代码之家 › 专栏 › 技术社区 › Chris Stryczynski

gcloud docker push导致“拒绝:项目'gcp project id example'的令牌交换失败。”

gcloud google-cloud-platform docker

Chris Stryczynski · 技术社区 · 7 年前

我已经跑了 gcloud auth login , gcloud auth configure-docker , gcloud components install docker-credential-gcr , gcloud config set project gcp-project-id-example .

我之前已经推到了这个存储库,所以我有点惊讶它现在不工作了?我已经通过了 gcloud身份验证登录 我的用户拥有完整的编辑权限。

sudo gcloud docker -- push eu.gcr.io/gcp-project-id-example/pipelinebuild:latest
WARNING: `gcloud docker` will not be supported for Docker client versions above 18.03.

As an alternative, use `gcloud auth configure-docker` to configure `docker` to
use `gcloud` as a credential helper, then use `docker` as you would for non-GCR
registries, e.g. `docker pull gcr.io/project-id/my-image`. Add
`--verbosity=error` to silence this warning: `gcloud docker
--verbosity=error -- pull gcr.io/project-id/my-image`.

See: https://cloud.google.com/container-registry/docs/support/deprecation-notices#gcloud-docker

The push refers to repository [eu.gcr.io/gcp-project-id-example/pipelinebuild]
09a1efc2708d: Preparing
484c62332bc0: Preparing
737446294222: Preparing
5330921097a0: Preparing
898d09fcad4e: Preparing
8ebe2c7c93e3: Waiting
2d360789868b: Waiting
43c7850e5ceb: Waiting
212ad79ba733: Waiting
b12c0a65bf50: Waiting
2ec89235b54b: Waiting
770a49082d40: Waiting
2a4ee56ebd9d: Waiting
f38582ca1d15: Waiting
3cc68fcb53a4: Waiting
577d10d964a3: Waiting
96e5efb05969: Waiting
aae94198c5bb: Waiting
9e5b0f110abc: Waiting
bddf843523ce: Waiting
6ab9447934c9: Waiting
9cc1209e0dce: Waiting
072f13fb321e: Waiting
0926f7bf84b3: Waiting
cdb414de0edf: Waiting
eceffb9b1d52: Waiting
6219baf3e782: Waiting
c9189dccc6a7: Waiting
93715b5af77e: Waiting
032237575276: Waiting
5f70bf18a086: Waiting
0d81735d8272: Waiting
982549bd6b32: Waiting
8698b31c92d5: Waiting
denied: Token exchange failed for project 'gcp-project-id-example'. Caller does not have permission 'storage.buckets.get'. To configure permissions, follow instructions at: https://cloud.google.com/container-registry/docs/access-control

我也试过:

docker login -u _json_key --password-stdin https://eu.gcr.io < aysc.json :

WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

但还是有同样的行为 gcloud docker -- push ... 或者只是 docker push ... .

我刚刚从零开始创建了一个全新的gcp项目,我仍然有同样的行为。我想我的系统必须重新配置。

为什么我会犯这个错误?

6 回复 | 直到 7 年前

Maoz Zadok 7 年前

创建并下载keyfile.json之后我将google_application_凭据导出到文件的位置

export GOOGLE_APPLICATION_CREDENTIALS=/var/lib/jenkins/gcp/keyfile.json

我就是这么做的:

docker login -u _json_key -p "`cat ${GOOGLE_APPLICATION_CREDENTIALS}`" https://gcr.io

希望有帮助

Gilbert L 7 年前

我怀疑问题出在sudo身上。我可以在不使用sudo的情况下对gcr.io/some-registry/some-image执行“docker push”。突然,我无法运行相同的“docker push”命令,得到了“denied:token exchange failed for my gcp project”。

Chris Stryczynski 7 年前

似乎在使用 sudo (我需要访问我机器上的Docker)。

直接从根目录运行时运行良好…所以可能是虫子。

我想是以前同名服务帐户的缓存造成的(参见此处 https://github.com/kubernetes/kubernetes/issues/34395 )

Chris Stryczynski 6 年前

当你奔跑 gcloud auth configure-docker 作为普通用户,它将配置文件保存在 ~/.docker/config.json -当通过 root 用户或 sudo …

所以简单的工作就是 sudo -u $USER docker push gcr.io/example/example:latest

slfan Narendra 6 年前

运行此命令再次激活令牌-

gcloud auth print-access-token | docker login -u oauth2accesstoken --password-stdin https://gcr.io

courtesy

-1

alexander.polomodov Alex Hawking 7 年前

在运行Docker登录之前,请尝试:

gcloud auth activate-service-account --key-file new-service-account-credentials.json

这只需要做一次。