node.js - GCP - 无法在 Cloud Run 中使用 Google Secret Manager (@google-cloud/secret-manager)

Question

我一直在我的 Node 应用程序中使用 @google-cloud/secret-manager 插件，该应用程序之前托管在 Google App Engine 上。

在我将代码移至 Cloud Run 之前，它运行得非常好。我现在收到以下错误:错误:

Error: 500 undefined: Getting metadata from plugin failed with error:Could not refresh access token: Unsuccessful response status code.

这是我的代码示例:

import { SecretManagerServiceClient } from '@google-cloud/secret-manager';

const SECRET = {
  FOO_KEY: 'foo_key',
  BAR_KEY: 'bar_key',
};

const buildSecretName = keyName => {
  const project = process.env.PROJECT_ID;
  return `projects/${project}/secrets/${keyName}/versions/latest`;
};

const accessSecret = async keyName => {
  const client = new SecretManagerServiceClient();
  const name = buildSecretName(keyName);
  
  const [version] = await client.accessSecretVersion({
    name,
  });

  return version.payload.data.toString('utf8');
};

const accessFooKey = async () => {
  const secret = await accessSecret(SECRET.FOO_KEY);
  return secret;
};

经过调试，运行accessSecretVersion函数时似乎会抛出异常。看起来 secret-manager 插件无法检索当前服务帐户，是因为我在 Docker 镜像中运行代码吗？

这是我的 Dockerfile 的内容

FROM node:12

ARG NODE_ENV=production
ENV NODE_ENV ${NODE_ENV}

ARG PROJECT_ID=my-project
ENV PROJECT_ID ${PROJECT_ID}

WORKDIR /usr/src

COPY package.json ./
COPY yarn.lock ./

RUN yarn

COPY . .

RUN yarn api:clean
RUN yarn api:build

EXPOSE 3000
CMD ["yarn", "api:start"]

它是使用以下 cloudbuild.yaml 文件通过触发器构建进行部署的

steps:
  - id: build API image
    name: gcr.io/cloud-builders/docker
    args:
      - build
      - -t
      - eu.gcr.io/${_TARGET_PROJECT_ID}/${_SERVICE_NAME}
      - .

  - id: publish API image
    name: gcr.io/cloud-builders/docker
    args:
      - push
      - eu.gcr.io/${_TARGET_PROJECT_ID}/${_SERVICE_NAME}

  - id: deploy
    name: gcr.io/google.com/cloudsdktool/cloud-sdk
    args:
      - gcloud
      - run
      - deploy
      - ${_SERVICE_NAME}
      - --image=eu.gcr.io/${_TARGET_PROJECT_ID}/${_SERVICE_NAME}
      - --project=${_TARGET_PROJECT_ID}
      - --platform=${_RUN_PLATFORM}
      - --region=${_REGION}

images:
  - eu.gcr.io/${_TARGET_PROJECT_ID}/${_SERVICE_NAME}

timeout: 1200s

仅供引用，我的 key 可由 Cloud Run 自定义服务帐户读取，它们都具有 Secret Manager Secret Accessor 访问权限。

非常感谢您的帮助!

Answer 1

正如 John Hanley 所说，我在部署 Docker 镜像时没有指定任何特定的服务帐户。默认服务帐户是 Compute Engine 帐户 ( <a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="69111111440a0604191c1d0c290d0c1f0c0506190c1b470e1a0c1b1f000a0c080a0a061c071d470a0604" rel="noreferrer noopener nofollow">[email protected]</a> )，我的公司已禁用该帐户以防止出现安全问题。

运行 gcloud run deploy 时使用自定义服务帐户命令解决了问题。我的deploy步骤现在看起来像这样:

  - id: deploy
    name: gcr.io/google.com/cloudsdktool/cloud-sdk
    args:
      - gcloud
      - run
      - deploy
      - ${_SERVICE_NAME}
      - --image=eu.gcr.io/${_TARGET_PROJECT_ID}/${_SERVICE_NAME}
      - --project=${_TARGET_PROJECT_ID}
      - --platform=${_RUN_PLATFORM}
      - --region=${_REGION}
      - --se<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="3644405f55531b575555594358420b55434542595b1b455344405f5553765b4f1b4644595c535542185f575b1851455344405f5553575555594358421855595b" rel="noreferrer noopener nofollow">[email protected]</a>

谢谢大家的帮助