使用 Google Cloud Dataproc 创建集群时，请求的身份验证范围不足 [403]

Question

在 Google Cloud Platform 中启用了 DataProc API。我使用与访问 GCS 和大查询相同的密钥来为每个 this example 创建一个新集群。我在下一行收到 Request had insufficient authentication scopes 错误。

 Operation createOperation =
            service.Projects.Regions.Clusters.Create(newCluster, project, dataprocGlobalRegion).Execute();

我的完整代码：

public static class DataProcClient
  {
    public static void Test()
    {
      string project = ConfigurationManager.AppSettings["Google.ProjectName"]; ;
      string dataprocGlobalRegion = "global";
      string zone = "us-east1-b";
      string machineType = "n1-standard-4";
      string clusterName = "sample-cluster";
      int numWorkers = 2;

        String serviceAccountEmail= ConfigurationManager.AppSettings["Google.ServiceAccountEmail"];
        String certificateFile = ConfigurationManager.AppSettings["KeyDirectory"] + ConfigurationManager.AppSettings["Google.CertificateFile"];
        X509Certificate2 certificate = new X509Certificate2(certificateFile, "notasecret", X509KeyStorageFlags.Exportable);

        ServiceAccountCredential credential = new ServiceAccountCredential(
                new ServiceAccountCredential.Initializer(serviceAccountEmail)
                {
                  Scopes = new[] { StorageService.Scope.DevstorageFullControl }
                }.FromCertificate(certificate));

        DataprocService service = new DataprocService(
            new BaseClientService.Initializer()
            {
              HttpClientInitializer = credential,
              ApplicationName = "Dataproc Sample",
            });

        // Create a new cluster:
        Cluster newCluster = new Cluster
        {
          ClusterName = clusterName,
          Config = new ClusterConfig
          {
            GceClusterConfig = new GceClusterConfig
            {
              ZoneUri = String.Format(
                  "https://www.googleapis.com/compute/v1/projects/{0}/zones/{1}",
                  project, zone),
            },
            MasterConfig = new InstanceGroupConfig
            {
              NumInstances = 1,
              MachineTypeUri = String.Format(
                  "https://www.googleapis.com/compute/v1/projects/{0}/zones/{1}/machineTypes/{2}",
                  project, zone, machineType),
            },
            WorkerConfig = new InstanceGroupConfig
            {
              NumInstances = numWorkers,
              MachineTypeUri = String.Format(
                  "https://www.googleapis.com/compute/v1/projects/{0}/zones/{1}/machineTypes/{2}",
                  project, zone, machineType),
            },
          },
        };

        Operation createOperation =
            service.Projects.Regions.Clusters.Create(newCluster, project, dataprocGlobalRegion).Execute();
        // Poll the operation:
        while (!IsDone(createOperation))
        {
          Console.WriteLine("Polling operation {0}", createOperation.Name);
          createOperation =
              service.Projects.Regions.Operations.Get(createOperation.Name).Execute();
          Thread.Sleep(1000);
        }
    }
    static bool IsDone(Operation op)
    {
      return op.Done ?? false;
    }
  }

Answer 1

创建 ServiceAccountCredential 时，更改：

new[] { StorageService.Scope.DevstorageFullControl }

到：

new[] { DataprocService.Scope.CloudPlatform }