ssh - 使用操作系统登录，如何从一个 GCE 到另一个 GCE 的 gcloud ssh？

Question

我有两个 GCE，都启用了操作系统登录:

1) 使用服务帐户 a_svc 配置的 a_vm

2) 使用服务帐户 b_svc 配置的 b_vm

a_svc 具有对 b_vm 的操作系统登录访问权限。
a_svc 在项目级别具有角色/compute.osAdminLogin，在 b_svc 级别具有角色/iam.serviceAccountUser。

我尝试了什么:

SSH 进入 a_vm 和 gcloud compute ssh a_vm ，然后 gcloud compute ssh b_vm

发生了什么:

它始终超时。
根据 --log-http 在挂起之前发出的 gcloud 请求:

uri: http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/a_svc@fredzqm-terraform-5.iam.gserviceaccount.com/?recursive=True
uri: http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/ca_svc@my_project.iam.gserviceaccount.com/token
uri: https://compute.googleapis.com/batch/compute/v1
uri: https://compute.googleapis.com/batch/compute/v1
uri: http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/a_svc@my_project.iam.gserviceaccount.com/?recursive=True
uri: https://oslogin.googleapis.com/v1/users/a_svc@my_project.gserviceaccount.com/loginProfile?projectId=fredzqm-terraform-5&alt=json

我的期望:

基于 https://cloud.google.com/compute/docs/instances/connecting-advanced#sa_ssh_manual ，gcloud 应该获取默认的应用程序凭据 (a_svc) 并使用它通过操作系统登录来访问 b_vm。

什么有效:

我已经验证 a_svc 确实具有对 b_vm 的 ssh 访问权限。这适用于我的工作站使用个人信用:
gcloud compute ssh b_vm --impersonate-service-account a_svc

如果我在 a_svc 中添加一个 ssh 公钥，然后使用该公钥 ssh 进入 b_vm .
gcloud compute os-login ssh-keys add --key-filessh sa_<id_of_a_svc>@b_vm -i private_key_path

Answer 1

我试图重现您的问题，但失败了。我能够连接到 service-account-b-instance来自 service_account_a_instance作为服务帐户并以该服务帐户执行命令。

看看我下面的步骤:

创建服务帐号service_account_a

创建与 service_account_a_instance 关联的 VM 实例:

$ gcloud compute instances create service-account-a-instance --zone=europe-west3-a --machine-type=n1-standard-1 --service-account=service-account-a@test-prj.iam.gserviceaccount.com --scopes=https://www.googleapis.com/auth/cloud-platform --metadata enable-oslogin=TRUE

Created [https://www.googleapis.com/compute/v1/projects/test-prj/zones/europe-west3-a/instances/service-account-a-instance].
NAME                        ZONE            MACHINE_TYPE   PREEMPTIBLE  INTERNAL_IP  EXTERNAL_IP    STATUS
service-account-a-instance  europe-west3-a  n1-standard-1               10.156.0.14  35.XXX.75.XXX  RUNNING

创建服务帐号service_account_b

创建虚拟机实例 service_account_b_instance与 service_account_b 相关联:

$ gcloud compute instances create service-account-b-instance --zone=europe-west3-a --machine-type=n1-standard-1 --service-account=service-account-b@test-prj.iam.gserviceaccount.com --scopes=https://www.googleapis.com/auth/cloud-platform --metadata enable-oslogin=TRUE

Created [https://www.googleapis.com/compute/v1/projects/test-prj/zones/europe-west3-a/instances/service-account-b-instance].
NAME                        ZONE            MACHINE_TYPE   PREEMPTIBLE  INTERNAL_IP  EXTERNAL_IP    STATUS
service-account-b-instance  europe-west3-a  n1-standard-1               10.156.0.16  35.XXX.255.XXX  RUNNING

生成 ssh key :

$ ssh-keygen
Generating public/private rsa key pair.

导入 ssh key :

$ gcloud compute os-login ssh-keys add --key-file id_rsa.pub

连接到实例 service-account-a-instance :

$ gcloud compute ssh service-account-a-instance
Linux service-account-a-instance 4.9.0-12-amd64 #1 SMP Debian 4.9.210-1 (2020-01-20) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Mon Mar  2 14:34:51 2020 from 104.132.189.65
user_domain_com@service-account-a-instance:~$ 

连接到实例 service-account-b-instance来自 service-account-a-instance :

user_domain_com@service-account-a-instance:~$ gcloud compute ssh service-account-b-instance --project test-prj --zone europe-west3-a

...

ssh: connect to host 35.242.255.44 port 22: Connection timed out
ERROR: (gcloud.compute.ssh) [/usr/bin/ssh] exited with return code [255].

在 VPC network 启用 ssh 连接-> Firewall然后再试一次:

user_domain_com@service-account-a-instance:~$ gcloud compute ssh service-account-b-instance --project test-prj --zone europe-west3-a
Permission denied (publickey).
ERROR: (gcloud.compute.ssh) [/usr/bin/ssh] exited with return code [255].

添加角色 roles/iam.serviceAccountUser至service-account-a然后再试一次:

user_domain_com@service-account-a-instance:~$ gcloud compute ssh service-account-b-instance --project test-prj --zone europe-west3-a

Linux service-account-b-instance 4.9.0-12-amd64 #1 SMP Debian 4.9.210-1 (2020-01-20) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Mon Mar  2 16:52:28 2020 from 35.198.75.226
sa_116762935227008431464@service-account-b-instance:~$
sa_116762935227008431464@service-account-b-instance:~$ uname -a
Linux service-account-b-instance 4.9.0-12-amd64 #1 SMP Debian 4.9.210-1 (2020-01-20) x86_64 GNU/Linux

最后它起作用了。