通过gcloud使用工作者身份

问题描述

我有2个带有gcloud sdk的docker imags，我的入口点脚本使用gcloud执行了一些检查，如下所示

gcloud pubsub subscriptions describe $GCP_SUB_NAME --quiet
result="$?"

if [ "$result" -ne 0 ]; then
    echo "Subscription not found,exited with non-zero status $result"
    exit $result
fi

我正在gke中运行这些...

对于每个使用工作负载标识连接到GKE服务帐户的docker映像，我都有一个不同的GCP服务帐户。

我的问题是两个部署无法同时成功。先运行的一个成功，其他运行失败，并显示以下错误。与gke / GCP凭证有关。

我收到以下错误

    gcloud pubsub subscriptions describe local-test-v1 --quiet
ERROR: (gcloud.pubsub.subscriptions.describe) You do not currently have an active account selected.
Please run:

  $ gcloud auth login

to obtain new credentials.

If you have already logged in with a different account:

    $ gcloud config set account ACCOUNT

to select an already authenticated account to use.

即使进行以下更改，我也无法通过

gcloud config set account [email protected]

gcloud pubsub subscriptions describe $GCP_SUB_NAME --quiet
    result="$?"
    
    if [ "$result" -ne 0 ]; then
        echo "Subscription not found,exited with non-zero status $result"
        exit $result
    fi

我现在得到的错误

gcloud config set account [email protected]
Updated property [core/account].
+ gcloud pubsub subscriptions describe local-test-v1 --quiet
ERROR: (gcloud.pubsub.subscriptions.describe) Your current active account [[email protected]] does not have any valid credentials
Please run:

  $ gcloud auth login

to obtain new credentials.

For service account,please activate it first:

  $ gcloud auth activate-service-account ACCOUNT

我不想使用GCP客户端库，因为我想保持它的重量轻，因此无论是gcloud r curl还是最佳选择。

我可以在没有密钥文件的情况下在GKE中使用gcloud吗？

我可以通过curl调用googleapis而不传递承载令牌吗？如何在docker容器中获取它？

任何想法...谢谢...

注1：工作负载标识

resource "google_service_account_iam_member" "workload_identity_iam" {
  
member = "serviceAccount:${var.gcp_project}.svc.id.goog[${var.kubernetes_namespace}/${var.kubernetes_service_account_name}]"
   
role   = "roles/iam.workloadIdentityUser"    

service_account_id = google_service_account.sa.name    

depends_on = [google_project_iam_member.pubsub_subscriber_iam,google_project_iam_member.bucket_object_admin_iam]  }

注意事项2：GKE SA

Name:                sa1
Namespace:           some-namespace
Labels:              <none>
Annotations:         iam.gke.io/gcp-service-account: [email protected]
Image pull secrets:  <none>
Mountable secrets:   sa1-token-shj9w
Tokens:              sa1-token-shj9w
Events:              <none>

Name:                sa2  
Namespace:           some-namespace 
Labels:              <none> 
Annotations:         iam.gke.io/gcp-service-account: [email protected] 
Image pull secrets:            <none>
Mountable secrets:   sa2-token-dkhdl 
Tokens:              sa2-token-dkhdl 
Events:              <none>

注意＃3：容器的作业模板

apiVersion: batch/v1
kind: Job
Metadata:
  namespace: some-namespace
  name: check
  labels:
    helm.sh/chart: check-0.1.0
    app.kubernetes.io/name: check
    app.kubernetes.io/instance: check
    app: check
    app.kubernetes.io/version: "0.1.0"
    app.kubernetes.io/managed-by: Helm
  annotations:
        helm.sh/hook: pre-install,pre-upgrade
        helm.sh/hook-weight: "-4"
spec:
  backoffLimit: 1
  completions: 1
  parallelism: 1
  template:
    Metadata:
      name: check
      labels:
        app.kubernetes.io/name: check
        app.kubernetes.io/instance: check
        app: check
    spec:
      restartPolicy: Never
      terminationGracePeriodSeconds: 0
      serviceAccountName: sa1
      securityContext:
        {}
      containers:
        - name: check
          securityContext:
            {}
          image: "eu.gcr.io/some-project/check:500c4166"
          imagePullPolicy: Always
          env:
            # Define the environment variable
            - name: GCP_PROJECT_ID
              valueFrom:
                configMapKeyRef:
                  name: check
                  key: gcpProjectID
            - name: GCP_SUB
              valueFrom:
                configMapKeyRef:
                  name: check
                  key: gcpsubscriptionName
            - name: GCP_BUCKET
              valueFrom:
                configMapKeyRef:         
                  name: check
                  key: gcpBucket
          resources:
            limits:
              cpu: 1000m
              memory: 128Mi
            requests:
              cpu: 100m
              memory: 128Mi

Docker映像：

FROM ubuntu:18.04

copY /checks/pre/ /checks/pre/
ENV HOME /checks/pre/
# Install needed packages
RUN apt-get update && \
    apt-get -y install --no-install-recommends curl \
    iputils-ping \
    tar \
    jq \
    python \
    ca-certificates \
    && mkdir -p /usr/local/gcloud && cd /usr/local/gcloud \
    && curl -o google-cloud-sdk.tar.gz -L -O https://dl.google.com/dl/cloudsdk/release/google-cloud-sdk.tar.gz \
    && tar -xzf google-cloud-sdk.tar.gz \
    && rm -f google-cloud-sdk.tar.gz \
    && ./google-cloud-sdk/install.sh --quiet \
    && mkdir -p /.config/gcloud && chmod 775 -R /checks/pre /.config/gcloud \
    && apt-get autoclean \
    && apt-get autoremove \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

ENV PATH $PATH:/usr/local/gcloud/google-cloud-sdk/bin

workdir /checks/pre

USER 1001

ENTRYPOINT [ "/checks/pre/entrypoint.sh" ]

解决方法

暂无找到可以解决该程序问题的有效方法，小编努力寻找整理中！

如果你已经找到好的解决方法，欢迎将解决方案带上本链接一起发送给小编。

小编邮箱:dio#foxmail.com (将#修改为@）

gcloud google-cloud-iam google-cloud-platform google-kubernetes-engine