PROSAGA码农传奇-k8s/Kubernetes-为GKE身份验证生成的令牌缺少权限

<div class =“post-text”itemprop =“text”>
  <P>
    所以，如果你看一下代码
    <a href="https://github.com/google-cloud-sdk/google-cloud-sdk/blob/af9de150b5107cd0dc66cb1cf3de417f06d56691/lib/surface/auth/application_default/print_access_token.py#L67" rel="nofollow noreferrer">
      这里
    </A>
     对于
     <code>
      print-access-token
    </code>
     您可以看到访问令牌通常是在没有范围的情况下打印的。你看：
  </p>
   <pre>
    <code>
      try:
  creds = client.GoogleCredentials.get_application_default()
except client.ApplicationDefaultCredentialsError as e:
  log.debug(e, exc_info=True)
  raise c_exc.ToolException(str(e))

if creds.create_scoped_required():
   ...

</code>
  </pre>
  <P>
    然后就此而言
    <a href="https://github.com/google-cloud-sdk/google-cloud-sdk/blob/af9de150b5107cd0dc66cb1cf3de417f06d56691/lib/third_party/oauth2client/client.py#L1163" rel="nofollow noreferrer">
      文件
    </A>
     你看：
  </p>
   <pre>
    <code>
      def create_scoped_required(self):
    """Whether this Credentials object is scopeless.
    create_scoped(scopes) method needs to be called in order to create
    a Credentials object for API calls.
    """
    return False

</code>
  </pre>
  <P>
    显然，在您的代码中，您将获得带有令牌的令牌
     <code>
      https://www.googleapis.com/auth/cloud-platform
    </code>
     范围。您可以尝试删除它或尝试使用
    <a href="https://github.com/google-cloud-sdk/google-cloud-sdk/blob/5514f695e0f3068d72f6ee7ee0de57e89aa259d1/lib/googlecloudsdk/api_lib/auth/util.py#L42" rel="nofollow noreferrer">
      USER_EMAIL_SCOPE
    </A>
     因为你指定：
     <code>
      "iss": self._service_account_key["client_email"]
    </code>
    。
  </p>
  <P>
    你总能检查一下
     <code>
      gcloud auth activate-service-account --key-file=credentials.json
    </code>
     商店下
     <code>
      ~/.config
    </code>
    。所以你知道
     <code>
      gcloud auth print-access-token
    </code>
     使用。请注意，按照
    <a href="https://github.com/google-cloud-sdk/google-cloud-sdk/blob/5514f695e0f3068d72f6ee7ee0de57e89aa259d1/lib/googlecloudsdk/core/credentials/store.py#L415" rel="nofollow noreferrer">
      这个
    </A>
     和
    <a href="https://github.com/google-cloud-sdk/google-cloud-sdk/blob/5514f695e0f3068d72f6ee7ee0de57e89aa259d1/lib/googlecloudsdk/core/credentials/creds.py#L311" rel="nofollow noreferrer">
      这个
    </A>
     看起来商店就在
    <a href="https://www.sqlite.org/index.html" rel="nofollow noreferrer">
      源码
    </A>
     格式。
  </p>
</DIV>