如何解决 GKE 上响应“403 unauthorized”的日志记录问题

Question

我正在 GKE 上开发一个应用程序，其中具有带堆栈驱动程序日志记录的日志记录功能。

现在我遇到了如下所述的问题。

【日志】

https://logging.googleapis.com/v2/entries:write?alt=json 返回 "User unauthorized to access 209122328335">

上面引用的日志在这里输出(★)。

    def __logging_v1(self):
        def create_service():
            from oauth2client.client import GoogleCredentials
            credentials = GoogleCredentials.get_application_default()

            print(credentials.service_account_email) # ☆

            from googleapiclient import discovery
            return discovery.build('logging',
                                   'v2', 
                             discoveryServiceUrl=discovery.V2_DISCOVERY_URI, 
                                   credentials=credentials,
                                   cache_discovery=False)

        body = self.__get_body()
        req = create_service().entries().write(body=body)

        try:
            req.execute()
        except Exception as err:
            # for system-log to detect an abnormality
            print('StackDriver AlertTag')
            print(err)　# ★Here

在一点(☆)上，我确认指定了一个服务帐户，它作为sercret-key挂载在容器上，并具有一些由IAM设置的角色(■1)。

■1

App Engine manager
BigQuery manager
Stackdriver Debugger agent
Stackdriver Profiler agent
Cloud SQL manager
Cloud Taskmanager
Cloud Trace manager
Compute manager
Cloud Datastore index manager
Cloud Datastore oner
Error Reporting manager
Logging manager
Monitoring manager
Pub/Sub manager
Service Management manager
Service controller
Source Repository manager
Stackdriver Account editer
Storage manager

其他条件：

1) 有效 API 服务

Compute Engine API
Stackdriver Logging API
Stackdriver Monitoring API
BigQuery API
Cloud Build API
Cloud Datastore API
Cloud Firestore API
Cloud OS Login API
Cloud Pub/Sub API
Cloud Source Repositories API
Cloud SQL
Compute Engine Instance Group Manager API
Container Registry API
Firebase Rules API
Google Cloud APIs
Google Cloud Deployment Manager V2 API
Google Cloud DNS API
Google Cloud Memorystore for Redis API
Google Cloud Storage
Google Cloud Storage JSON API
Google Compute Engine Instance Group Updater API
Google Compute Engine Instance Groups API
Kubernetes Engine API
Service Management API
Service Usage API
Stackdriver API
Stackdriver Debugger API
Stackdriver Profiler API
Stackdriver Provisioning Service Private 
Stackdriver Trace API

2) 集群设置

Stackdriver Logging **Valid**
Stackdriver Monitoring **Valid**

3) 另一个项目的相同来源和相同条件

上面的错误日志没有出现，并且记录准确有效。

◆1

oauthScopes:
  - https://www.googleapis.com/auth/cloud-platform
  serviceAccount: default
nodeIpv4CidrSize: 24
nodePools:
- autoscaling:
    enabled: true
    maxNodeCount: 3
  config:
    diskSizeGb: 100
    diskType: pd-standard
--
    oauthScopes:
    - https://www.googleapis.com/auth/cloud-platform
    serviceAccount: default
  initialNodeCount: 2
  instanceGroupUrls:
  - https://www.googleapis.com/****
  management:
    autoRepair: true
  name: default-pool
  selfLink:
        https://container.googleapis.com/****
  status: RUNNING

Answer 1

解决方法：使用无限制发行的服务账号作为资源。详细地说，在发布服务帐户时，没有设置步骤 3（授予需要作为此服务帐户执行操作的用户或组的访问权限。）。步骤中可以设置限制部分用户使用服务账号

来自@Delta

如何解决 GKE 上响应“403 unauthorized”的日志记录问题

How to solve a logging problem on GKE responsed "403 unauthorized"

logging

http-status-code-403

google-kubernetes-engine