type of credential to use when authenticating on
behalf of a service or application (as opposed to a user). For example, if
you will run gsutil out of a nightly cron job to upload/download data,
using a service account allows the cron job not to depend on credentials of
an individual employee at your company. This is the type of credential that
will be configured when you run "gsutil config -e".

It is important to note that a service account is considered an Editor by
default for the purposes of API access, rather than an Owner. In particular,
the fact that Editors have OWNER access in the default object and
bucket ACLs, but the canned ACL options remove OWNER access from
Editors, can lead to unexpected results. The solution to this problem is to
ensure the service account is an Owner in the Permissions tab for your
project. To find the email address of your service account, visit the
'Google Developers Console <https://cloud.google.com/console#/project>'_,
click on the project you're using, click "APIs & auth", and click
"Credentials".

To create a service account, visit the Google Developers Console and then:

   - Click "APIs & auth" in the left sidebar.

   - Click "Credentials".

   - Click "Create New Client ID".

   - Select "Service Account" as your application type.

   - Save the JSON private key or the .p12 private key and password
     provided.

For further information about account roles, see:
  https://developers.google.com/console/help/#DifferentRoles

For more details about OAuth2 service accounts, see:
  https://developers.google.com/accounts/docs/OAuth2ServiceAccount

    

Answer 2

A partir de hoje, gsutil config -e ainda está no documento quando você executa gsutil help config , mas não funciona. gsutil help creds diz para fazer primeiro gcloud auth activate-service-account

Então eu fiz gcloud auth activate-service-account --key-file=mycredentialsialreadyhad.json

O preenchimento de ~/.config/gcloud/ e gsutil agora funciona.

OAuth2 Service Account: This is the preferred type of credential to use when authenticating on behalf of a service or application (as opposed to a user). (...). This is the type of credential that will be configured when you run "gsutil config -e". To configure service account credentials when installed via the Cloud SDK, run "gcloud auth activate-service-account".