【发布时间】：2016-09-26 05:57:48
【问题描述】：
我正在尝试将容器引擎上的应用程序默认凭据用于 python IAM API。但是我收到以下错误，指出身份验证范围不足。我的项目启用了 IAM API，并且代码在本地运行。所以，我不确定我错过了什么。
我的错误信息：
22:26:16.000
ERROR:root:<HttpError 403 when requesting https://iam.googleapis.com/v1/projects/henry-dev/serviceAccounts/test123@henry-dev.iam.gserviceaccount.com/keys?alt=json returned "Request had insufficient authentication scopes.">
{
metadata: {…}
textPayload: "ERROR:root:<HttpError 403 when requesting https://iam.googleapis.com/v1/projects/henry-dev/serviceAccounts/test123@henry-dev.iam.gserviceaccount.com/keys?alt=json returned "Request had insufficient authentication scopes.">
"
insertId: "116wpgtg3n4zndx"
log: "simplekubeserver"
}
22:26:16.000
HttpError: <HttpError 403 when requesting https://iam.googleapis.com/v1/projects/henry-dev/serviceAccounts/test123@henry-dev.iam.gserviceaccount.com/keys?alt=json returned "Request had insufficient authentication scopes.">
{
metadata: {…}
textPayload: "HttpError: <HttpError 403 when requesting https://iam.googleapis.com/v1/projects/henry-dev/serviceAccounts/test123@henry-dev.iam.gserviceaccount.com/keys?alt=json returned "Request had insufficient authentication scopes.">
"
insertId: "116wpgtg3n4znej"
log: "simplekubeserver"
}
我的代码，可在本地运行，但不能在 GKE 上运行：
from oauth2client.client import GoogleCredentials
def _iam_service():
credentials = GoogleCredentials.get_application_default()
return discovery.build(serviceName='iam',
version='v1',
credentials=credentials)
def list_keys(project_id, service_account_id):
full_name = 'projects/{0}/serviceAccounts/{1}'.format(project_id, service_account_id)
keys = _iam_service().projects().serviceAccounts().keys()
request = keys.list(name=full_name)
return request.execute()
我进行故障排除的一件事是获取正在使用的服务帐户。
print credentials.service_account_email
在本地，这显示了我正在使用的正确服务帐户。而在 GKE 上，我得到了 None，但期望像 123456789-compute@developer.gserviceaccount.com
在source code，我看到了：
_get_application_default_credential_GCE()
_get_application_default_credential_GAE()
但对于 GKE，没有任何明确的规定。所以，我假设使用 GCE 的那个。
This doc 提到这应该在 Container Engine 上运行。
Application Default Credentials are best suited for cases
when the call needs to have the same identity and authorization level
for the application independent of the user. This is the recommended
approach to authorize calls to Google Cloud Platform APIs, particularly
when you're building an application that is deployed to Google App
Engine, **Google Container Engine**, or Google Compute Engine virtual
machines.
【问题讨论】：