blocks|key|3081078|text|这些密钥存储在您的Project+Metadata中，您可以通过谷歌控制台UI删除它们|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|3081079|entityMap|0|LINK|mutability|MUTABLE|url|https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys^0|9|G|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

These key are stored in your <a href="https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys" rel="nofollow noreferrer">Project Metadata</a> yo can remove them by deleting trough the Google Console UI

blocks|key|764966|text|正如您在问题中提到的OS+Login+:有一种方法可以使用this+command从用户的配置文件中删除特定的SSH键。或者，我建议您像John+Hanley一样，将复制到实例中的文件放入Storage中，并通过启动脚本检索它(您也可以使用自定义的Compute映像)，而不是执行SCP。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|764967|entityMap|0|LINK|mutability|MUTABLE|url|https://cloud.google.com/sdk/gcloud/reference/compute/os-login/ssh-keys/remove^0|T|C|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

Seeing as you were mentioning OS Login in your question: there is a way to delete specific SSH keys from a user's profile using <a href="https://cloud.google.com/sdk/gcloud/reference/compute/os-login/ssh-keys/remove" rel="nofollow noreferrer">this command</a>. Alternatively, instead of performing SCP, I'd advise you, much like John Hanley has, to put the file you're copying into the instance in Storage and retrieve it via a startup script (you could also use a custom Compute image).

blocks|key|4548590|text|上面一种非常粗糙的方法对我来说很有效，那就是：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4548591|for+i+in+$(gcloud+compute+os-login+ssh-keys+list);+do+echo+$i;+gcloud+compute+os-login+ssh-keys+remove+--key+$i;+done|code-block|syntax|javascript|4548592|我在删除了几十个键之后停止了这个操作(使用Control-C组合键)，然后它又开始工作了。|4548593|实际上，在GUI的项目元数据中，我没有看到很多键。仅限：|4548594|公钥密钥:+network-name...|4548595|sshKeys+:+gke-e9...|unordered-list-item|4548596|
|4548597|SSH+gke...cidr+peter_v+:+ssh-rsa+my+|4548598|gke...cidr+|4548599|4548600|4548601|entityMap^0|0|0|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Z|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|10|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|11|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|12|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|13|8|@]|9|@]|A|$]]|$1|M|3|N|5|O|7|14|8|@]|9|@]|A|$]]|$1|P|3|Q|5|6|7|15|8|@]|9|@]|A|$]]|$1|R|3|S|5|O|7|16|8|@]|9|@]|A|$]]|$1|T|3|U|5|O|7|17|8|@]|9|@]|A|$]]|$1|V|3|-4|5|6|7|18|8|@]|9|@]|A|$]]|$1|W|3|-4|5|6|7|19|8|@]|9|@]|A|$]]|$1|X|3|-4|5|6|7|1A|8|@]|9|@]|A|$]]]|Y|$]]

A very crude way to do the above that worked for me was:

<pre><code>for i in $(gcloud compute os-login ssh-keys list); do echo $i; gcloud compute os-login ssh-keys remove --key $i; done
</code></pre>

I stopped this (with Control-C) after deleting a few tens of keys and then it worked again.

Actually, in the project metadata in the GUI, I do not see a lot of key. Only :

<ul>
<li>gke...cidr : network-name...</li>
<li>sshKeys : gke-e9...</li>
<li>SSH Keys => peter_v : ssh-rsa my public key</li>
</ul>

blocks|key|984055|text|永久的解决方案是使用--ssh-key-expire-after+30s。您仍然需要使用上面的解决方案来清理现有的密钥，或者像这样使用更多的命令功夫(没有grep)。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|984056|for+i+in+$(gcloud+compute+os-login+ssh-keys+list+--format="table[no-heading](value.fingerprint)");+do+
++echo+$i;+
++gcloud+compute+os-login+ssh-keys+remove+--key+$i+%7C%7C+true;+
done|code-block|syntax|javascript|984057|注意:您必须使用违规帐户。gcloud+config+account+activate+ACCOUNT和/或gcloud+auth+activate-service-account+--key-file=FILE或gcloud+auth+login|984058|在脚本中需要一个新的ssh密钥：|984059|#+KEYNAME+should+be+something+like+$HOME/.ssh/google_compute_engine
ssh-keygen+-t+rsa+-N+""+-f+"${KEYNAME}"+-C+"${USERNAME}"+%7C%7C+true
chmod+400+${KEYNAME}*

cat+>+ssh-keys+<<EOF
${USERNAME}:$(cat+${KEYNAME}.pub)
EOF|984060|测试此解决方案：|984061|while+:;+do
++USERNAME=testing@test-project.iam.gserviceaccount.com
++KEYNAME=~/.ssh/google_compute_engine
++rm+-f+~/.ssh/google_compute_engine*
++ssh-keygen+-t+rsa+-N+""+-f+"${KEYNAME}"+-C+"${USERNAME}"+%7C%7C+true
++chmod+400+${KEYNAME}*
++cat+>+ssh-keys+<<EOF
++${USERNAME}:$(cat+${KEYNAME}.pub)
EOF
++gcloud+--project=test-project+compute+ssh+--ssh-key-expire-after+30s+one-bastion-to-rule-them-all+--+date
++gcloud+--project=test-project+compute+os-login+ssh-keys+list+--format="table[no-heading](value.fingerprint)"+\
++++%7Cwc+-l
done|984062|entityMap^0|A|Q|0|0|D|12|1I|1G|2Z|H|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|W|8|@$9|X|A|Y|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|Z|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|10|8|@$9|11|A|12|B|C]|$9|13|A|14|B|C]|$9|15|A|16|B|C]]|D|@]|E|$]]|$1|M|3|N|5|6|7|17|8|@]|D|@]|E|$]]|$1|O|3|P|5|H|7|18|8|@]|D|@]|E|$I|J]]|$1|Q|3|R|5|6|7|19|8|@]|D|@]|E|$]]|$1|S|3|T|5|H|7|1A|8|@]|D|@]|E|$I|J]]|$1|U|3|-4|5|6|7|1B|8|@]|D|@]|E|$]]]|V|$]]

The permanent solution is to use <code>--ssh-key-expire-after 30s</code>.
You still need to cleanup the existing keys with the solutions above or a little more command kungfu like this (without grep).
<pre class="lang-sh prettyprint-override"><code>for i in $(gcloud compute os-login ssh-keys list --format=&quot;table[no-heading](value.fingerprint)&quot;); do 
 echo $i; 
 gcloud compute os-login ssh-keys remove --key $i || true; 
done
</code></pre>
NOTE: you have to be using the offending account. <code>gcloud config account activate ACCOUNT</code> and/or <code>gcloud auth activate-service-account --key-file=FILE</code> or <code>gcloud auth login</code>
Need a new ssh key in a script:
<pre class="lang-sh prettyprint-override"><code># KEYNAME should be something like $HOME/.ssh/google_compute_engine
ssh-keygen -t rsa -N &quot;&quot; -f &quot;${KEYNAME}&quot; -C &quot;${USERNAME}&quot; || true
chmod 400 ${KEYNAME}*

cat &gt; ssh-keys &lt;&lt;EOF
${USERNAME}:$(cat ${KEYNAME}.pub)
EOF
</code></pre>
Testing this solution:
<pre class="lang-sh prettyprint-override"><code>while :; do
 USERNAME=testing@test-project.iam.gserviceaccount.com
 KEYNAME=~/.ssh/google_compute_engine
 rm -f ~/.ssh/google_compute_engine*
 ssh-keygen -t rsa -N &quot;&quot; -f &quot;${KEYNAME}&quot; -C &quot;${USERNAME}&quot; || true
 chmod 400 ${KEYNAME}*
 cat &gt; ssh-keys &lt;&lt;EOF
 ${USERNAME}:$(cat ${KEYNAME}.pub)
EOF
 gcloud --project=test-project compute ssh --ssh-key-expire-after 30s one-bastion-to-rule-them-all -- date
 gcloud --project=test-project compute os-login ssh-keys list --format=&quot;table[no-heading](value.fingerprint)&quot; \
 |wc -l
done
</code></pre>

I am using Gcloud to run Prow (Continous Integration server). One of my job creates a virtual machine, perform some tests and then delete that instance. I use a service account to create VM, run tests. 

<pre><code>#!/bin/bash

set -o errexit

cleanup() {
 gcloud compute instances delete kyma-integration-test-${RANDOM_ID}
}


gcloud config set project ...
gcloud auth activate-service-account --key-file ...

gcloud compute instances create &lt;vm_name&gt; \
 --metadata enable-oslogin=TRUE \
 --image debian-9-stretch-v20181009 \
 --image-project debian-cloud --machine-type n1-standard-4 --boot-disk-size 20 \

trap cleanup exit

gcloud compute scp --strict-host-key-checking=no --quiet &lt;script.sh&gt; &lt;vm_name&gt;:~/&lt;script.sh&gt;

gcloud compute ssh --quiet &lt;vm_name&gt; -- ./&lt;script.sh&gt;
</code></pre>

After some time, I got following error:

<pre><code>ERROR: (gcloud.compute.scp) INVALID_ARGUMENT: Login profile size exceeds 32 KiB. Delete profile values to make additional space.
</code></pre>

Indeed, for that service account, <code>describe</code> command returns a lot of data, for example ~70 entries in <code>sshPublicKeys</code> section. 

<code>gcloud auth activate-service-account --key-file ...
gcloud compute os-login describe-profile
</code>

Most of this public keys refer to already removed VM instances. How to perform cleanup of this list? Or is it possible to not store that public keys at all?

Gcloud - cannot provision many VM using one Service Account

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我正在使用Gcloud来运行Prow (Continous Integration server)。我的一项工作是创建一个虚拟机，执行一些测试，然后删除该实例。我使用服务帐户创建虚拟机，运行测试。#!/bin/bashset -o errexitcleanup() {    gcloud compute instanc...

问Gcloud -无法使用一个服务帐户调配多个虚拟机
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Gcloud -无法使用一个服务帐户调配多个虚拟机EN