使用Kubernetes引擎GKE Google Cloud的Spring boot Cloud SQL

Question

我创建了一个spring boot项目，它与云SQL（MySQL）连接。我已经在google cloud（cloudrun）中部署了这一功能，目前正在使用中。

现在，我正在尝试在kubernates enigne GKE中部署Spring boot应用程序的相同容器映像，我预计这将与mysql云sql实例连接。但是，我在应用程序POD日志中收到以下错误。

     "method" : "google.cloud.sql.v1beta4.SqlInstancesService.CreateEphemeral"
      "service" : "sqladmin.googleapis.com",
    "metadata" : {
    "domain" : "googleapis.com",
    "reason" : "ACCESS_TOKEN_SCOPE_INSUFFICIENT",
    "@type" : "type.googleapis.com/google.rpc.ErrorInfo",
  "details" : [ {
  "status" : "PERMISSION_DENIED",
  "message" : "Request had insufficient authentication scopes.",
  } ],
    "reason" : "insufficientPermissions"
    "message" : "Insufficient Permission",
    "domain" : "global",
  "errors" : [ {
  "code" : 403,

Failed to create ephemeral certificate for the Cloud SQL instance.

请帮忙。。。解决方案是什么

Answer 1

不确定如何传递服务号文件，但您可以使用库伯内特斯秘密传递它，或者使用服务帐户并将其附加到部署。

kubectl create secret generic google-application-credentials --from-file=./application-credentials.json

附加秘密的部署卷

volumes:
- name: google-application-credentials-volume
  secret:
    secretName: google-application-credentials
    items:
    - key: application-credentials.json # default name created by the create secret from-file command
      path: application-credentials.json

在小路上安装秘密

spec:
  containers:
  - name: my-service
    volumeMounts:
    - name: google-application-credentials-volume
      mountPath: /etc/gcp
      readOnly: true

最后，您可以传递指向该文件和cred的环境变量

spec:
  containers:
  - name: my-service
    env:
    - name: GOOGLE_APPLICATION_CREDENTIALS
      value: /etc/gcp/application-credentials.json

确保您的服务帐户具有足够的角色来更新云SQL。