I am trying to use the google speech API for converting an audio file to text, but facing some problems with the documentation.I have enabled the speech API and created an service account file. I also got the service account credentials activated. Then I wrote the following command to retrieve the authorization token using my service account.
gcloud auth application-default print-access-token
But it is returning this message
I don't understand why this is happening because I already have an VM instance created in my Compute Engine. Can anybody explain where am I going wrong with this? Also, is there any other way to authenticate my account and call the google speech API?
gcloud credentials and and application default credentials are managed separately. If you activated service account key file this only can be used for gcloud commands but not for application default credentials.
gcloud auth application-default set of commands are there only to manage application default and having nothing to do with commands in gcloud auth.
There a few ways to "activate" application default credentials:
Use your user account
Run gcloud auth application-default login, or
Use service account (preferred)
set environment variable GOOGLE_APPLICATION_CREDENTIALS=path/to/your/service_accont_key_file.json
copy path/to/your/service_accont_key_file.json to ~/.config/gcloud/application_default_credentials.json`
On windows this might be different, run
gcloud info --format="value(config.paths.global_config_dir)"
to get a path to your config directory.
now command like
gcloud auth application-default print-access-token
should work.
As A solution you can Download the GCLOUD console and then RUN this command on console "gcloud auth application-default" login with the gmail account which have the project access and then you will get access of google api which are enabled.
you can generate your key json file on gcloud using this command:
gcloud auth application-default login
google will display a link to confirm, once you do, there will be the json file ina temp folder displayed
Related
I have been trying to log with a new corporate account in order to push some code in gcp Cloud Repository. Despite all my attempts at logging in with the new user, somehow when I issue git push it still tells me
ERROR: Your current active account [old_email#domain.com] does not have any valid credentials
Please run:
$ gcloud auth login
to obtain new credentials.
For service account, please activate it first:
$ gcloud auth activate-service-account ACCOUNT
Run 'gcloud auth login' to log in.
Username for 'https://source.developers.google.com':
When I run gcloud auth list only the new corporate email <new_corporate_email>#domain.com is displayed.
Here are the steps I took
gcloud auth login
gcloud auth login --no-launch-browser
gcloud auth application-default login
gcloud config set account <new_corporate_email>#domain.com
git config --global user.email "<new_corporate_email>#domain.com"
Where is the current active account stored and how do I refresh its value? Could this be strictly a git issue?
I suspected it was a problem with git and its relationship with gcloud since I am using Google Cloud Source Repositories.
What I did was not solve this solution perse, but I offer you a workaround in case you get the same error. Here are the steps I applied to "fix" it:
I made sure I was logged with the right account on gcloud
I made sure that account had the right IAM rights within the GCP
project
I backed up my source repo (thankfully, only these few last changes
were missing from my remote repo)
I deleted the original local source code repo and recloned it using
gcloud
I took the changes from my backup folder via rsync
I tested a commit & push and it worked
I,ve added my service-account successfuly using below command.
gcloud auth activate-service-account --key-file=mycredentialsialreadyhad.json
Now I can't remove or logout from it.
any help would be greatly appreciated.
edit:
i tried this commands and got error
gcloud auth revoke
ERROR: (gcloud.auth.revoke) Cannot revoke GCE-provided credentials.
gcloud config configurations delete default
ERROR: (gcloud.config.configurations.delete) Deleting named configuration failed because configuration [default] is set as active. Use gcloud config configurations activate to change the active configuration.
edit2: this gcloud cli is on GCP ubuntu VM
UPDATE
Use a command with a specified account because you can't revoke the Compute Engine service account(default).
For example:
gcloud auth revoke serviceaccount#testproject.iam.gserviceaccount.com
and run:
gcloud auth list
It should only display the default service account of the Compute Engine:
[PROJECT-NUMBER]-compute#developer.gserviceaccount.com
I may be late to the party on this, but the solution that I found works is:
gcloud config unset auth/impersonate_service_account
Followed by:
gcloud auth login
TLDR; To logout from all accounts
gcloud auth revoke --all
To check active account logins
gcloud auth list
To logout form one account only (take account from command above)
gcloud auth revoke [ACCOUNT]
this error happens when you try to remove a service account that was propagated to the machine during the creation time (docs here).
this service account could not be removed from your machine.
in any other case, the following commands should work (as mentioned in other answers here).
gcloud auth revoke --all
OR
gcloud auth revoke [ACCOUNT]
Use the below syntax to activate the service account. Here we need to mention service account ID.
gcloud auth activate-service-account testpck#xxxxxx.iam.gserviceaccount.com --key-file=xxxxxx.json --project=xxxxxx
Use the below syntax to revoke the service account:
gcloud auth revoke testpck#xxxxx.iam.gserviceaccount.com
Error encountered in your case because the service account ID was not mentioned in gcloud auth revoke command , which is trying to revoke your active google account.
Permissions are denied if you disable the service account instead of revoke. If you revoke the service account then default account will get activated and that might have permission to storage.
In addition to gcloud auth revoke commands mentioned above, I also had to unset the GOOGLE_APPLICATION_CREDENTIALS env variable.
unset GOOGLE_APPLICATION_CREDENTIALS
I'm using gcloud and kubectl to handle my resources (Kubernetes, VM and so on). Everything worked find until I read some article that created a new service account and activate it via cloud. Something like this:
gcloud auth activate-service-account --key-file=path/to/key
The created service account has limited permissions to few resources. When I run commands, like:
kubectl --namespace production get pods
I'm getting back response like:
Error from server (Forbidden): pods is forbidden: User
"SA-USER#PROGECTNAME.iam.gserviceaccount.com"
cannot list resource "pods" in API group "" in the namespace
"production": requires one of ["container.pods.list"] permission(s).
The SA SA-USER#PROGECTNAME.iam.gserviceaccount.com is the service account that I created yesterday. For some reason, it took control on my default permissions and I'm locked out because this user almost has no permissions.
I tried to make the gcloud forget this service account without success. Things I tried:
Uninstall & Install of gcloud and kubectl
Remove the config directory ("~/.config/gcloud/")
gcloud auth login
All those tried was failed. I still getting the same message as above.
How I can make gcloud and kubectl forget this service account?
Thanks!
UPDATE for the new auth plugin:
Some time ago, gke adopted the new auth plugin architecture for kubernetes.
In the new plugin gke-gcloud-auth-plugin, the authentication cache is at
macOS: ~/.kube/gke_gcloud_auth_plugin_cache
(Please edit this answer to include locations in others operation systems.)
You can just delete that file.
There is a problem with the expiration of the authentication token used by kubectl.
When you choose a new user via gcloud and make a kubectl request, an authentication token is cached locally.
A workaround is to edit your ~/.kube/config and set a date in the past for the expiry field on the relevant user section.
You can perform a gcloud auth application-default login
You can also see the current configuration of your gcloud CLI by doing gcloud config list. You can change some default parameter with gcloud config set param_name param_value. For example (because you will use often it if you have several projects)
gcloud config set project MyProjectId
With these, you will be able to solve your issue
gcloud has a --impersonate-service-account flag
gsutil has a -i flag
But I want to configure impersonation once in my current session and then know that all future commands are using that service account. So what I want is to gcloud activate-service-account some-service-account-to-impersonate WITHOUT a static key. Is this possible? Can gcloud setup impersonation for my current session like this without me having to specify --impersonate-service-account for every command?
Additionally I want to develop locally and run my app locally as a service account using impersonation. If I have the app configured to use implicit creds (google SDK should look for GOOGLE_APPLICATION_CREDENTIALS or use the user's oath creds by default) I'm thinking it would be possible to run gcloud activate-service-account with impersonation then run my app in that same session and it will run with the impersonated account.
EDIT: per comments looks like this is what I want: gcloud config set auth/impersonate_service_account [SA_FULL_EMAIL]
I wrote an article that goes into detail on how to setup and use service account impersonation.
Google Cloud – Improving Security with Impersonation
To configure the CLI to use impersonation by default:
gcloud config set auth/impersonate_service_account [SA_FULL_EMAIL]
To clear this setting
gcloud config unset auth/impersonate_service_account
I am unable to non-interactively activate my Google Cloud service account; even after reading several SO threads.
Creating a service account
gcloud iam service-accounts create my-awesome-acct ...
Creating a role for the service account
gcloud iam roles create AwesomeRole \
--permissions storage.objects.create,storage.objects.delete ....
Generating the keys
gcloud iam service-accounts keys create ~/awesome-key.json ...
Activating the service account
gcloud auth activate-service-account my-awesome-acct ~/awesome-key.json
My Issue
Even after following the above steps, when I run gsutil ... commands, I still get the error message:
$ gsutil cp my_file.tgz gs://my_bucket
Copying file://my_file.tgz [Content-Type=application/x-tar]...
Your credentials are invalid. Please run
$ gcloud auth login
The only way I could get this to work is to actually run gcloud auth login and allow the authentication in a web browser.
Am I doing something wrong? Or is this intended for every service account?
I'm going to answer my own question here.
My Solution
Instead of using gsutil, I decided to use the Google Cloud Client Libraries.
What I did:
gsutil cp my_file.tgz gs://my_bucket
What I am doing now:
from gcloud import storage
# key file is located in my current directory
os.environ.get('GOOGLE_APPLICATION_CREDENTIALS', 'gcloud-auth.json')
client = storage.Client()
bucket = client.get_bucket("my_bucket")
blob = bucket.blob("my_file.tgz")
blob.upload_from_filename("my_file.tgz")
Hindsight 20/20
After getting the above solution working, it seems if I also set the environment variable, GOOGLE_APPLICATION_CREDENTIALS, my gsutil should've worked too. (untested)