如何直接从 Go 中的 GCP 服务帐户 JSON 密钥文件创建

Question

我正在寻找一种kubernetes.Clientset从服务帐户 JSON 密钥文件开始在 Go 中为 GKE 初始化的方法。我找到了一些线索，比如这个博客和这个相关的要点，但是那里概述的方法似乎需要列出 GCP 项目中的所有集群以创建 kubeconfig 的内存中表示，这并不理想。

Answer 1

使用来自https://github.com/rancher/kontainer-engine的GKE 驱动程序代码作为灵感，我想出了以下方法（避免了对 的依赖）：k8s.io/client-go/tools/clientcmdpackage mainimport (&nbsp; &nbsp; "context"&nbsp; &nbsp; "encoding/base64"&nbsp; &nbsp; "fmt"&nbsp; &nbsp; "io/ioutil"&nbsp; &nbsp; "log"&nbsp; &nbsp; "net/http"&nbsp; &nbsp; "strings"&nbsp; &nbsp; "golang.org/x/oauth2"&nbsp; &nbsp; "golang.org/x/oauth2/google"&nbsp; &nbsp; "google.golang.org/api/container/v1"&nbsp; &nbsp; "google.golang.org/api/option"&nbsp; &nbsp; v1 "k8s.io/apimachinery/pkg/apis/meta/v1"&nbsp; &nbsp; "k8s.io/client-go/kubernetes"&nbsp; &nbsp; "k8s.io/client-go/rest")func getGKEClientset(cluster *container.Cluster, ts oauth2.TokenSource) (kubernetes.Interface, error) {&nbsp; &nbsp; capem, err := base64.StdEncoding.DecodeString(cluster.MasterAuth.ClusterCaCertificate)&nbsp; &nbsp; if err != nil {&nbsp; &nbsp; &nbsp; &nbsp; return nil, fmt.Errorf("failed to decode cluster CA cert: %s", err)&nbsp; &nbsp; }&nbsp; &nbsp; config := &rest.Config{&nbsp; &nbsp; &nbsp; &nbsp; Host: cluster.Endpoint,&nbsp; &nbsp; &nbsp; &nbsp; TLSClientConfig: rest.TLSClientConfig{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CAData: capem,&nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; }&nbsp; &nbsp; config.Wrap(func(rt http.RoundTripper) http.RoundTripper {&nbsp; &nbsp; &nbsp; &nbsp; return &oauth2.Transport{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Source: ts,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Base:&nbsp; &nbsp;rt,&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; })&nbsp; &nbsp; clientset, err := kubernetes.NewForConfig(config)&nbsp; &nbsp; if err != nil {&nbsp; &nbsp; &nbsp; &nbsp; return nil, fmt.Errorf("failed to initialise clientset from config: %s", err)&nbsp; &nbsp; }&nbsp; &nbsp; return clientset, nil}func main() {&nbsp; &nbsp; gcpServiceAccountKeyFile := "gcp_service_account_key.json"&nbsp; &nbsp; gkeLocation := "<GKE Project Location>" // i.e. us-east1&nbsp; &nbsp; gkeClusterName := "<GKE Cluster Name>"&nbsp; &nbsp; gkeNamespace :=&nbsp; "<GKE Cluster Namespace>"&nbsp; &nbsp; data, err := ioutil.ReadFile(gcpServiceAccountKeyFile)&nbsp; &nbsp; if err != nil {&nbsp; &nbsp; &nbsp; &nbsp; log.Fatalf("Failed to read GCP service account key file: %s", err)&nbsp; &nbsp; }&nbsp; &nbsp; ctx := context.Background()&nbsp; &nbsp; creds, err := google.CredentialsFromJSON(ctx, data, container.CloudPlatformScope)&nbsp; &nbsp; if err != nil {&nbsp; &nbsp; &nbsp; &nbsp; log.Fatalf("Failed to load GCP service account credentials: %s", err)&nbsp; &nbsp; }&nbsp; &nbsp; gkeService, err := container.NewService(ctx, option.WithHTTPClient(oauth2.NewClient(ctx, creds.TokenSource)))&nbsp; &nbsp; if err != nil {&nbsp; &nbsp; &nbsp; &nbsp; log.Fatalf("Failed to initialise Kubernetes Engine service: %s", err)&nbsp; &nbsp; }&nbsp; &nbsp; name := fmt.Sprintf("projects/%s/locations/%s/clusters/%s", creds.ProjectID, gkeLocation, gkeClusterName)&nbsp; &nbsp; cluster, err := container.NewProjectsLocationsClustersService(gkeService).Get(name).Do()&nbsp; &nbsp; if err != nil {&nbsp; &nbsp; &nbsp; &nbsp; log.Fatalf("Failed to load GKE cluster %q: %s", name, err)&nbsp; &nbsp; }&nbsp; &nbsp; clientset, err := getGKEClientset(cluster, creds.TokenSource)&nbsp; &nbsp; if err != nil {&nbsp; &nbsp; &nbsp; &nbsp; log.Fatalf("Failed to initialise Kubernetes clientset: %s", err)&nbsp; &nbsp; }&nbsp; &nbsp; pods, err := clientset.CoreV1().Pods(gkeNamespace).List(ctx, v1.ListOptions{})&nbsp; &nbsp; if err != nil {&nbsp; &nbsp; &nbsp; &nbsp; log.Fatalf("Failed to list pods: %s", err)&nbsp; &nbsp; }&nbsp; &nbsp; log.Printf("There are %d pods in the namespace", len(pods.Items))}