用Bitbucket管道认证GCP服务帐户

Question

目前，试图在bitbucket管道中对Linux机器进行身份验证，以便在允许它将文件从GCS桶移动到自身的测试中运行这段代码。

storage_client = storage.Client()

source_bucket = storage_client.bucket('gs://xxxx')
source_blob = source_bucket.blob(xxxx)

_ = source_bucket.copy_blob(source_blob, 'xxxx', destination_blob_name)

为了进行身份验证，我将其放在存储库根目录下的bitbucket-pipelines.yml中：

image: python:3.8

options:
  max-time: 20

pipelines:
  default:
    - step:
        size: 2x
        caches:
          - pip
          - pipenv
        script:
          - curl -O https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-365.0.0-linux-x86_64.tar.gz
          - tar -xvf google-cloud-sdk-365.0.0-linux-x86_64.tar.gz
          - ./google-cloud-sdk/install.sh
          - export PATH=$PATH:$(pwd)/google-cloud-sdk/bin
          - echo $GCLOUD_SERVICE_KEY | gcloud auth activate-service-account --key-file=-
          - pip3 install -U pip pipenv
          - pipenv install --deploy --dev
          - gcloud auth list
          - pipenv run pytest -v --junitxml=test-reports/report.xml

其中GCLOUD_SERVICE_KEY是Bitbucket上的存储库变量。但是，当运行行pipenv run pytest -v --junitxml=test-reports/report.xml时，我会得到以下错误：

>       storage_client = storage.Client()
tests/gcs/test_gcs.py:58: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
/root/.local/share/virtualenvs/build-3vGKWv3F/lib/python3.8/site-packages/google/cloud/storage/client.py:124: in __init__
    super(Client, self).__init__(
/root/.local/share/virtualenvs/build-3vGKWv3F/lib/python3.8/site-packages/google/cloud/client.py:318: in __init__
    _ClientProjectMixin.__init__(self, project=project, credentials=credentials)
/root/.local/share/virtualenvs/build-3vGKWv3F/lib/python3.8/site-packages/google/cloud/client.py:266: in __init__
    project = self._determine_default(project)
/root/.local/share/virtualenvs/build-3vGKWv3F/lib/python3.8/site-packages/google/cloud/client.py:285: in _determine_default
    return _determine_default_project(project)
/root/.local/share/virtualenvs/build-3vGKWv3F/lib/python3.8/site-packages/google/cloud/_helpers.py:186: in _determine_default_project
    _, project = google.auth.default()
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
scopes = None, request = None, quota_project_id = None, default_scopes = None
    def default(scopes=None, request=None, quota_project_id=None, default_scopes=None):
        """Gets the default credentials for the current environment.
    
        `Application Default Credentials`_ provides an easy way to obtain
        credentials to call Google APIs for server-to-server or local applications.

现在，有些人可能希望将GCLOUD_SERVICE_KEY保存为存储库中的文件，或者以某种方式将其复制到运行管道本身的linux机器上，但我认为最好使用行echo $GCLOUD_SERVICE_KEY | gcloud auth activate-service-account --key-file=-而不提交任何私钥。

Answer 1

命令gcloud auth activate-service-不为python程序设置ADC (应用程序默认凭据)。

将服务帐户的内容写入文件，并将环境变量GOOGLE_APPLICATION_CREDENTIALS设置为指向该文件。

另一个选项是将内容写入已知位置，然后在创建客户端时指定该位置：

storage.Client.from_service_account_json('<PATH_TO_SERVICE_ACCOUNT_JSON>')

还有其他选项，例如从传递给Python程序的JSON字符串创建凭据。通常情况下，您首先要对base64进行编码/解码。

credentials = service_account.Credentials.from_service_account_info(str)
storage.Client(credentials=credentials)