I am trying to invoke a Cloud Run service using Cloud Tasks as described in the docs here.

我正在尝试使用云任务调用云运行服务，如这里的文档中所述。

I have a running Cloud Run service. If I make the service publicly accessible, it behaves as expected.

我有一项正在运行的云运行服务。如果我使服务可公开访问，它就会按预期运行。

I have created a cloud queue and I schedule the cloud task with a local script. This one is using my own account. The script looks like this

我已经创建了一个云队列，并使用本地脚本调度云任务。这个人用的是我自己的账户。脚本如下所示

from google.cloud import tasks_v2

client = tasks_v2.CloudTasksClient()

project = 'my-project'
queue = 'my-queue'
location = 'europe-west1'
url = 'https://url_to_my_service'

parent = client.queue_path(project, location, queue)

task = {
        'http_request': {
            'http_method': 'GET',
            'url': url,
            'oidc_token': {
               'service_account_email': '[email protected]'
            }
        }
}

response = client.create_task(parent, task)
print('Created task {}'.format(response.name))

I see the task appear in the queue, but it fails and retries immediately. The reason for this (by checking the logs) is that the Cloud Run service returns a 401 response.

我看到任务出现在队列中，但它失败并立即重试。这样做的原因(通过检查日志)是因为Cloud Run服务返回401响应。

My own user has the roles "Service Account Token Creator" and "Service Account User". It doesn't have the "Cloud Tasks Enqueuer" explicitly, but since I am able to create the task in the queue, I guess I have inherited the required permissions.
The service account "[email protected]" (which I use in the task to get the OIDC token) has - amongst others - the following roles:

我自己的用户具有角色“Service Account Token Creator”和“Service Account User”。它没有显式的“云任务入队程序”，但是因为我能够在队列中创建任务，所以我想我已经继承了所需的权限。服务帐户“[电子邮件受保护]”(我在任务中使用它来获取OIDC令牌)除其他角色外，还具有以下角色：

• Cloud Tasks Enqueuer (Although I don't think it needs this one as I'm creating the task with my own account)


• Cloud Tasks Task Runner


• Cloud Tasks Viewer


• Service Account Token Creator (I'm not sure whether this should be added to my own account - the one who schedules the task - or to the service account that should perform the call to Cloud Run)


• Service Account User (same here)


• Cloud Run Invoker

So I did a dirty trick: I created a key file for the service account, downloaded it locally and impersonated locally by adding an account to my gcloud config with the key file. Next, I run

因此，我做了一个卑鄙的把戏：我为服务帐户创建了一个密钥文件，将其下载到本地，并通过使用该密钥文件将一个帐户添加到我的gCloud配置中进行本地模拟。接下来，我会跑

curl -H "Authorization: Bearer $(gcloud auth print-identity-token)" https://url_to_my_service

That works! (By the way, it also works when I switch back to my own account)

这很管用！(顺便说一句，当我切换回我自己的账户时，它也可以使用)

Final tests: if I remove the oidc_token from the task when creating the task, I get a 403 response from Cloud Run! Not a 401...
If I remove the "Cloud Run Invoker" role from the service account and try again locally with curl, I also get a 403 instead of a 401.

最终测试：如果我在创建任务时从任务中删除oidc_Token，则会收到Cloud Run的403响应！不是401...如果我从服务帐户中删除“Cloud Run Invoker”角色，并使用curl在本地重试，我也会得到403而不是401。

If I finally make the Cloud Run service publicly accessible, everything works.

如果我最终使Cloud Run服务可以公开访问，一切都会正常工作。

So, it seems that the Cloud Task fails to generate a token for the service account to authenticate properly at the Cloud Run service.

因此，云任务似乎无法为服务帐户生成令牌，以便在云运行服务中正确进行身份验证。

What am I missing?

我错过了什么？

I had the same issue here was my fix:

我也有同样的问题，这是我的解决办法：

Diagnosis: Generating OIDC tokens currently does not support custom domains in the audience parameter. I was using a custom domain for my cloud run service (https://my-service.my-domain.com) instead of the cloud run generated url (found in the cloud run service dashboard) that looks like this: https://XXXXXX.run.app

诊断：生成OIDC令牌目前不支持audience参数中的自定义域。我为我的云运行服务使用了自定义域（my-service.my-domain.com），而不是云运行生成的URL（在云运行服务仪表板中找到），如下所示：https://XXXXXX.run.app

Masking behavior: In the task being enqueued to Cloud Tasks, If the audience field for the oidc_token is not explicitly set then the target url from the task is used to set the audience in the request for the OIDC token.

屏蔽行为：在排队到云任务的任务中，如果没有显式设置oidc_令牌的受众字段，则使用任务中的目标URL来设置OIDC令牌请求中的受众。

In my case this meant that enqueueing a task to be sent to the target https://my-service.my-domain.com/resource the audience for the generating the OIDC token was set to my custom domain https://my-service.my-domain.com/resource. Since custom domains are not supported when generating OIDC tokens, I was receiving 401 not authorized responses from the target service.

在我的例子中，这意味着将一个要发送到目标https://my-service.my-domain.com/resource的任务排队，生成OIDC令牌的受众被设置为我的自定义域https://my-service.my-domain.com/resource.由于在生成OIDC令牌时不支持自定义域，因此我收到了来自目标服务的401个未经授权的响应。

My fix: Explicitly populate the audience with the Cloud Run generated URL, so that a valid token is issued. In my client I was able to globally set the audience for all tasks targeting a given service with the base url: 'audience' : 'https://XXXXXX.run.app'. This generated a valid token. I did not need to change the url of the target resource itself. The resource stayed the same: 'url' : 'https://my-service.my-domain.com/resource'

我的解决办法：使用Cloud Run生成的URL显式填充受众，以便颁发有效的令牌。在我的客户端中，我能够使用基本URL‘Audience’：‘https://XXXXXX.run.app’.‘全局设置针对给定服务的所有任务的受众这生成了一个有效的令牌。我不需要更改目标资源本身的URL。资源保持不变：‘url’：‘https://my-service.my-domain.com/resource’

More Reading:
I've run into this problem before when setting up service-to-service authentication: Google Cloud Run Authentication Service-to-Service

更多阅读：我以前在设置服务到服务身份验证时遇到过这个问题：谷歌云运行身份验证服务到服务

1.I created a private cloud run service using this code:

1.我使用以下代码创建了一个私有云运行服务：

import os

from flask import Flask
from flask import request


app = Flask(__name__)

@app.route('/index', methods=['GET', 'POST'])
def hello_world():
    target = os.environ.get('TARGET', 'World')
    print(target)
    return str(request.data)

if __name__ == "__main__":
    app.run(debug=True,host='0.0.0.0',port=int(os.environ.get('PORT', 8080)))
   

2.I created a service account with --role=roles/run.invoker that I will associate with the cloud task

2.我创建了一个服务帐户，并将其与云任务相关联

 gcloud iam service-accounts create SERVICE-ACCOUNT_NAME \
 --display-name "DISPLAYED-SERVICE-ACCOUNT_NAME"  
 gcloud iam service-accounts list

 gcloud run services add-iam-policy-binding SERVICE \
 --member=serviceAccount:[email protected] \ 
 --role=roles/run.invoker 

3.I created a queue

3.我创建了一个队列

gcloud tasks queues create my-queue

4.I create a test.py

4.我创建了一个test.py

from google.cloud import tasks_v2
from google.protobuf import timestamp_pb2
import datetime

# Create a client.
client = tasks_v2.CloudTasksClient()

# TODO(developer): Uncomment these lines and replace with your values.
project = 'your-project'
queue = 'your-queue'
location = 'europe-west2' # app engine locations
url = 'https://helloworld/index'
payload = 'Hello from the Cloud Task'

# Construct the fully qualified queue name.
parent = client.queue_path(project, location, queue)

# Construct the request body.
task = {
        'http_request': {  # Specify the type of request.
            'http_method': 'POST',
            'url': url,  # The full url path that the task will be sent to.
            'oidc_token': {
                'service_account_email': "your-service-account"
            },
             'headers' : {
             'Content-Type': 'application/json',
           }
        }
}

# Convert "seconds from now" into an rfc3339 datetime string.
d = datetime.datetime.utcnow() + datetime.timedelta(seconds=60)

# Create Timestamp protobuf.
timestamp = timestamp_pb2.Timestamp()
timestamp.FromDatetime(d)

# Add the timestamp to the tasks.
task['schedule_time'] = timestamp
task['name'] = 'projects/your-project/locations/app-engine-loacation/queues/your-queue/tasks/your-task'


converted_payload = payload.encode()

# Add the payload to the request.
task['http_request']['body'] = converted_payload


# Use the client to build and send the task.
response = client.create_task(parent, task)

print('Created task {}'.format(response.name))
#return response

5.I run the code in Google Cloud Shell with my user account which has Owner role.

5.我使用具有所有者角色的用户帐户在Google Cloud Shell中运行代码。

6.The response received has the form:

6.收到的答复的形式如下：

Created task projects/your-project/locations/app-engine-loacation/queues/your-queue/tasks/your-task

7.Check the logs, success

7.查看日志，成功

For those like me, struggling through documentation and stackoverflow when having continuous UNAUTHORIZED responses on Cloud Tasks HTTP requests:

对于像我这样的人来说，在云任务HTTP请求上有连续的未经授权的响应时，努力处理文档和堆栈溢出：

As was written in thread, you better provide audience for oidcToken you send to CloudTasks. Ensure your requested url exactly equals to your resource.

正如在线程中编写的那样，您最好为您发送到CloudTasks的oidcToken提供受众。确保您请求的url与您的资源完全相同。

For instance, if you have Cloud Function named my-awesome-cloud-function and your task request url is https://REGION-PROJECT-ID.cloudfunctions.net/my-awesome-cloud-function/api/v1/hello, you need to ensure, that you set function url itself.

例如，如果您有名为my-awawed-Cloud-Function的Cloud函数，并且您的任务请求URL是https://REGION-PROJECT-ID.cloudfunctions.net/my-awesome-cloud-function/api/v1/hello，，则需要确保设置函数URL本身。

{ 
  serviceAccountEmail: [email protected],
  audience: https://REGION-PROJECT-ID.cloudfunctions.net/my-awesome-cloud-function 
}

Otherwise seems full url is used and leads to an error.

否则，似乎使用了完整的URL并导致错误。

The next day I am no longer able to reproduce this issue. I can reproduce the 403 responses by removing the Cloud Run Invoker role, but I no longer get 401 responses with exactly the same code as yesterday.
I guess this was a temporary issue on Google's side?

第二天，我再也不能复制这个问题了。我可以通过删除Cloud Run调用者角色来复制403个响应，但我不再使用与昨天完全相同的代码获得401个响应。我想这是谷歌方面的一个暂时问题吧？

Also, I noticed that it takes some time before updated policies are actually in place (1 to 2 minutes).

此外，我注意到更新的策略需要一段时间才能真正到位(1到2分钟)。

Not directly related to the OP issue but I was struggling to call Cloud Workflows from Cloud Tasks. The issue is that I was using OIDC instead of OAuth.
It's mentioned in https://cloud.google.com/tasks/docs/reference/rpc/google.cloud.tasks.v2#google.cloud.tasks.v2.CreateTaskRequest

与运营问题没有直接关系，但我很难从云任务中调用云工作流。问题是我使用的是OIDC而不是OAuth。它在https://cloud.google.com/tasks/docs/reference/rpc/google.cloud.tasks.v2#google.cloud.tasks.v2.CreateTaskRequest中提到过

OAuthToken

If specified, an OAuth token will be generated and attached as an
Authorization header in the HTTP request.

This type of authorization should generally only be used when calling
Google APIs hosted on *.googleapis.com.

The url for workflows executions is starting with workflows.googleapis.com, that's why OAuth should be used instead of OIDC.

工作流执行的URL以workflows.googleapis.com开头，这就是为什么应该使用OAuth而不是OIDC。