google-cloud-platform - 授权来自 Cloud Function 的 Cloud SQL Admin API 调用
问题描述
我正在尝试构建小功能(后来部署到云功能)以将 BAK 文件恢复到云 sql。此函数将由 cron 触发。在阅读有关授权此 API 的文档时,我有点迷茫:https ://cloud.google.com/sql/docs/sqlserver/import-export/importing#importing_data_from_a_bak_file_in
已经创建了包含此角色的服务帐户:Cloud SQL Admin、Storage Admin、Storage Object Admin、Storage Object Viewer,并在创建 Cloud Function 但不起作用时从下拉列表中选择该服务帐户。
阅读此内容后还尝试生成 API 密钥:https ://cloud.google.com/sql/docs/sqlserver/admin-api/how-tos/authorizing
所以我的 POST 网址变成了这样:
https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id/import?key=generatedAPIKey
但仍然出现错误:
"error": {
"code": 401,
"message": "Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.",
"errors": [
{
"message": "Login Required.",
"domain": "global",
"reason": "required",
"location": "Authorization",
"locationType": "header"
}
],
"status": "UNAUTHENTICATED"
}
}
我需要为此使用 Oauth 2 吗?这是我在 Cloud Function 中的代码:
import http.client
import mimetypes
def restore_bak(request):
conn = http.client.HTTPSConnection("www.googleapis.com")
payload = "{\r\n \"importContext\":\r\n {\r\n \"fileType\": \"BAK\",\r\n \"uri\": \"gs://{bucket_name}/{backup_name}.bak\",\r\n \"database\": \"{database_name}\"\r\n }\r\n}\r\n"
headers = {
'Content-Type': 'application/json'
}
conn.request("POST", "/sql/v1beta4/projects/{project_id}/instances/{instance_name}/import", payload, headers)
res = conn.getresponse()
data = res.read()
print(data.decode("utf-8"))
return(data.decode("utf-8"))
解决方案
这看起来像 python,所以我建议使用Discovery Client Library for Python。这个库为 SQL Admin API 提供了一个方便的包装器:
# Construct the service object for the interacting with the Cloud SQL Admin API.
service = discovery.build('sqladmin', 'v1beta4', http=http)
req = service.instances().list(project="PROJECT_ID")
resp = req.execute()
print json.dumps(resp, indent=2)
默认情况下,此库使用“应用程序默认凭据 (ADC) ”策略从环境中获取您的凭据。
您还可以通过创建 oauth2 令牌并将其设置为请求中的标头来手动验证您的请求(例如,如果您想使用 asyncio)。最简单的方法是使用 google-auth 包获取 ADC 并将其设置为标头:
import google.auth
import google.auth.transport.requests
credentials, project_id = google.auth.default()
credentials.refresh(google.auth.transport.requests.Request())
headers = {
"Authorization": "Bearer {}".format(credentials.token),
"Content-Type": "application/json"
}
推荐阅读
- amazon-web-services - AWS AppConfig and Parameter Store
- android - How to change TextInputLayout or AutoCompleteTextView's ripple color in Java?
- python - Match consecutive vowels
- javascript - Timer interval increases as I activate extra timers
- haskell - Actual type is `Maybe (Maybe [(Nucleotide, Int)])` when I expect it to be `[(Nucleotide, Int)]`
- python - Tensorflow Dataset - dataset.repeat()
- reactjs - Array Passed in Props Showing Up as Empty
- javascript - Is there any way to prohibit the screen from scrolling when moving input type=range?
- python-3.x - 从 yahoofinancials 下载共同基金最低初始投资
- javascript - Add linear gradient and url nested inside a background image declaration using React js