如何在 docker Ubuntu 映像上验证谷歌云 SDK? [英] How to authenticate google cloud SDK on a docker Ubuntu image?

问题描述

我对如何在 docker 容器上对 gcloud sdk 进行身份验证有点困惑.现在，我的 docker 文件包括以下内容:

I am a bit confused about how I can authenticate the gcloud sdk on a docker container. Right now, my docker file includes the following:

#Install the google SDK
RUN curl https://dl.google.com/dl/cloudsdk/release/google-cloud-sdk.tar.gz > /tmp/google-cloud-sdk.tar.gz
RUN mkdir -p /usr/local/gcloud
RUN tar -C /usr/local/gcloud -xvf /tmp/google-cloud-sdk.tar.gz
RUN /usr/local/gcloud/google-cloud-sdk/install.sh
RUN /usr/local/gcloud/google-cloud-sdk/bin/gcloud init

但是，我很困惑如何进行身份验证?当我在我的机器上运行 gcloud auth application-default login 时，它会在 chrome 中打开一个新选项卡，提示我登录.如果它在容器中的 google chrome 中打开一个新选项卡，我将如何在 docker 容器上输入我的凭据?

However, I am confused how I would authenticate? When I run gcloud auth application-default login on my machine, it opens a new tab in chrome which prompts me to login. How would I input my credentials on the docker container if it opens a new tab in google chrome in the container?

推荐答案

在设置 docker 容器时，您可以考虑使用 deb 包，就像在 docker hub.

You might consider using deb packages when setting up your docker container as it is done on docker hub.

也就是说你不应该运行 gcloud init 或 gcloud auth application-default login 或 gcloud auth login...那些是交互式命令哪个启动浏览器.要向容器提供凭据，请为其提供服务帐户密钥文件.

That said you should NOT run gcloud init or gcloud auth application-default login or gcloud auth login... those are interactive commands which launch browser. To provide credentials to the container supply it with service account key file.

您可以从云控制台下载一个:https:///console.cloud.google.com/iam-admin/serviceaccounts/project?project=YOUR_PROJECT 或使用 gcloud 命令

You can download one from cloud console: https://console.cloud.google.com/iam-admin/serviceaccounts/project?project=YOUR_PROJECT or create it with gcloud command

gcloud iam service-accounts keys create

请参阅参考指南.

无论哪种方式，一旦您拥有密钥文件，将其添加到您的容器中并运行

Either way once you have the key file ADD it to your container and run

gcloud auth activate-service-account --key-file=MY_KEY_FILE.json

您现在应该已经设置好了，但是如果您想将其用作应用程序默认凭据 (ADC)，即在其他库和工具的上下文中，您需要设置以下环境变量以指向密钥文件:

You should be now set, but if you want to use it as Application Default Credentials (ADC), that is in the context of other libraries and tools, you need to set the following environment variable to point to the key file:

export GOOGLE_APPLICATION_CREDENTIALS=/the/path/to/MY_KEY_FILE.json

这里要指出的一件事是 gcloud 工具不使用 ADC，所以稍后如果您将帐户更改为其他内容，例如通过

One thing to point out here is that gcloud tool does not use ADC, so later if you change your account to something else, for example via

gcloud config set core/account [e-mail]

其他工具和库将继续通过 ADC 密钥文件使用旧帐户，但 gcloud 现在将使用不同的帐户.

other tools and libraries will continue using old account via ADC key file but gcloud will now use different account.

这篇关于如何在 docker Ubuntu 映像上验证谷歌云 SDK?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！