Skip to content

Update the gcloud auth commands. #683

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ensonic merged 1 commit into from
May 18, 2026
+7 −7
Merged

Update the gcloud auth commands. #683

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/how-to/connecting-robot.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ Once you've done this, you can:
> gcloud iam service-accounts add-iam-policy-binding "${SA}" \
> --role=roles/iam.serviceAccountTokenCreator \
> --project="${PROJECT_ID}" --member="user:${YOUR_EMAIL_ADDRESS:?}"
> gcloud auth print-access-token --impersonate-service-account="${SA}"
> gcloud auth application-default print-access-token --impersonate-service-account="${SA}"
> ```
>
> If you see `ERROR: Failed to impersonate ...`, wait a few minutes for the IAM
Expand Down
2 changes: 1 addition & 1 deletion src/bootstrap/cloud/terraform/service-account.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,7 +106,7 @@ resource "google_service_account_iam_member" "human-acl-act-as-self" {

# Grant permissions to generate tokens for registering new workcell clusters.
# This lets users run:
# gcloud auth print-access-token \
# gcloud auth application-default print-access-token \
Comment thread
drigz marked this conversation as resolved.
# --impersonate-service-account=human-acl@${PROJECT_ID}.iam.gserviceaccount.com
# so they can register new workcell clusters without passing their own tokens
# (which aren't limited to a single GCP project) into the cluster.
Expand Down
10 changes: 5 additions & 5 deletions src/go/cmd/token-vendor/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,31 +168,31 @@ PROJECT=testproject
Publish a key for the device `robot-dev-testuser`:

```bash
curl -D - --max-time 3 --data-binary "@api/v1/testdata/rsa_cert.pem" -H "Authorization: Bearer $(gcloud auth print-access-token)" -H "Content-type: application/x-pem-file" https://www.endpoints.${PROJECT}.cloud.goog/apis/core.token-vendor/v1/public-key.publish?device-id=robot-dev-testuser
curl -D - --max-time 3 --data-binary "@api/v1/testdata/rsa_cert.pem" -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" -H "Content-type: application/x-pem-file" https://www.endpoints.${PROJECT}.cloud.goog/apis/core.token-vendor/v1/public-key.publish?device-id=robot-dev-testuser
```

Optionally set extra options for the device:

```bash
curl -D - --max-time 3 -d '{"service-account":"svc@${PROJECT}.iam.gserviceaccount.com"}' -H "Content-Type: application/json" -H "Authorization: Bearer $(gcloud auth print-access-token)" -H "Content-type: application/x-pem-file" https://www.endpoints.${PROJECT}.cloud.goog/apis/core.token-vendor/v1/public-key.configure?device-id=robot-dev-testuser
curl -D - --max-time 3 -d '{"service-account":"svc@${PROJECT}.iam.gserviceaccount.com"}' -H "Content-Type: application/json" -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" -H "Content-type: application/x-pem-file" https://www.endpoints.${PROJECT}.cloud.goog/apis/core.token-vendor/v1/public-key.configure?device-id=robot-dev-testuser
```

Read the key again:

```bash
curl -D - --max-time 3 -H "Authorization: Bearer $(gcloud auth print-access-token)" https://www.endpoints.${PROJECT}.cloud.goog/apis/core.token-vendor/v1/public-key.read?device-id=robot-dev-testuser
curl -D - --max-time 3 -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" https://www.endpoints.${PROJECT}.cloud.goog/apis/core.token-vendor/v1/public-key.read?device-id=robot-dev-testuser
```

Verify if your local user account has access to the human and robot ACL:

```bash
curl -D - --max-time 3 -H "Authorization: Bearer $(gcloud auth print-access-token)" https://www.endpoints.${PROJECT}.cloud.goog/apis/core.token-vendor/v1/token.verify
curl -D - --max-time 3 -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" https://www.endpoints.${PROJECT}.cloud.goog/apis/core.token-vendor/v1/token.verify
```

and

```bash
curl -D - --max-time 3 -H "Authorization: Bearer $(gcloud auth print-access-token)" https://www.endpoints.${PROJECT}.cloud.goog/apis/core.token-vendor/v1/token.verify?robots=true
curl -D - --max-time 3 -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" https://www.endpoints.${PROJECT}.cloud.goog/apis/core.token-vendor/v1/token.verify?robots=true
```

Request a cloud access token for the robot. First generate a valid JWT using the intstructions at [testdata/README.md](api/v1/testdata/README.md). Afterwards use it to request the cloud token:
Expand Down
Loading