Use gcloud with jenkins

Question

I am trying to write a script that periodically checks Google cloud storage. This works fine when I run it normally, but if I enable it as a build step in Jenkins, it will give 403 Forbidden error. This is because the gcloud auth login process for which you want to copy the verification code is not completed for the Jenkins user. How to do this using Jenkins?

EDIT:

I tried the steps: https://cloud.google.com/storage/docs/authentication#service_accounts and downloaded the JSON key, which looks like this:

 {"web":{"auth_uri":"https://accounts.google.com/o/oauth2/auth","token_uri":"https://accounts.google.com/o/oauth2/token","client_email":" [e-mail] ","client_x509_cert_url":"https://www.googleapis.com/robot/v1/metadata/x509/ [e-mail] ","client_id":"....project.googleusercontent.com","auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs"}} 

which is damn weird because all links point to things like bad request, invalid request .. I have to do something wrong. The command I ran was:

 gcloud auth activate-service-account [e-mail] --key-file /var/lib/jenkins/....project.googleusercontent.com.json 

Answer 1

It is best to use a “service account” to authenticate gcloud / gsutil with GCS. Basic steps: use the generated JSON private key as instructed here:

 https://cloud.google.com/storage/docs/authentication#service_accounts 

Copy this key to the place where the Jenkins user can read it, and how the Jenkins user starts

 gcloud auth activate-service-account ... 

(see https://cloud.google.com/storage/docs/authentication#service_accounts ). Please note that JSON key file support is fairly new, and you will need an updated version of gcloud.

From there, your Jenkins process should have access to GCS, as usual.

The key file should have the following format:

 { "private_key_id": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", "private_key": "-----BEGIN PRIVATE KEY-----\n ... \n-----END PRIVATE KEY-----\n", "client_email": " [e-mail] ", "client_id": "..." "type": "service_account" }