如何从云运行服务访问Google云存储桶而不使用本地服务帐户密钥文件？

Question

我刚刚部署了一个Cloud Run REST API应用程序，它使用Google Cloud Storage API从桶和桶内的文件夹中获取最后一个文件。这是我正在使用的代码：

import os
import logging
from flask import Flask
from flask import request, jsonify, render_template
from google.oauth2 import service_account
from google.cloud import storage
from bson.json_util import dumps


app = Flask(__name__)

storage_client = storage.Client.from_service_account_json('sa.json')

@app.route('/')
# API Version 1.0
def index():
    """Welcome to Last File API Version 1.0."""
    button_text = "Add File"
    return render_template('main.html', button_text=button_text)

@app.route("/last_file_m_individual/", methods=["GET"])
def list_m_individual_files():
    """List all files in GCP bucket."""
    bucketName = request.args.get('bucketname')
    bucketFolder = request.args.get('bucketfolder')
    bucket = storage_client.get_bucket(bucketName)
    files = bucket.list_blobs(prefix=bucketFolder)
    fileList = [file.name for file in files if '.' in file.name]
    last_file_pep = fileList[-1]
    last_file_p = last_file_pep.split("/")
    last_file = last_file_p[-1]
    return last_file

@app.errorhandler(500)
def server_error(e):
    # Log the error and stacktrace.
    logging.exception('An error occurred during a request.')
    return 'An internal error occurred.', 500

if __name__ == "__main__":
    app.run(debug=True,host='0.0.0.0',port=int(os.environ.get('PORT', 8080)))

如果没有本地的服务帐户密钥文件，我如何在Google云存储和云运行之间进行服务对服务的身份验证？

提前道谢。

Answer 1

在Cloud Run上，Python的Cloud Storage client library将自动获取Cloud Run服务标识的凭据，这要归功于容器中存在的容器实例元数据服务器。在此阅读更多信息