从另一个项目访问Cloud Run服务

Question

Can I access the CloudRun api from a different project using a ServiceAccount from that project ?

I have a Project A, in which a CloudRun service (ServiceA) is hosted. I have another Project B, from which I need to call ServiceA using a service account (SvcAcccountB).

But every time I try to make the call to ServiceA using SvcAccountB it fails with a 403. There is no firewall issue as I can see in the logs for ServiceA that call is getting rejected. I have given the "CloudRun Invoker" permissions to SvcAccountB.

If I have service account (svcAccountA) in Project A, then the call to ServiceA works fine.

What else am I missing so that svcAccountB can call ServiceA?

Answer 1

There are 3 steps you need to post to CloudRun Service using a service account:-

1. Get a JWT Token using your service account json file Here's a sample Claims:- Iat: now, // expires after 'expiraryLength' seconds. Exp: now + expiryLength, // Iss must match 'issuer' in the security configuration in your // swagger spec (eg service account email). It can be any string. Iss: saEmail, // Aud must be either your Endpoints service name, or match the value // specified as the 'x-google-audience' in the OpenAPI document. Aud: "https://www.googleapis.com/oauth2/v4/token", // Sub and Email should match the service account's email address. Sub: saEmail, PrivateClaims: map[string]interface{}{"target_audience": audience}, Iat: now, // expires after 'expiraryLength' seconds. Exp: now + expiryLength, // Iss must match 'issuer' in the security configuration in your // swagger spec (eg service account email). It can be any string. Iss: saEmail, // Aud must be either your Endpoints service name, or match the value // specified as the 'x-google-audience' in the OpenAPI document. Aud: "https://www.googleapis.com/oauth2/v4/token", // Sub and Email should match the service account's email address. Sub: saEmail, PrivateClaims: map[string]interface{}{"target_audience": audience}, Iat: now, // expires after 'expiraryLength' seconds. Exp: now + expiryLength, // Iss must match 'issuer' in the security configuration in your // swagger spec (eg service account email). It can be any string. Iss: saEmail, // Aud must be either your Endpoints service name, or match the value // specified as the 'x-google-audience' in the OpenAPI document. Aud: "https://www.googleapis.com/oauth2/v4/token", // Sub and Email should match the service account's email address. Sub: saEmail, PrivateClaims: map[string]interface{}{"target_audience": audience}, where the audience is the url of your CloudRun service.

2. Pass this JWT token to get the Access token Here's more details : https://developers.google.com/identity/protocols/OAuth2ServiceAccount

3. Then send the Access token to your CloudRun service.