由于服务帐户错误，无法在 Google 云中使用加壳器创建图像

Question

我已经在 Gcloud 中创建了一个服务帐户。
在我的 mac.

每当我运行我的打包程序模板时，它都会抱怨这个帐户，我不知道它来自哪里。

Packer 模板：

{
  "builders": [
    {
      "type": "googlecompute",
      "account_file": "/Users/Joe/Downloads/account.json",
      "project_id": "rare-truck-123456",
      "source_image": "centos-7-v20180129",
      "zone": "us-west1-a",
      "ssh_username": "centos"
    }
  ]
}

错误：

➜  packer git:(master) ✗ packer build release_google_image.json
googlecompute output will be in this color.

==> googlecompute: Checking image does not exist...
==> googlecompute: Creating temporary SSH key for instance...
==> googlecompute: Using image: centos-7-v20180129
==> googlecompute: Creating instance...
    googlecompute: Loading zone: us-west1-a
    googlecompute: Loading machine type: n1-standard-1
    googlecompute: Loading network: default
    googlecompute: Requesting instance creation...
    googlecompute: Waiting for creation operation to complete...
==> googlecompute: Error creating instance: 1 error(s) occurred:
==> googlecompute: 
==> googlecompute: * The resource '123412341234-compute@developer.gserviceaccount.com' of type 'serviceAccount' was not found.
Build 'googlecompute' errored: Error creating instance: 1 error(s) occurred:

* The resource '123412341234-compute@developer.gserviceaccount.com' of type 'serviceAccount' was not found.

==> Some builds didn't complete successfully and had errors:
--> googlecompute: Error creating instance: 1 error(s) occurred:

* The resource '123412341234-compute@developer.gserviceaccount.com' of type 'serviceAccount' was not found.

==> Builds finished but no artifacts were created.

为什么要尝试使用 123412341234-compute@developer.gserviceaccount.com？

我在 google 云中的项目下创建了一个具有计算管理员 v1 权限的服务帐户，我下载了我的 json 文件并将其重命名为 accounts.json。该服务帐户的名称不同 (release-builder@rare-truck-123456.iam.gserviceaccount.com)，但加壳程序似乎忽略了它并追踪一些奇怪的帐户。

甚至我的 cli 命令 gcloud info 也会返回正确的服务帐户：

Google 云 SDK [188.0.1]

Platform: [Mac OS X, x86_64] ('Darwin', 'Alexs-MacBook-Pro.local', '16.7.0', 'Darwin Kernel Version 16.7.0: Thu Jan 11 22:59:40 PST 2018; root:xnu-3789.73.8~1/RELEASE_X86_64', 'x86_64', 'i386')
Python Version: [2.7.14 (default, Sep 25 2017, 09:53:22)  [GCC 4.2.1 Compatible Apple LLVM 9.0.0 (clang-900.0.37)]]
Python Location: [/usr/local/Cellar/python/2.7.14/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python]
Site Packages: [Disabled]

Installation Root: [/Users/Joe/Downloads/google-cloud-sdk]
Installed Components:
  core: [2018.02.08]
  gsutil: [4.28]
  bq: [2.0.28]
System PATH: [/Users/Joe/Downloads/google-cloud-sdk/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin]
Python PATH: [/Users/Joe/Downloads/google-cloud-sdk/lib/third_party:/Users/Joe/Downloads/google-cloud-sdk/lib:/usr/local/Cellar/python/2.7.14/Frameworks/Python.framework/Versions/2.7/lib/python27.zip:/usr/local/Cellar/python/2.7.14/Frameworks/Python.framework/Versions/2.7/lib/python2.7:/usr/local/Cellar/python/2.7.14/Frameworks/Python.framework/Versions/2.7/lib/python2.7/plat-darwin:/usr/local/Cellar/python/2.7.14/Frameworks/Python.framework/Versions/2.7/lib/python2.7/plat-mac:/usr/local/Cellar/python/2.7.14/Frameworks/Python.framework/Versions/2.7/lib/python2.7/plat-mac/lib-scriptpackages:/usr/local/Cellar/python/2.7.14/Frameworks/Python.framework/Versions/2.7/lib/python2.7/lib-tk:/usr/local/Cellar/python/2.7.14/Frameworks/Python.framework/Versions/2.7/lib/python2.7/lib-old:/usr/local/Cellar/python/2.7.14/Frameworks/Python.framework/Versions/2.7/lib/python2.7/lib-dynload]
Cloud SDK on PATH: [True]
Kubectl on PATH: [False]

Installation Properties: [/Users/Joe/Downloads/google-cloud-sdk/properties]
User Config Directory: [/Users/Joe/.config/gcloud]
Active Configuration Name: [default]
Active Configuration Path: [/Users/Joe/.config/gcloud/configurations/config_default]

Account: [release-builder@rare-truck-123456.iam.gserviceaccount.com]
Project: [rare-truck-123456]

Current Properties:
  [core]
    project: [rare-truck-123456]
    account: [release-builder@rare-truck-123456.iam.gserviceaccount.com]
    disable_usage_reporting: [True]
  [compute]
    region: [us-west1]
    zone: [us-west1-a]

Logs Directory: [/Users/Joe/.config/gcloud/logs]
Last Log File: [/Users/Joe/.config/gcloud/logs/2018.02.09/15.51.18.911677.log]

git: [git version 2.14.3 (Apple Git-98)]
ssh: [OpenSSH_7.4p1, LibreSSL 2.5.0]

Answer 1

Google Compute Engine 实例使用默认服务帐户以更好地与 Google 平台集成。

如您在文档 [1] 中所读：“(...)如果用户将管理配置为运行作为服务帐户的虚拟机实例，您还必须授予roles/iam.serviceAccountActor 角色。

您需要将角色 "Service Account User" 添加到您的服务帐户，以便能够创建 Google 个 Compute Engine 实例。

[1] https://cloud.google.com/iam/docs/understanding-roles#compute_name_short_roles

由于服务帐户错误，无法在 Google 云中使用加壳器创建图像

Cannot create image with packer in Google Cloud due to service account error

google-cloud-platform

google-compute-engine

gcloud

packer

google-iam