Using Google Cloud Source Repositories with service account

Question

Is it possible to access a Google Cloud Source Repository in an automated way, i.e. from a GCE instance using a service account?

The only authentication method I am seeing in the docs is to use the gcloud auth login command, which will authenticate my personal user to access the repo, not the machine I am running commands from.

Answer 1

If you are running on GCE, take advantage of the new authentication method that needs fewer lines of code.

When creating your VM instance, under "Access & Security," set "Cloud Platform" to "Enabled."

Then the authentication code is this simple:

from oauth2client.client import GoogleCredentials
credentials = GoogleCredentials.get_application_default()
http = credentials.authorize(httplib2.Http())

See https://developers.google.com/identity/protocols/application-default-credentials

Answer 2

On GCE vms running

gcloud source repos clone default ~/my_repo

should work automatically without extra step of authentication, as it will use VMs service account.

If you running on some other machine you can download from https://console.cloud.google.com service account .json key file and activate it with

gcloud auth activate-service-account --key-file KEY_FILE

and then run the above clone command.

Answer 3

If you want to clone with git rather than running through gcloud, you can run:

git config --global credential.helper gcloud.sh

...and then this will work:

git clone https://source.developers.google.com/p/$PROJECT/r/$REPO

Answer 4

1. Enable access to the "Cloud Source Repositories" Cloud API for the instance. You should do this while creating or editing the instance in the Admin console
2. From a shell inside the instance, execute gcloud source repos clone <repo_name_in_cloud_source> <target_path_to_clone_into>

Answer 5

In case somebody like me was trying to do this as part of Dockerfile, after struggling for a while I've only managed to get it to work like this:

RUN gcloud auth activate-service-account --key-file KEY_FILE ; \
    gcloud source repos clone default ~/my_repo

As you can see, having it to be part of the same RUN command was the key, otherwise it kept failing with

ERROR: (gcloud.source.repos.clone) You do not currently have an active account selected.