curl如何基于本地gcloud的CLI身份验证向Google Cloud进行身份验证? [英] How can curl authenticate to Google Cloud based on local gcloud's CLI authentication?

问题描述

我的脚本使用了一系列gcloud命令，当然gcloud已通过身份验证.我需要使用curl来访问gcloud无法使用的GCP REST API.我可以通过在Cloud Console中生成JSON凭证文件来做到这一点，但我不希望将其作为单独的手动步骤进行.

这就是我现在的方法，使用从控制台下载的JSON文件.

    GOOGLE_APPLICATION_CREDENTIALS=credentials.json
    curl -X POST -H "Authorization: Bearer \"$(gcloud auth application-default print-access-token)\"" \
              -H "Content-Type: application/json; charset=utf-8" \
                 https://cloudresourcemanager.googleapis.com/v1/projects/<MY_PROJECT>:getAncestry

如果没有下载JSON，我会得到:

 ERROR: (gcloud.auth.application-default.print-access-token)
 The Application Default Credentials are not available. They are available if running in Google Compute Engine.
 Otherwise, the environment variable  GOOGLE_APPLICATION_CREDENTIALS must be defined pointing
 to a file defining the credentials. See https://developers.google.com/accounts/docs/application-default-credentials 
 for more information.
    { "error": {
        "code": 401,
        "message": "Request had invalid authentication credentials.
Expected OAuth 2 access token, login cookie or other valid authentication credential.
 See https://developers.google.com/identity/sign-in/web/devconsole-project.",
        "status": "UNAUTHENTICATED"
      }
    }

我如何利用我的gcloud身份验证来使用curl?如果可以在脚本中自动生成JSON，我不介意使用JSON.例如，是否有一种方法可以调用gcloud生成此JSON，然后将其设置为GOOGLE_APPLICATION_CREDENTIALS?

解决方案

对Cloud SDK进行身份验证后，就可以使用 gcloud auth应用程序默认登录命令. >

My script uses a sequence of gcloud commands and of course gcloud is authenticated. I need to use curl to access GCP REST APIs that are not available to gcloud. I can do this by generating a JSON credentials file in the Cloud Console, but I'd rather not do that as a separate manual step.

[Edit: The answer is to replace the gcloud auth string in that curl command with gcloud auth print-access-token. See answer below.]

This is how I do it now, using a JSON file downloaded from the Console.

    GOOGLE_APPLICATION_CREDENTIALS=credentials.json
    curl -X POST -H "Authorization: Bearer \"$(gcloud auth application-default print-access-token)\"" \
              -H "Content-Type: application/json; charset=utf-8" \
                 https://cloudresourcemanager.googleapis.com/v1/projects/<MY_PROJECT>:getAncestry

Without that downloaded JSON, I get this:

 ERROR: (gcloud.auth.application-default.print-access-token)
 The Application Default Credentials are not available. They are available if running in Google Compute Engine.
 Otherwise, the environment variable  GOOGLE_APPLICATION_CREDENTIALS must be defined pointing
 to a file defining the credentials. See https://developers.google.com/accounts/docs/application-default-credentials 
 for more information.
    { "error": {
        "code": 401,
        "message": "Request had invalid authentication credentials.
Expected OAuth 2 access token, login cookie or other valid authentication credential.
 See https://developers.google.com/identity/sign-in/web/devconsole-project.",
        "status": "UNAUTHENTICATED"
      }
    }

How can I leverage my gcloud authentication to use curl? I don't mind using the JSON if I can automate its generation as part of this script. For example, is there a way to call gcloud to generate this JSON, which I would then set as GOOGLE_APPLICATION_CREDENTIALS?

解决方案

Once you have the Cloud SDK authenticated, you can use the gcloud auth print-access-token command to get an access token for the current active account, without the need of specifying the path to the JSON credentials file.

You will still need the credentials.json file, if you wish to activate a service account for the Cloud SDK instance. However, I am pretty sure you will only have to do that once.

EDIT:

I noticed you are using the gcloud auth application-default print-access-token.

Keep in mind that, contrary to the gcloud auth print-access-token command, it uses the current Application Default Credential (ADC), which has to be set by specifying the credentials.json file path with the GOOGLE_APPLICATION_CREDENTIALS env variable, or by using the gcloud auth application-default login command.

这篇关于curl如何基于本地gcloud的CLI身份验证向Google Cloud进行身份验证?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！