blocks|key|2572476|text|请注意，您的Kubernetes服务帐户与您的Google云存储服务帐户不同。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2572477|gsutil使用boto配置，因此您可以在/etc/boto.cfg或~/.boto下挂载Kubernetes密钥|offset|length|style|CODE|2572478|您可以使用令牌或服务帐户向GCP进行身份验证。您可以使用gsutil+config+-f生成令牌，也可以使用gsutil+config+-e生成服务帐户凭据。它将生成一个~/.boto文件，然后您可以将该文件作为Kubernetes+secret挂载到您的pod上。|2572479|更多信息here。|2572480|entityMap|0|LINK|mutability|MUTABLE|url|https://cloud.google.com/storage/docs/gsutil/commands/config^0|0|0|6|L|D|Z|7|0|S|G|1I|G|2D|7|0|4|4|0|0^^$0|@$1|2|3|4|5|6|7|T|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|U|8|@$D|V|E|W|F|G]|$D|X|E|Y|F|G]|$D|Z|E|10|F|G]]|9|@]|A|$]]|$1|H|3|I|5|6|7|11|8|@$D|12|E|13|F|G]|$D|14|E|15|F|G]|$D|16|E|17|F|G]]|9|@]|A|$]]|$1|J|3|K|5|6|7|18|8|@]|9|@$D|19|E|1A|1|1B]]|A|$]]|$1|L|3|-4|5|6|7|1C|8|@]|9|@]|A|$]]]|M|$N|$5|O|P|Q|A|$R|S]]]]

Note that your Kubernetes Service Account is different from your Google Cloud Storage service account.

<code>gsutil</code> uses the boto config so you can mount a Kubernetes secret under <code>/etc/boto.cfg</code> or <code>~/.boto</code>

You can authenticate with GCP using a token or a service account. You can generate a token using <code>gsutil config -f</code> you can generate service account credentials using <code>gsutil config -e</code>. It will generate a <code>~/.boto</code> file and then you can mount that as Kubernetes secret on your pods.

More information <a href="https://cloud.google.com/storage/docs/gsutil/commands/config" rel="nofollow noreferrer">here</a>.

blocks|key|2362261|text|简而言之，gsutil不知道如何使用令牌的格式，所以您无法使用它。您将需要一个JSON密钥文件，如本教程中所述(除非您不能使用GOOGLE_APPLICATION_CREDENTIALS环境变量)：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|2362262|https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform|2362263|Gsutil不是读取GOOGLE_APPLICATION_CREDENTIALS环境变量，而是使用Boto配置文件加载凭据。它知道查找这些Boto配置文件的常见位置是/etc/boto.cfg和$HOME/.boto。请注意，后一个值会根据运行命令的用户的不同而变化(对于不同的用户，$HOME会扩展为不同的值)；由于cron作业通常以不同于设置配置文件的用户身份运行，因此我不建议使用此路径。|2362264|因此，在pod上，您需要首先创建一个引用密钥文件的Boto配置文件：|2362265|#+This+option+is+only+necessary+if+you're+running+an+installation+of
#+gsutil+that+came+bundled+with+gcloud.+It+tells+gcloud+that+you'll+be
#+managing+credentials+manually+via+your+own+Boto+config+files.

$+gcloud+config+set+pass_credentials_to_gsutil+False


#+Set+up+your+boto+file+at+/path/to/my/boto.cfg+-+the+setup+will+prompt
#+you+to+supply+the+/path/to/your/keyfile.json.++Alternatively,+to+avoid
#+interactive+setup+prompts,+you+could+set+up+this+config+file+beforehand
#+and+copy+it+to+the+pod.

$+gsutil+config+-e+-o+'/path/to/my/boto.cfg'|code-block|syntax|javascript|2362266|最后，无论何时运行gsutil，都需要告诉它在哪里可以找到引用JSON密钥文件的Boto配置文件(还要确保运行该命令的用户具有读取Boto配置文件和JSON密钥文件的权限)。如果您将Boto配置文件写入到我上面提到的某个众所周知的路径，gsutil将尝试自动查找它；如果不是这样，您可以通过在为cron作业提供的命令中导出BOTO_CONFIG环境变量来告诉gsutil在哪里可以找到Boto配置文件：|2362267|export+BOTO_CONFIG=/path/to/my/boto.cfg;+/path/to/gsutil+cp+<src>+<dst>|2362268|编辑|BOLD|2362269|注意，GCE+VM映像附带了一个预填充的文件，该文件位于/etc/boto.cfg。这个配置文件告诉gsutil加载一个插件，该插件允许gsutil联系GCE元数据服务器并以这种方式获取身份验证令牌(对应于该VM的default机器人服务帐户)。如果您的pod能够读取主机VM的/etc/boto.cfg文件，您可以联系GCE元数据服务器，并且您可以接受由VM的default服务帐户执行的操作，那么这个解决方案应该开箱即用。|2362270|entityMap|0|LINK|mutability|MUTABLE|url^0|1R|U|0|0|2I|0|0|A|U|2B|D|2P|B|3Y|5|0|0|0|4H|B|0|0|0|2|0|2Z|7|51|7|0^^$0|@$1|2|3|4|5|6|7|16|8|@$9|17|A|18|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|19|8|@]|D|@$9|1A|A|1B|1|1C]]|E|$]]|$1|H|3|I|5|6|7|1D|8|@$9|1E|A|1F|B|C]|$9|1G|A|1H|B|C]|$9|1I|A|1J|B|C]|$9|1K|A|1L|B|C]]|D|@]|E|$]]|$1|J|3|K|5|6|7|1M|8|@]|D|@]|E|$]]|$1|L|3|M|5|N|7|1N|8|@]|D|@]|E|$O|P]]|$1|Q|3|R|5|6|7|1O|8|@$9|1P|A|1Q|B|C]]|D|@]|E|$]]|$1|S|3|T|5|N|7|1R|8|@]|D|@]|E|$O|P]]|$1|U|3|V|5|6|7|1S|8|@$9|1T|A|1U|B|W]]|D|@]|E|$]]|$1|X|3|Y|5|6|7|1V|8|@$9|1W|A|1X|B|C]|$9|1Y|A|1Z|B|C]]|D|@]|E|$]]|$1|Z|3|-4|5|6|7|20|8|@]|D|@]|E|$]]]|10|$11|$5|12|13|14|E|$15|G]]]]

The short answer is that the token there is not in a format that gsutil knows how to use, so you can't use it. You'll need a JSON keyfile, as mentioned in the tutorial here (except that you won't be able to use the <code>GOOGLE_APPLICATION_CREDENTIALS</code> environment variable):

<a href="https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform</a>

Rather than reading from the <code>GOOGLE_APPLICATION_CREDENTIALS</code> environment variable, Gsutil uses Boto configuration files to load credentials. The common places that it knows to look for these Boto config files are <code>/etc/boto.cfg</code> and <code>$HOME/.boto</code>. Note that the latter value changes depending on the user running the command (<code>$HOME</code> expands to different values for different users); since cron jobs usually run as a different user than the one who set up the config file, I wouldn't recommend relying on this path.

So, on your pod, you'll need to first create a Boto config file that references the keyfile:

<pre><code># This option is only necessary if you're running an installation of
# gsutil that came bundled with gcloud. It tells gcloud that you'll be
# managing credentials manually via your own Boto config files.

$ gcloud config set pass_credentials_to_gsutil False


# Set up your boto file at /path/to/my/boto.cfg - the setup will prompt
# you to supply the /path/to/your/keyfile.json. Alternatively, to avoid
# interactive setup prompts, you could set up this config file beforehand
# and copy it to the pod.

$ gsutil config -e -o '/path/to/my/boto.cfg'
</code></pre>

And finally, whenever you run gsutil, you need to tell it where to find that Boto config file which references your JSON keyfile (and also make sure that the user running the command has permission to read both the Boto config file and the JSON keyfile). If you wrote your Boto config file to one of the well-known paths I mentioned above, gsutil will attempt to find it automatically; if not, you can tell gsutil where to find the Boto config file by exporting the <code>BOTO_CONFIG</code> environment variable in the commands you supply for your cron job:

<pre><code>export BOTO_CONFIG=/path/to/my/boto.cfg; /path/to/gsutil cp &lt;src&gt; &lt;dst&gt;
</code></pre>

Edit:

Note that GCE VM images come with a pre-populated file at /etc/boto.cfg. This config file tells gsutil to load a plugin that allows gsutil to contact the GCE metadata server and fetch auth tokens (corresponding to the <code>default</code> robot service account for that VM) that way. If your pod is able to read the host VM's /etc/boto.cfg file, you're able to contact the GCE metadata server, and you're fine with operations being performed by the VM's <code>default</code> service account, this solution should work out-of-the-box.

I have a kubernetes Cronjob that performs some backup jobs, and the backup files needs to be uploaded to a bucket. The pod have the service account credentials mounted inside the pod at /var/run/secrets/kubernetes.io/serviceaccount, but how can I instruct gsutil to use the credentials in /var/run/secrets/kubernetes.io/serviceaccount?

<pre><code>lrwxrwxrwx 1 root root 12 Oct 8 20:56 token -&gt; ..data/token
lrwxrwxrwx 1 root root 16 Oct 8 20:56 namespace -&gt; ..data/namespace
lrwxrwxrwx 1 root root 13 Oct 8 20:56 ca.crt -&gt; ..data/ca.crt
lrwxrwxrwx 1 root root 31 Oct 8 20:56 ..data -&gt; ..2018_10_08_20_56_04.686748281
drwxr-xr-x 2 root root 100 Oct 8 20:56 ..2018_10_08_20_56_04.686748281
drwxrwxrwt 3 root root 140 Oct 8 20:56 .
drwxr-xr-x 3 root root 4096 Oct 8 20:57 ..
</code></pre>

Configure gsutil to use kubernetes service account credentials inside of pod

身份验证

Kubernetes

云存储

服务器

JSON

我有一个kubernetes Cronjob，它执行一些备份作业，备份文件需要上传到存储桶中。pod将服务帐户凭据装载在/var/run/secrets/kubernetes.io/serviceaccount，的pod中，但如何指示gsutil使用pod中的凭据lrwxrwxrwx 1 root root   12 ...

问配置gsutil以在pod内使用kubernetes服务帐户凭据
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问配置gsutil以在pod内使用kubernetes服务帐户凭据EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问配置gsutil以在pod内使用kubernetes服务帐户凭据
EN