与@google-cloud的工作负载身份联合

Question

有没有人知道，如果有任何其他方式的身份验证/授权访问谷歌云存储除了服务帐户密钥当我使用@google-cloud/StorageNode.js模块从这里?我读过关于"工作负载身份联合"，但对我来说，当我使用@google-cloud/storage库时，我似乎不能使用这种方法。我没有找到任何合适的构造函数，只有这两个:

const {Storage} = require('@google-cloud/storage');
var storage = new Storage({
projectId   : `my_google_project_id`,
keyFilename : `my_google_key_file.json`   // service account key is inside of this file
});
// or this one:
var storage = new Storage();    // service account key is inside of file specified by environment variable GOOGLE_APPLICATION_CREDENTIALS

建议吗?谢谢你

Answer 1

大多数Google客户端支持类型为external_account的新秘密密钥文件。下面演示如何创建此文件并设置应用程序默认凭据(ADC)以加载此文件。

要在Google Client库中使用工作负载身份联合，请将联合凭据保存到一个文件中，然后通过环境变量GOOGLE_APPLICATION_CREDENTIALS指定该文件。Storage客户端将使用ADC并从环境中定位凭据。

示例(AWS):

# Generate an AWS configuration file.
gcloud iam workload-identity-pools create-cred-config 
projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$POOL_ID/providers/$AWS_PROVIDER_ID 
--service-account $SERVICE_ACCOUNT_EMAIL 
--aws 
--output-file /path/to/generated/config.json

Azure示例:

# Generate an Azure configuration file.
gcloud iam workload-identity-pools create-cred-config 
projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$POOL_ID/providers/$AZURE_PROVIDER_ID 
--service-account $SERVICE_ACCOUNT_EMAIL 
--azure 
--output-file /path/to/generated/config.json

注意:我在Azure VM上生成了我的凭据。我在上面的命令中添加了以下命令行选项:

--app-id-uri=https://iam.googleapis.com/projects/REDACTED/locations/global/workloadIdentityPools/pool-azure/providers/provider-id

输出文件用于设置环境:

set GOOGLE_APPLICATION_CREDENTIALS=/path/to/generated/config.json

文件具有以下结构。这个例子是针对Azure的:

{
"type": "external_account",
"audience": "//iam.googleapis.com/projects/REDACTED/locations/global/workloadIdentityPools/pool-azure/providers/provider-id",
"subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
"token_url": "https://sts.googleapis.com/v1/token",
"credential_source": {
"url": "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://iam.googleapis.com/projects/REDACTED/locations/global/workloadIdentityPools/pool-azure/providers/provider-id",
"headers": {
"Metadata": "True"
},
"format": {
"type": "json",
"subject_token_field_name": "access_token"
}
},
"service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/[e-mail]:generateAccessToken"
}

使用此样式创建客户端:

var storage = new Storage();