如何解决如何在Google Cloud Run中生成Blob签名的网址?
在Google Cloud Run下,您可以选择容器正在运行的服务帐户。使用默认的计算服务帐户无法生成签名的URL。
如果您允许服务帐户的所有范围,则此处列出的解决方法适用于Google Cloud Compute。在Cloud Run中似乎并没有做到这一点(我找不到)。
https://github.com/googleapis/google-auth-library-python/issues/50
我尝试过的事情:
- 为服务帐户分配角色:
roles/iam.serviceAccountTokenCreator
- 在虚拟机中的同一个GCP项目中(相对于Cloud Run)验证了解决方法
- 验证代码是否在容器中本地工作,并具有从私钥(通过json文件)加载的服务帐户。
from google.cloud import storage
client = storage.Client()
bucket = client.get_bucket('EXAMPLE_BUCKET')
blob = bucket.get_blob('libraries/image_1.png')
expires = datetime.now() + timedelta(seconds=86400)
blob.generate_signed_url(expiration=expires)
失败:
you need a private key to sign credentials.the credentials you are currently using <class 'google.auth.compute_engine.credentials.Credentials'> just contains a token. see https://googleapis.dev/python/google-api-core/latest/auth.html#setting-up-a-service-account for more details.
/usr/local/lib/python3.8/site-packages/google/cloud/storage/_signing.py,line 51,in ensure_signed_credentials
尝试添加解决方法,
Error calling the IAM signBytes API:
{ "error": { "code": 400,"message": "Request contains an invalid argument.","status": "INVALID_ARGUMENT" }
}
Exception Location: /usr/local/lib/python3.8/site-packages/google/auth/iam.py,line 81,in _make_signing_request
Github问题中提到的解决方法代码:
from google.cloud import storage
from google.auth.transport import requests
from google.auth import compute_engine
from datetime import datetime,timedelta
def get_signing_creds(credentials):
auth_request = requests.Request()
print(credentials.service_account_email)
signing_credentials = compute_engine.IDTokenCredentials(auth_request,"",service_account_email=credentials.ser
vice_account_email)
return signing_credentials
client = storage.Client()
bucket = client.get_bucket('EXAMPLE_BUCKET')
blob = bucket.get_blob('libraries/image_1.png')
expires = datetime.now() + timedelta(seconds=86400)
signing_creds = get_signing_creds(client._credentials)
url = blob.generate_signed_url(expiration=expires,credentials=signing_creds)
print(url)
如何在Google Cloud Run下生成签名的URL? 此时,似乎我可能必须挂载想要避免的服务帐户密钥。
编辑: 为了弄清楚,服务帐户具有正确的权限-它可以在GCE中使用,并且可以在本地使用JSON私钥。
解决方法
是的,但是我必须深入研究以找到方法(如果您不关心细节,请跳到最后)
如果您进入_signing.py file
,line 623,可以看到此
if access_token and service_account_email:
signature = _sign_message(string_to_sign,access_token,service_account_email)
...
如果提供access_token
和service_account_email
,则可以使用_sign_message
方法。此方法使用IAM service SignBlob API处的this line
这很重要,因为您现在可以在本地没有私钥的情况下对Blob进行签名!这样就解决了问题,下面的代码可以在Cloud Run上运行(我确定可以在Cloud Function上运行)
def sign_url():
from google.cloud import storage
from datetime import datetime,timedelta
import google.auth
credentials,project_id = google.auth.default()
# Perform a refresh request to get the access token of the current credentials (Else,it's None)
from google.auth.transport import requests
r = requests.Request()
credentials.refresh(r)
client = storage.Client()
bucket = client.get_bucket('EXAMPLE_BUCKET')
blob = bucket.get_blob('libraries/image_1.png')
expires = datetime.now() + timedelta(seconds=86400)
# In case of user credential use,define manually the service account to use (for development purpose only)
service_account_email = "YOUR DEV SERVICE ACCOUNT"
# If you use a service account credential,you can use the embedded email
if hasattr(credentials,"service_account_email"):
service_account_email = credentials.service_account_email
url = blob.generate_signed_url(expiration=expires,service_account_email=service_account_email,access_token=credentials.token)
return url,200
让我知道是否不清楚
,您不能使用默认服务帐户对网址进行签名。
使用具有权限的专用服务帐户再次尝试服务代码,看看是否可以解决您的错误
参考文献和进一步阅读:
- https://stackoverflow.com/a/54272263
- https://cloud.google.com/storage/docs/access-control/signed-urls
- https://github.com/googleapis/google-auth-library-python/issues/238
已将更新的方法添加到 GCP 的 documentation 中,用于 Cloud Run 和 App Engine 等无服务器实例。
以下 snippet 显示了如何从存储库创建签名 URL。
def generate_upload_signed_url_v4(bucket_name,blob_name):
"""Generates a v4 signed URL for uploading a blob using HTTP PUT.
Note that this method requires a service account key file. You can not use
this if you are using Application Default Credentials from Google Compute
Engine or from the Google Cloud SDK.
"""
# bucket_name = 'your-bucket-name'
# blob_name = 'your-object-name'
storage_client = storage.Client()
bucket = storage_client.bucket(bucket_name)
blob = bucket.blob(blob_name)
url = blob.generate_signed_url(
version="v4",# This URL is valid for 15 minutes
expiration=datetime.timedelta(minutes=15),# Allow PUT requests using this URL.
method="PUT",content_type="application/octet-stream",)
return url
一旦您的后端返回签名 URL,您就可以从前端执行 curl put 请求,如下所示
curl -X PUT -H 'Content-Type: application/octet-stream' --upload-file my-file 'my-signed-url'
版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。