kubernetes - 谷歌云 : insufficient authentication scopes

Question

我在向部署在我的 Google Cloud Kubernetes 集群中的 Spring Boot 应用程序发送请求时遇到困难。我的应用程序收到一张照片并将其发送到 Google Vision API。我正在使用提供的客户端库(https://cloud.google.com/vision/docs/libraries#client-libraries-install-java)，如 https://cloud.google.com/vision/docs/auth 中所述:

If you're using a client library to call the Vision API, use Application Default Credentials (ADC). Services using ADC look for credentials within a GOOGLE_APPLICATION_CREDENTIALS environment variable. Unless you specifically wish to have ADC use other credentials (for example, user credentials), we recommend you set this environment variable to point to your service account key file.

在我的本地机器上一切正常，我有一个带有环境的 docker 容器。变量 GOOGLE_APPLICATION_CREDENTIALS 指向我的服务帐户 key 文件。

我的集群中没有这个变量。这是我从 Kubernetes 集群中的应用程序得到的响应:

{
    "timestamp": "2018-05-10T14:07:27.652+0000",
    "status": 500,
    "error": "Internal Server Error",
    "message": "io.grpc.StatusRuntimeException: PERMISSION_DENIED: Request had insufficient authentication scopes.",
    "path": "/image"
}

我做错了什么？提前谢谢!

Answer 1

我还必须在我的 GKE 设置中指定 GOOGLE_APPLICATION_CREDENTIALS 环境变量，这些是我完成的步骤，感谢 How to set GOOGLE_APPLICATION_CREDENTIALS on GKE running through Kubernetes :

1. 创建 secret (在我的情况下，在 Gitlab 上的部署步骤中):

kubectl create secret generic google-application-credentials --from-file=./application-credentials.json

2.设置音量:

...
volumes:
- name: google-application-credentials-volume
  secret:
    secretName: google-application-credentials
    items:
    - key: application-credentials.json # default name created by the create secret from-file command
      path: application-credentials.json

3. 设置卷挂载:

spec:
  containers:
  - name: my-service
    volumeMounts:
    - name: google-application-credentials-volume
      mountPath: /etc/gcp
      readOnly: true

4. 设置环境变量:

spec:
  containers:
  - name: my-service
    env:
    - name: GOOGLE_APPLICATION_CREDENTIALS
      value: /etc/gcp/application-credentials.json