Using Google Cloud Source Repositories with service account

Question

Is it possible to access a Google Cloud Source Repository in an automated way, i.e. from a GCE instance using a service account?

The only authentication method I am seeing in the docs is to use the gcloud auth login command, which will authenticate my personal user to access the repo, not the machine I am running commands from.

score 8 · Answer 1 · answered Apr 13 '17 at 22:16

8

If you want to clone with git rather than running through gcloud, you can run:

git config --global credential.helper gcloud.sh

...and then this will work:

git clone https://source.developers.google.com/p/$PROJECT/r/$REPO

answered Apr 13 '17 at 22:16

Maximilian

7,512
3
50
63

score 7 · Answer 2 · answered Mar 31 '16 at 16:57

7

On GCE vms running

gcloud source repos clone default ~/my_repo

should work automatically without extra step of authentication, as it will use VMs service account.

If you running on some other machine you can download from https://console.cloud.google.com service account .json key file and activate it with

gcloud auth activate-service-account --key-file KEY_FILE

and then run the above clone command.

answered Mar 31 '16 at 16:57

cherba

8,681
3
27
34

For me it gives fatal: remote error: Invalid authentication credentials. Please generate a new identifier: https://source.developers.google.com/auth/start?scopes=https://www.googleapis.com/auth/cloud-platform I tried giving VM service account permissions in https://console.cloud.google.com/code/develop/repo still same error. – Kluyg Apr 01 '17 at 23:57
3

I got it working, need to select "Allow full access to all Cloud APIs" when creating an instance. Otherwise VM service account doesn't have a scope needed, and even with IAM roles granted can't access the repo. – Kluyg Apr 02 '17 at 00:14

score 2 · Answer 3 · answered Dec 19 '18 at 23:40

In case somebody like me was trying to do this as part of Dockerfile, after struggling for a while I've only managed to get it to work like this:

RUN gcloud auth activate-service-account --key-file KEY_FILE ; \
    gcloud source repos clone default ~/my_repo

As you can see, having it to be part of the same RUN command was the key, otherwise it kept failing with

ERROR: (gcloud.source.repos.clone) You do not currently have an active account selected.

score 1 · Answer 4 · edited Aug 04 '17 at 17:47

1

Enable access to the "Cloud Source Repositories" Cloud API for the instance. You should do this while creating or editing the instance in the Admin console
From a shell inside the instance, execute gcloud source repos clone <repo_name_in_cloud_source> <target_path_to_clone_into>

edited Aug 04 '17 at 17:47

Community

1
1

answered Jul 05 '17 at 20:49

andresgottlieb

920
10
18

score 0 · Answer 5 · answered Aug 19 '15 at 19:42

If you are running on GCE, take advantage of the new authentication method that needs fewer lines of code.

When creating your VM instance, under "Access & Security," set "Cloud Platform" to "Enabled."

Then the authentication code is this simple:

from oauth2client.client import GoogleCredentials
credentials = GoogleCredentials.get_application_default()
http = credentials.authorize(httplib2.Http())

See https://developers.google.com/identity/protocols/application-default-credentials

Using Google Cloud Source Repositories with service account

5 Answers5

Linked