Athenticating gcloud service account within gitlab CI/CD

Question

I am deploying a service to gcloud from gitlab-ci.yml file using gcloud-service-key.json. I get this error

$ google-cloud-sdk/bin/gcloud auth activate-service-account --key-file ${HOME}/gcloud-service-key.json ERROR: gcloud crashed (ValueError): No key could be detected.

Find below a subset of the code snippet

 - apk add --update make ca-certificates openssl python --repository https://alpine.global.ssl.fastly.net/alpine/v3.10/community --repository https://alpine.global.ssl.fastly.net/alpine/v3.10/main && rm -fR /var/cache/apk/*
  - update-ca-certificates
  # Write our GCP service account private key into a file
  - echo $GCLOUD_SERVICE_KEY > ${HOME}/gcloud-service-key.json
  # Download and install Google Cloud SDK
  - wget https://dl.google.com/dl/cloudsdk/release/google-cloud-sdk.tar.gz
  - tar zxvf google-cloud-sdk.tar.gz && ./google-cloud-sdk/install.sh --usage-reporting=false --path-update=true
  - google-cloud-sdk/bin/gcloud --quiet components update
  - google-cloud-sdk/bin/gcloud auth activate-service-account --key-file ${HOME}/gcloud-service-key.json

Any help will be appraciated, I've been at this for several days now.

Wojtek_B Wojtek_B · Accepted Answer · 2020-08-06T15:40:30

It looks like there's an issue with you key-file. Try generating new one with gcloud:

$ gcloud iam service-accounts keys create key1.json [email protected]
created key [6ca5ffc929f31d1f1915d430887a7fa3689eb69d] of type [json] as [key1.json] for [[email protected]]

There's also an official documentation how to generate a key - feel free to have a look if in doubt.

Your json key-file should look like this:

{
  "type": "service_account",
  "project_id": "xxxxxx,
  "private_key_id": "6ca5ffc929f31d1f1915d430887a7fa3689eb69d",
  "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAAsdfsd234fesSiAgEAAoIBAQDKnmI67Aw3DgHM\n1b25LH1jRAV0pt6hjTEeJGH$
  "client_email": "[email protected]",
  "client_id": "110107674812168412361",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/[email protected]"
}

If your file looks in a different way check the echo $GCLOUD_SERVICE_KEY > ${HOME}/gcloud-service-key.json part. It may be an issue with the $GCLOUD_SERVICE_KEY variable.

Also if you have any doubts about activating an account there's also another piece of documentation on how to do it.

Athenticating gcloud service account within gitlab CI/CD

1 Answers